* Re: [Emacs-diffs] master f373e81 1/2: New lispref section “Security Considerations”
[not found] ` <E1Zp6Wk-0005Cw-D3@vcs.savannah.gnu.org>
@ 2015-10-22 4:15 ` Stefan Monnier
2015-10-22 14:42 ` Eli Zaretskii
0 siblings, 1 reply; 2+ messages in thread
From: Stefan Monnier @ 2015-10-22 4:15 UTC (permalink / raw)
To: emacs-devel; +Cc: Paul Eggert
> * doc/lispref/os.texi (Security Considerations):
> New node.
There's also the fact that various features like file-local variables
mean that opening /some/file/some/where can be dangerous if that file or
some parent directory is under the control of an attacker.
We do some effort to protect against such holes, but the risk is very
real: it only takes a single package setting safe-local-variable too
optimistically (such as elpa/packages/ada-mode recently, IIRC).
Stefan
^ permalink raw reply [flat|nested] 2+ messages in thread* Re: [Emacs-diffs] master f373e81 1/2: New lispref section “Security Considerations”
2015-10-22 4:15 ` [Emacs-diffs] master f373e81 1/2: New lispref section “Security Considerations” Stefan Monnier
@ 2015-10-22 14:42 ` Eli Zaretskii
0 siblings, 0 replies; 2+ messages in thread
From: Eli Zaretskii @ 2015-10-22 14:42 UTC (permalink / raw)
To: Stefan Monnier; +Cc: eggert, emacs-devel
> From: Stefan Monnier <monnier@IRO.UMontreal.CA>
> Date: Thu, 22 Oct 2015 00:15:13 -0400
> Cc: Paul Eggert <eggert@cs.ucla.edu>
>
> > * doc/lispref/os.texi (Security Considerations):
> > New node.
>
> There's also the fact that various features like file-local variables
> mean that opening /some/file/some/where can be dangerous if that file or
> some parent directory is under the control of an attacker.
>
> We do some effort to protect against such holes, but the risk is very
> real: it only takes a single package setting safe-local-variable too
> optimistically (such as elpa/packages/ada-mode recently, IIRC).
I think at least some of this stuff should be in the User Manual,
perhaps worded slightly differently. Part of security is in the hands
of the users, Lisp programmers can do very little about that.
^ permalink raw reply [flat|nested] 2+ messages in thread
end of thread, other threads:[~2015-10-22 14:42 UTC | newest]
Thread overview: 2+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
[not found] <20151022032653.19962.53975@vcs.savannah.gnu.org>
[not found] ` <E1Zp6Wk-0005Cw-D3@vcs.savannah.gnu.org>
2015-10-22 4:15 ` [Emacs-diffs] master f373e81 1/2: New lispref section “Security Considerations” Stefan Monnier
2015-10-22 14:42 ` Eli Zaretskii
Code repositories for project(s) associated with this external index
https://git.savannah.gnu.org/cgit/emacs.git
https://git.savannah.gnu.org/cgit/emacs/org-mode.git
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.