From mboxrd@z Thu Jan 1 00:00:00 1970 Path: news.gmane.io!.POSTED.blaine.gmane.org!not-for-mail From: Jean Louis Newsgroups: gmane.emacs.bugs,gmane.emacs.orgmode Subject: bug#58774: 29.0.50; [WISH]: Let us make EWW browse WWW Org files correctly Date: Wed, 26 Oct 2022 10:57:16 +0300 Message-ID: References: <86bkq0qf8p.fsf@protected.rcdrun.com> <87bkq0t03l.fsf@web.de> <87r0yvsgtt.fsf@web.de> Mime-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 8bit Injection-Info: ciao.gmane.io; posting-host="blaine.gmane.org:116.202.254.214"; logging-data="24691"; mail-complaints-to="usenet@ciao.gmane.io" User-Agent: Mutt/2.2.7+37 (a90f69b) (2022-09-02) Cc: 58774@debbugs.gnu.org, emacs-orgmode@gnu.org To: "Dr. Arne Babenhauserheide" Original-X-From: bug-gnu-emacs-bounces+geb-bug-gnu-emacs=m.gmane-mx.org@gnu.org Wed Oct 26 10:04:09 2022 Return-path: Envelope-to: geb-bug-gnu-emacs@m.gmane-mx.org Original-Received: from lists.gnu.org ([209.51.188.17]) by ciao.gmane.io with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.92) (envelope-from ) id 1onbOT-0006BL-4s for geb-bug-gnu-emacs@m.gmane-mx.org; Wed, 26 Oct 2022 10:04:09 +0200 Original-Received: from localhost ([::1] helo=lists1p.gnu.org) by lists.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1onbLe-0005Xs-1h; Wed, 26 Oct 2022 04:01:14 -0400 Original-Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1onbLU-0005TH-3J for bug-gnu-emacs@gnu.org; Wed, 26 Oct 2022 04:01:09 -0400 Original-Received: from debbugs.gnu.org ([209.51.188.43]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_128_GCM_SHA256:128) (Exim 4.90_1) (envelope-from ) id 1onbLS-0007hu-Ad for bug-gnu-emacs@gnu.org; Wed, 26 Oct 2022 04:01:03 -0400 Original-Received: from Debian-debbugs by debbugs.gnu.org with local (Exim 4.84_2) (envelope-from ) id 1onbLS-0004dD-52 for bug-gnu-emacs@gnu.org; Wed, 26 Oct 2022 04:01:02 -0400 X-Loop: help-debbugs@gnu.org Resent-From: Jean Louis Original-Sender: "Debbugs-submit" Resent-CC: bug-gnu-emacs@gnu.org Resent-Date: Wed, 26 Oct 2022 08:01:02 +0000 Resent-Message-ID: Resent-Sender: help-debbugs@gnu.org X-GNU-PR-Message: followup 58774 X-GNU-PR-Package: emacs X-GNU-PR-Keywords: wontfix X-Debbugs-Original-Cc: bug-gnu-emacs@gnu.org, emacs-orgmode@gnu.org Original-Received: via spool by submit@debbugs.gnu.org id=B.166677121517698 (code B ref -1); Wed, 26 Oct 2022 08:01:02 +0000 Original-Received: (at submit) by debbugs.gnu.org; 26 Oct 2022 08:00:15 +0000 Original-Received: from localhost ([127.0.0.1]:53190 helo=debbugs.gnu.org) by debbugs.gnu.org with esmtp (Exim 4.84_2) (envelope-from ) id 1onbKg-0004bM-Pz for submit@debbugs.gnu.org; Wed, 26 Oct 2022 04:00:15 -0400 Original-Received: from lists.gnu.org ([209.51.188.17]:52814) by debbugs.gnu.org with esmtp (Exim 4.84_2) (envelope-from ) id 1onbKe-0004bD-T9 for submit@debbugs.gnu.org; Wed, 26 Oct 2022 04:00:13 -0400 Original-Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1onbKV-0004zG-BS; Wed, 26 Oct 2022 04:00:04 -0400 Original-Received: from stw1.rcdrun.com ([217.170.207.13]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1onbKR-000759-39; Wed, 26 Oct 2022 04:00:01 -0400 Original-Received: from localhost ([::ffff:197.239.4.142]) (AUTH: PLAIN admin, TLS: TLS1.3,256bits,ECDHE_RSA_AES_256_GCM_SHA384) by stw1.rcdrun.com with ESMTPSA id 0000000000081D92.000000006358E8F9.00005D10; Wed, 26 Oct 2022 00:59:53 -0700 Mail-Followup-To: "Dr. Arne Babenhauserheide" , bug-gnu-emacs@gnu.org, emacs-orgmode@gnu.org Content-Disposition: inline In-Reply-To: <87r0yvsgtt.fsf@web.de> Received-SPF: pass client-ip=217.170.207.13; envelope-from=bugs@gnu.support; helo=stw1.rcdrun.com X-Spam_score_int: -17 X-Spam_score: -1.8 X-Spam_bar: - X-Spam_report: (-1.8 / 5.0 requ) BAYES_00=-1.9, RCVD_IN_SBL=0.141, SPF_HELO_PASS=-0.001, SPF_PASS=-0.001 autolearn=no autolearn_force=no X-Spam_action: no action X-BeenThere: debbugs-submit@debbugs.gnu.org X-Mailman-Version: 2.1.18 Precedence: list X-BeenThere: bug-gnu-emacs@gnu.org List-Id: "Bug reports for GNU Emacs, the Swiss army knife of text editors" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Original-Sender: "bug-gnu-emacs" Errors-To: bug-gnu-emacs-bounces+geb-bug-gnu-emacs=m.gmane-mx.org@gnu.org Xref: news.gmane.io gmane.emacs.bugs:246203 gmane.emacs.orgmode:149919 Archived-At: * Dr. Arne Babenhauserheide [2022-10-26 01:02]: > All of the Emacs packages have some amount of implicit trust. Users are unaware what package may do, and packages are everywhere on Internet. That is not a problem that I wish to solve. > If you ask me whether I can make this work safely: This would first > require the introduction of a safe-org-mode which strictly disables all > features that can execute remote code or disguise unsafe operations as > safe ones. If a user then decides to explicitly call M-x org-mode, > that’s their problem. Thanks, though, that was not my request. Please note that you miss very important issue, and that is that all browsers support customization on how to open specific content types, so it is quite trivial to customize in browser to open Common Lisp program with Common Lisp. Thus all of browsers who allow content type customization are analogous to problem you are presenting, which in fact is no practical problem at all. Find the victim first, then present the problem. To understand is that content type opening is generally not secure and that it is user choice. I am user of Org mode, and all I wish is to adapt eww to invoke command "org-mode" once content type text/x-org has been recognized. This way I can browse Org files directly, it is very useful for me as I have bunch of files. > If you ask me whether I know how to make this work unsafely: It likely > won’t need a lot of elisp reading, but I do not, because I do not look > for it, because if I did, I would not. Well then 👀 > I do not want to be the one who caused the systems of eww users to get > breached, or who helped opening that security hole. See above, all other content types and URL links may be customized by user to be opened how users want it. Your security presentation lacks the background knowledge. See the attached screenshot how easy it was to customize IceWeasel or Firefox derivate to open Org files by using Emacs client. I have script called "edit" which invoces emacsclient. -- Jean Take action in Free Software Foundation campaigns: https://www.fsf.org/campaigns In support of Richard M. Stallman https://stallmansupport.org/