This patch prevents a code execution vector involving terminal escape
sequences when rxvt-unicode is in "secure mode".

This change was spurred by the following conversation on the
oss-security mailing list:

Problem description and proof of concept:
http://seclists.org/oss-sec/2017/q2/190

Upstream response:
http://seclists.org/oss-sec/2017/q2/291

Patch copied from upstream source repository:
http://cvs.schmorp.de/rxvt-unicode/src/command.C?r1=1.582&r2=1.583

--- rxvt-unicode/src/command.C	2016/07/14 05:33:26	1.582
+++ rxvt-unicode/src/command.C	2017/05/18 02:43:18	1.583
@@ -2695,7 +2695,7 @@
         /* kidnapped escape sequence: Should be 8.3.48 */
       case C1_ESA:		/* ESC G */
         // used by original rxvt for rob nations own graphics mode
-        if (cmd_getc () == 'Q')
+        if (cmd_getc () == 'Q' && option (Opt_insecure))
           tt_printf ("\033G0\012");	/* query graphics - no graphics */
         break;
 
@@ -2914,7 +2914,7 @@
         break;
 
       case CSI_CUB:		/* 8.3.18: (1) CURSOR LEFT */
-      case CSI_HPB: 		/* 8.3.59: (1) CHARACTER POSITION BACKWARD */
+      case CSI_HPB:		/* 8.3.59: (1) CHARACTER POSITION BACKWARD */
 #ifdef ISO6429
         arg[0] = -arg[0];
 #else				/* emulate common DEC VTs */
ref='/guix/commit/guix.scm?id=d94ec407585dc4d34ec80a28567f98205c4f24c2'>commit</a><a href='/guix/diff/guix.scm?id=d94ec407585dc4d34ec80a28567f98205c4f24c2'>diff</a></td><td class='form'><form class='right' method='get' action='/guix/log/guix.scm'>
<input type='hidden' name='id' value='d94ec407585dc4d34ec80a28567f98205c4f24c2'/><select name='qt'>
<option value='grep'>log msg</option>
<option value='author'>author</option>
<option value='committer'>committer</option>
<option value='range'>range</option>
</select>
<input class='txt' type='search' size='10' name='q' value=''/>
<input type='submit' value='search'/>
</form>
</td></tr></table>
<div class='path'>path: <a href='/guix/log/?id=d94ec407585dc4d34ec80a28567f98205c4f24c2'>root</a>/<a href='/guix/log/guix.scm?id=d94ec407585dc4d34ec80a28567f98205c4f24c2'>guix.scm</a></div><div class='content'><table class='list nowrap'><tr class='nohover'><th class='left'>Age</th><th class='left'>Commit message (<a href='/guix/log/guix.scm?id=d94ec407585dc4d34ec80a28567f98205c4f24c2&amp;showmsg=1'>Expand</a>)</th><th class='left'>Author</th></tr>
ssage (<a href='/guix/log/etc/copyright.el?id=7abd6eecbb12513f0143e9d77d32d53bf14cf691&amp;showmsg=1'>Expand</a>)</th><th class='left'>Author</th></tr>
<tr><td><span title='2020-02-22 17:56:31 +0300'>2020-02-22</span></td><td><a href='/guix/commit/etc/copyright.el?id=9a3971143854bf877c0739fc8fdf7b945a2e3935'>etc: Add copyright.</a><span class='msg-avail'>...</span></td><td>Oleg Pykhalov</td></tr>