From: Augusto Stoffel <arstoffel@gmail.com>
To: Richard Stallman <rms@gnu.org>
Cc: monnier@iro.umontreal.ca, emacs-devel@gnu.org
Subject: Re: [RFC] MIME attachments for comint
Date: Thu, 30 Sep 2021 09:09:46 +0200 [thread overview]
Message-ID: <87czoqleth.fsf@gmail.com> (raw)
In-Reply-To: <E1mVp9Y-00039q-PV@fencepost.gnu.org> (Richard Stallman's message of "Thu, 30 Sep 2021 02:02:44 -0400")
On Thu, 30 Sep 2021 at 02:02, Richard Stallman <rms@gnu.org> wrote:
> [[[ To any NSA and FBI agents reading my email: please consider ]]]
> [[[ whether defending the US Constitution against all enemies, ]]]
> [[[ foreign or domestic, requires you to follow Snowden's example. ]]]
>
> > But TeX markup could in principle execute arbitrary code.
>
> I'm surprised and worried. Can you show how that can happen?
From the tex manpage:
-shell-escape
Enable the \write18{command} construct. The command can be any
shell command. This construct is normally disallowed for secu‐
rity reasons.
On luatex, this switch also controls the availability of certain Lua
functions: os.execute(), os.exec(), os.spawn(), and io.popen().
This option is off by default, or at least should be in a sane OS --
that's why I said “could in principle”. Also, I don't know exactly how
Org mode deals with this potential security issue in its LaTeX-preview
functionality, but I would expect this has been taken into
consideration.
In any case, I disabled TeX rendering in my little package for the time
being, until I'm confident it's safe.
next prev parent reply other threads:[~2021-09-30 7:09 UTC|newest]
Thread overview: 22+ messages / expand[flat|nested] mbox.gz Atom feed top
2021-09-27 19:00 [RFC] MIME attachments for comint Augusto Stoffel
2021-09-27 20:37 ` Stefan Monnier
2021-09-28 16:05 ` Augusto Stoffel
2021-09-28 19:26 ` Stefan Monnier
2021-09-30 6:02 ` Richard Stallman
2021-09-30 7:09 ` Augusto Stoffel [this message]
2021-10-02 23:17 ` Richard Stallman
2021-10-03 7:48 ` Augusto Stoffel
2021-10-04 22:23 ` Richard Stallman
2021-09-30 8:49 ` Gregory Heytings
2021-10-04 22:25 ` Richard Stallman
2021-09-30 7:34 ` Colin Baxter
2021-09-28 5:36 ` Lars Ingebrigtsen
2021-09-28 16:09 ` Augusto Stoffel
2021-09-28 16:29 ` Robin Tarsiger
2021-09-28 18:22 ` Augusto Stoffel
2021-09-29 5:35 ` Lars Ingebrigtsen
2021-10-17 16:20 ` Stefan Monnier
2021-10-17 16:32 ` Stefan Monnier
2021-10-18 8:22 ` Augusto Stoffel
2021-10-18 16:44 ` comint-mime and loccur update (was: [RFC] MIME attachments for comint) Stefan Monnier
2021-10-20 12:17 ` Alexey Veretennikov
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
List information: https://www.gnu.org/software/emacs/
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=87czoqleth.fsf@gmail.com \
--to=arstoffel@gmail.com \
--cc=emacs-devel@gnu.org \
--cc=monnier@iro.umontreal.ca \
--cc=rms@gnu.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
Code repositories for project(s) associated with this public inbox
https://git.savannah.gnu.org/cgit/emacs.git
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for read-only IMAP folder(s) and NNTP newsgroup(s).