From mboxrd@z Thu Jan 1 00:00:00 1970 Path: news.gmane.io!.POSTED.blaine.gmane.org!not-for-mail From: Christopher Howard Newsgroups: gmane.emacs.devel Subject: Re: Emacs Arbitrary Code Execution and How to Avoid It Date: Wed, 04 Dec 2024 08:23:45 -0900 Message-ID: <87ldwvgy5a.fsf@librehacker.com> References: <878qswfya2.fsf@librehacker.com> <87v7vzh4l1.fsf@stebalien.com> Mime-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: quoted-printable Injection-Info: ciao.gmane.io; posting-host="blaine.gmane.org:116.202.254.214"; logging-data="21360"; mail-complaints-to="usenet@ciao.gmane.io" Cc: Emacs Devel Mailing List To: Steven Allen Original-X-From: emacs-devel-bounces+ged-emacs-devel=m.gmane-mx.org@gnu.org Wed Dec 04 18:24:36 2024 Return-path: Envelope-to: ged-emacs-devel@m.gmane-mx.org Original-Received: from lists.gnu.org ([209.51.188.17]) by ciao.gmane.io with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.92) (envelope-from ) id 1tIt76-0005NL-1A for ged-emacs-devel@m.gmane-mx.org; Wed, 04 Dec 2024 18:24:36 +0100 Original-Received: from localhost ([::1] helo=lists1p.gnu.org) by lists.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1tIt6m-00064r-7g; Wed, 04 Dec 2024 12:24:16 -0500 Original-Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1tIt6Z-0005xa-LG for emacs-devel@gnu.org; Wed, 04 Dec 2024 12:24:05 -0500 Original-Received: from mx.kolabnow.com ([212.103.80.155]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1tIt6R-0005kZ-Ec for emacs-devel@gnu.org; Wed, 04 Dec 2024 12:23:59 -0500 Original-Received: from localhost (unknown [127.0.0.1]) by mx.kolabnow.com (Postfix) with ESMTP id 33CAC3070CF6; Wed, 4 Dec 2024 18:23:51 +0100 (CET) Authentication-Results: ext-mx-out013.mykolab.com (amavis); dkim=pass (2048-bit key) reason="pass (just generated, assumed good)" header.d=kolabnow.com DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=kolabnow.com; h= content-transfer-encoding:content-type:content-type:mime-version :message-id:date:date:references:in-reply-to:subject:subject :from:from:received:received:received; s=dkim20240523; t= 1733333029; x=1735147430; bh=L/HhskxwrAD+0KAw4NgVNiglWhNSzGZ9RcU ii6hzPIg=; b=NZaURVwd4GzBdat8ga3mAVLkDhnp4cvmnTRUiYS8Nm307mUX2Jr KDkrWgd2WAInwrAISFdp53IJlv/L/1FFxMtvYZep37Q5K7PUvi5V7OF0bsFvjtay f9vG2gnUxzJ+bCSzN4ZDm+xIZj/lWl7Cz3WD1yDiA+N7rCNnvxbl8Bta/Z94Pn2Z biEuI0DiMn+86UtI5+SQijCn0WSpRGG5UPP0h6Mk6Zgs+Bh6oV6MDj+KY/70HefY g/HkFlFi0O+wgjPAOeUx83k+4eKHI2OqW/WTuLFs9CdRuOeZGMqEGUfq10sXfJHV enC25oidekRfrjtmwHJap4Ctn1TqwyI0+gg== X-Virus-Scanned: amavis at mykolab.com Original-Received: from mx.kolabnow.com ([127.0.0.1]) by localhost (ext-mx-out013.mykolab.com [127.0.0.1]) (amavis, port 10024) with ESMTP id 1qmZzT0NgyzC; Wed, 4 Dec 2024 18:23:49 +0100 (CET) Original-Received: from int-mx011.mykolab.com (unknown [10.9.13.11]) by mx.kolabnow.com (Postfix) with ESMTPS id 6BC253070CDF; Wed, 4 Dec 2024 18:23:48 +0100 (CET) Original-Received: from ext-subm010.mykolab.com (unknown [10.9.6.10]) by int-mx011.mykolab.com (Postfix) with ESMTPS id 6385723C632; Wed, 4 Dec 2024 18:23:48 +0100 (CET) In-Reply-To: (Jean Louis's message of "Wed, 4 Dec 2024 20:02:57 +0300") Received-SPF: none client-ip=212.103.80.155; envelope-from=christopher@librehacker.com; helo=mx.kolabnow.com X-Spam_score_int: -18 X-Spam_score: -1.9 X-Spam_bar: - X-Spam_report: (-1.9 / 5.0 requ) BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, RCVD_IN_VALIDITY_RPBL_BLOCKED=0.001, RCVD_IN_VALIDITY_SAFE_BLOCKED=0.001, SPF_HELO_NONE=0.001, SPF_NONE=0.001 autolearn=ham autolearn_force=no X-Spam_action: no action X-BeenThere: emacs-devel@gnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: "Emacs development discussions." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: emacs-devel-bounces+ged-emacs-devel=m.gmane-mx.org@gnu.org Original-Sender: emacs-devel-bounces+ged-emacs-devel=m.gmane-mx.org@gnu.org Xref: news.gmane.io gmane.emacs.devel:326041 Archived-At: Jean Louis writes: > I get it, though similar concepts are in many editors. As you said, > "if flymake is enabled" which means that user enabling flymake should > get informed of it. There is myriad of packages that can be created, > so "if" they are enabled to do specific things on specific triggers > that does not constitute and serious "security hole". It is all > conditional, and there are many conditions that may provide an open > door for malicious friends to execute whatever code. It is anyway > coming by spam. It requires 21st century literacy to recognize > something is wrong. We talk hypothetically, so far there is zero > victims, nothing happened, no damage, just sensationalism. It seems like a "significant" concern, if maybe not a "serious" one. I high= ly doubt I would every be caught in this way by a spam e-mail attachment. B= ut something I do very frequently is clone random repositories, including o= bscure new packages and advertised init.el code, and peruse through the eli= sp code with my Emacs editor. I don't think it is sensational to wonder abo= ut whether simply inspecting the code file (find-file) is going to allow fo= r immediate code execution that could do things like delete my ssh keys or = paste them to a bin Web site. With directory local variables, there is a mechanism in place that asks you= first if you want to apply the variables. So this sort of thing has been c= onsidered a valid concern. Perhaps, at the moment, a vanilla Emacs setup does not trigger this, but it= is something users should be aware of as they are considering various feat= ures to enable or install. If completion-preview-mode activates this, which= is a built-in feature, that seems worthy of note. And maybe some mitigatio= n could be programmed into Emacs =E2=80=94 I'm not sure. --=20 Christopher Howard