From 02fb01166eb5ee11473ecc2ccd5cb5a2a92528a1 Mon Sep 17 00:00:00 2001
From: Stefan Monnier <monnier@iro.umontreal.ca>
Date: Tue, 26 May 2026 15:54:34 -0400
Subject: [PATCH] Gnus: Prefer passing functions to message-add-action

Building code with code is tricky.  E.g. the code in gnus-draft-setup
suffered from a security issue because it forgot to quote
some arguments (see commit 142b1e0d4c3).

* lisp/gnus/gnus-salt.el (gnus-pick-setup-message):
* lisp/gnus/gnus-msg.el (gnus-inews-add-send-actions):
* lisp/gnus/gnus-draft.el (gnus-draft-setup): Prefer passing functions
to message-add-action over passing it ELisp expressions.

* lisp/gnus/message.el (message-do-actions): Drop errors but not silently.
---
 lisp/gnus/gnus-draft.el | 14 +++++++-------
 lisp/gnus/gnus-msg.el   | 19 ++++++++++---------
 lisp/gnus/gnus-salt.el  |  7 ++++---
 lisp/gnus/message.el    |  3 ++-
 lisp/gnus/nndraft.el    |  2 +-
 5 files changed, 24 insertions(+), 21 deletions(-)

diff --git a/lisp/gnus/gnus-draft.el b/lisp/gnus/gnus-draft.el
index 9d5b8baba3f..89b20c91fda 100644
--- a/lisp/gnus/gnus-draft.el
+++ b/lisp/gnus/gnus-draft.el
@@ -273,13 +273,13 @@ If DONT-POP is nil, display the buffer after setting it up."
       (setq message-post-method
             (lambda (arg) (gnus-post-method arg (car ga))))
       (unless (equal (cadr ga) "")
-        (dolist (article (cdr ga))
-          (message-add-action
-           `(progn
-              (gnus-add-mark ,(car ga) 'replied ,article)
-              (gnus-request-set-mark ,(car ga) (list (list (list ,article)
-                                                           'add '(reply)))))
-           'send))))
+        (let ((group (car ga)))
+          (dolist (article (cdr ga))
+            (message-add-action
+             (lambda ()
+               (gnus-add-mark group 'replied article)
+               (gnus-request-set-mark group `(((,article) add (reply)))))
+             'send)))))
     (run-hooks 'gnus-draft-setup-hook)))
 
 (defun gnus-draft-article-sendable-p (article)
diff --git a/lisp/gnus/gnus-msg.el b/lisp/gnus/gnus-msg.el
index a478093fc6c..4318de613b0 100644
--- a/lisp/gnus/gnus-msg.el
+++ b/lisp/gnus/gnus-msg.el
@@ -544,10 +544,10 @@ instead."
 	(let ((gn gnus-newsgroup-name))
 	  (lambda (&optional arg) (gnus-post-method arg gn))))
   (message-add-action
-   `(progn
-      (setq gnus-current-window-configuration ',winconf-name)
-      (when (gnus-buffer-live-p ,buffer)
-	(set-window-configuration ,winconf)))
+   (lambda ()
+     (setq gnus-current-window-configuration winconf-name)
+     (when (gnus-buffer-live-p buffer)
+       (set-window-configuration winconf)))
    'exit 'postpone 'kill)
   (let ((to-be-marked (cond
 		       (yanked
@@ -556,12 +556,13 @@ instead."
 		       (article (if (listp article) article (list article)))
 		       (t nil))))
     (message-add-action
-     `(when (gnus-buffer-live-p ,buffer)
-	(with-current-buffer ,buffer
-	  ,(when to-be-marked
+     (lambda ()
+       (when (gnus-buffer-live-p buffer)
+	 (with-current-buffer buffer
+	   (when to-be-marked
 	     (if (eq config 'forward)
-		 `(gnus-summary-mark-article-as-forwarded ',to-be-marked)
-	       `(gnus-summary-mark-article-as-replied ',to-be-marked)))))
+		 (gnus-summary-mark-article-as-forwarded to-be-marked)
+	       (gnus-summary-mark-article-as-replied to-be-marked))))))
      'send)))
 
 ;;; Post news commands of Gnus group mode and summary mode
diff --git a/lisp/gnus/gnus-salt.el b/lisp/gnus/gnus-salt.el
index d70f7f8fe5c..e4b2cf99616 100644
--- a/lisp/gnus/gnus-salt.el
+++ b/lisp/gnus/gnus-salt.el
@@ -119,9 +119,10 @@ It accepts the same format specs that `gnus-summary-line-format' does."
   (when (and (gnus-buffer-live-p gnus-summary-buffer)
 	     (with-current-buffer gnus-summary-buffer
 	       gnus-pick-mode))
-    (message-add-action
-     `(gnus-configure-windows ,gnus-current-window-configuration t)
-     'send 'exit 'postpone 'kill)))
+    (let ((gcwc gnus-current-window-configuration))
+      (message-add-action
+       (lambda () (gnus-configure-windows gcwc t))
+       'send 'exit 'postpone 'kill))))
 
 (defvar gnus-pick-line-number 1)
 (defun gnus-pick-line-number ()
diff --git a/lisp/gnus/message.el b/lisp/gnus/message.el
index 671c3fdc1bc..6531669087b 100644
--- a/lisp/gnus/message.el
+++ b/lisp/gnus/message.el
@@ -4762,10 +4762,11 @@ Valid types are `send', `return', `exit', `kill' and `postpone'."
 	   (delq action (symbol-value var))))))
 
 (defun message-do-actions (actions)
+  ;; FIXME: Replace it with `run-hooks'?
   "Perform all actions in ACTIONS."
   ;; Now perform actions on successful sending.
   (dolist (action actions)
-    (ignore-errors
+    (with-demoted-errors "message-do-actions: %S"
       (cond
        ;; A simple function.
        ((functionp action)
diff --git a/lisp/gnus/nndraft.el b/lisp/gnus/nndraft.el
index 133ebe734eb..e59d680e92d 100644
--- a/lisp/gnus/nndraft.el
+++ b/lisp/gnus/nndraft.el
@@ -207,7 +207,7 @@ are generated if and only if they are also in `message-draft-headers'."
     (clear-visited-file-modtime)
     (add-hook 'write-contents-functions #'nndraft-generate-headers nil t)
     (add-hook 'after-save-hook #'nndraft-update-unread-articles nil t)
-    (message-add-action '(nndraft-update-unread-articles)
+    (message-add-action #'nndraft-update-unread-articles
 			'exit 'postpone 'kill)
     article))