From: Christopher Howard <christopher@librehacker.com>
To: Emacs Devel Mailing List <emacs-devel@gnu.org>
Subject: Emacs Arbitrary Code Execution and How to Avoid It
Date: Tue, 03 Dec 2024 08:53:57 -0900 [thread overview]
Message-ID: <878qswfya2.fsf@librehacker.com> (raw)
Hi, I read the interesting write up here:
https://eshelyaron.com/posts/2024-11-27-emacs-aritrary-code-execution-and-how-to-avoid-it.html
I wasn't terribly worried about this, as I don't *automatically* activate Flymake or Flycheck. But the article did mention that "code completion runs arbitrary code", and I was wondering more about that. I do not currently use Completion Preview mode. I have used Company in the past but company-mode is not currently activated. So, if I am just viewing an elisp file, i.e., not typing anything it in, nor running dabbrev commands, is there any danger? Should I setup Emacs to, by default, open all elisp files in View Mode?
Regarding dabbrev, I know dabbrev can search all buffers but I don't know if it does any macro expansion.
I was going to e-mail the author of the post, but cloudflare won't let me see his e-mail address.
--
📛 Christopher Howard
🚀 gemini://gem.librehacker.com
🌐 http://gem.librehacker.com
בראשית ברא אלהים את השמים ואת הארץ
next reply other threads:[~2024-12-03 17:53 UTC|newest]
Thread overview: 29+ messages / expand[flat|nested] mbox.gz Atom feed top
2024-12-03 17:53 Christopher Howard [this message]
2024-12-03 19:20 ` Emacs Arbitrary Code Execution and How to Avoid It Gerd Möllmann
2024-12-03 20:25 ` Eshel Yaron
2024-12-08 5:10 ` Richard Stallman
2024-12-06 4:47 ` Richard Stallman
2024-12-06 8:30 ` Eli Zaretskii
2024-12-09 4:57 ` Richard Stallman
2024-12-09 13:59 ` Eli Zaretskii
2024-12-04 9:39 ` Jean Louis
2024-12-04 15:04 ` Steven Allen
2024-12-04 17:02 ` Jean Louis
2024-12-04 17:23 ` Christopher Howard
2024-12-07 4:23 ` Richard Stallman
2024-12-10 18:03 ` Daniel Radetsky
2024-12-11 8:35 ` Eshel Yaron
2024-12-11 9:25 ` Jean Louis
2024-12-11 9:37 ` Daniel Radetsky
2024-12-11 10:38 ` Jean Louis
2024-12-11 10:42 ` tomas
2024-12-11 12:50 ` Daniel Radetsky
2024-12-11 13:10 ` tomas
2024-12-12 4:48 ` Richard Stallman
2024-12-12 7:39 ` Jean Louis
2024-12-06 4:47 ` Richard Stallman
2024-12-06 5:30 ` Jim Porter
2024-12-06 8:32 ` Eli Zaretskii
2024-12-06 8:29 ` Eli Zaretskii
2024-12-06 16:51 ` Philip Kaludercic
2024-12-08 5:15 ` Richard Stallman
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=878qswfya2.fsf@librehacker.com \
--to=christopher@librehacker.com \
--cc=emacs-devel@gnu.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
Code repositories for project(s) associated with this external index
https://git.savannah.gnu.org/cgit/emacs.git
https://git.savannah.gnu.org/cgit/emacs/org-mode.git
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.