From mboxrd@z Thu Jan 1 00:00:00 1970 Path: news.gmane.org!not-for-mail From: Dmitry Gutov Newsgroups: gmane.emacs.devel Subject: Re: [PATCH] Add shell-quasiquote. Date: Tue, 20 Oct 2015 19:59:46 +0300 Message-ID: <56267302.7050606@yandex.ru> References: <87si59wj42.fsf@T420.taylan> <878u6znii9.fsf@T420.taylan> <877fmjj9p6.fsf@fencepost.gnu.org> <87zizfm2dq.fsf@T420.taylan> <871tcr7yvq.fsf@fastmail.com> <87mvvfm0bd.fsf@T420.taylan> <56250803.5080601@cs.ucla.edu> <87a8ren5ys.fsf@T420.taylan> <56259BB1.3070908@cs.ucla.edu> <878u6ykmvt.fsf@T420.taylan> <87h9llvo98.fsf@members.fsf.org> <5626622A.3090707@yandex.ru> <87zizdijbp.fsf@T420.taylan> NNTP-Posting-Host: plane.gmane.org Mime-Version: 1.0 Content-Type: text/plain; charset=UTF-8; format=flowed Content-Transfer-Encoding: 8bit X-Trace: ger.gmane.org 1445360425 15724 80.91.229.3 (20 Oct 2015 17:00:25 GMT) X-Complaints-To: usenet@ger.gmane.org NNTP-Posting-Date: Tue, 20 Oct 2015 17:00:25 +0000 (UTC) Cc: Paul Eggert , Nicolas Richard , emacs-devel@gnu.org To: =?UTF-8?Q?Taylan_Ulrich_Bay=c4=b1rl=c4=b1/Kammer?= Original-X-From: emacs-devel-bounces+ged-emacs-devel=m.gmane.org@gnu.org Tue Oct 20 19:00:20 2015 Return-path: Envelope-to: ged-emacs-devel@m.gmane.org Original-Received: from lists.gnu.org ([208.118.235.17]) by plane.gmane.org with esmtp (Exim 4.69) (envelope-from ) id 1ZoaGo-0006e8-37 for ged-emacs-devel@m.gmane.org; Tue, 20 Oct 2015 19:00:18 +0200 Original-Received: from localhost ([::1]:47135 helo=lists.gnu.org) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1ZoaGn-0003NW-Kb for ged-emacs-devel@m.gmane.org; Tue, 20 Oct 2015 13:00:17 -0400 Original-Received: from eggs.gnu.org ([2001:4830:134:3::10]:44419) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1ZoaGP-0003CN-6w for emacs-devel@gnu.org; Tue, 20 Oct 2015 12:59:53 -0400 Original-Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1ZoaGL-00052t-SL for emacs-devel@gnu.org; Tue, 20 Oct 2015 12:59:53 -0400 Original-Received: from mail-wi0-x229.google.com ([2a00:1450:400c:c05::229]:37236) by eggs.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1ZoaGL-00052S-Gd for emacs-devel@gnu.org; Tue, 20 Oct 2015 12:59:49 -0400 Original-Received: by wicfv8 with SMTP id fv8so38470144wic.0 for ; Tue, 20 Oct 2015 09:59:49 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20120113; h=sender:subject:to:references:cc:from:message-id:date:user-agent :mime-version:in-reply-to:content-type:content-transfer-encoding; bh=tzDJtsaRZ5VKDXgjE9ygWrYD8XqKGNNbEoX5xiKERRs=; b=hf40nfOeJcIb6aou5k+3GYfAb8fn0DIMeetaZ085O1ghmD/OjjhTG9LU9fFBxDxnun lAQ3Yho3bX8r1WMrSkw6Ir3fQymBiwIUoxI7hRb8Jyua8r3oOjhf5VvRPEkBg256Z4sC 3AyFtxyNidTco+6JyhuHHAvd//CYTxkqI7lZ10baUnLbKpb+AbkdSm+oN9CNQhO31zjR XkdB4sShb7Kb0XHeHEYe8ZREoL4VXo2X2XWQHvIdI1M3e4dZhKCCaPNsuMJrTcyY3zyD REtJy++LH4FyBlwkaskOsk9Jte79zAT8vKRWtncoHv4rAdXZDIXnX+3lMBonrZgJ5Io+ E6OA== X-Received: by 10.194.239.230 with SMTP id vv6mr5468535wjc.21.1445360388943; Tue, 20 Oct 2015 09:59:48 -0700 (PDT) Original-Received: from [10.9.0.103] (nat.webazilla.com. [78.140.128.228]) by smtp.googlemail.com with ESMTPSA id jd7sm4963004wjb.19.2015.10.20.09.59.47 (version=TLSv1/SSLv3 cipher=OTHER); Tue, 20 Oct 2015 09:59:47 -0700 (PDT) User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:42.0) Gecko/20100101 Thunderbird/42.0 In-Reply-To: <87zizdijbp.fsf@T420.taylan> X-detected-operating-system: by eggs.gnu.org: Error: Malformed IPv6 address (bad octet value). X-Received-From: 2a00:1450:400c:c05::229 X-BeenThere: emacs-devel@gnu.org X-Mailman-Version: 2.1.14 Precedence: list List-Id: "Emacs development discussions." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: emacs-devel-bounces+ged-emacs-devel=m.gmane.org@gnu.org Original-Sender: emacs-devel-bounces+ged-emacs-devel=m.gmane.org@gnu.org Xref: news.gmane.org gmane.emacs.devel:192204 Archived-At: On 10/20/2015 07:41 PM, Taylan Ulrich Bayırlı/Kammer wrote: > I'm afraid it's effectively the same thing as using shell-quote-argument > directly in my code. It puts the responsibility on me, because if > shell-quote-argument breaks and I don't react fast enough to change > shqq--quote-string, it's my fault for having used a definition of > shqq--quote-string that was prone to breakage. So it would be okay if shell-quote-argument breaks and thus makes major functionality in Emacs vulnerable, but your tiny function in its small package is safe and sound? That's a nice set of priorities. Regarding responsibility, I repeat: contributing package to ELPA means that that the developers here share some of it. And your function, speaking in security terms, adds to the attack surface, not subtracts from it.