Re: Avoiding arbitrary code execution with macroexpansion

[Wilfred Hughes <me@wilfred.me.uk>]

> Sounds like it. I suggest constructing a complete, self-contained and hopefully easy way to reproduce
> the problem with emacs -Q, and sending it in a bug report to bug-gnu-emacs@gnu.org. Thanks.

Done, #32495.

> Perhaps doing an flet of eval and apply would work.

I tried that, but it would require using flet with every function that
can evaluate code directly (i.e. doesn't itself call eval). I'm not
sure of the full list. I tried this:

(cl-letf (((symbol-function 'eval) #'ignore)
          ((symbol-function 'eval-region) #'ignore)
          ((symbol-function 'eval-buffer) #'ignore)
          ((symbol-function 'backtrace-eval) #'ignore))
  (macroexpand-all some-arbitrary-form-here))

but I know this is missing a few functions, such as load and load-file.

On 20 August 2018 at 04:04, Richard Stallman <rms@gnu.org> wrote:
> [[[ To any NSA and FBI agents reading my email: please consider    ]]]
> [[[ whether defending the US Constitution against all enemies,     ]]]
> [[[ foreign or domestic, requires you to follow Snowden's example. ]]]
>
>   > Using a macro that calls eval, such as eval-when-compile,
>   > eval-and-compile, c-lang-defconst-eval-immediately (undoubtedly others
>   > too), means anything can happen at macroexpansion time.
>
> Can we make macroexpand detect these cases and give an error?
> It would have to do a codewalk on the macro definition,
> but that is doable.
>
> Perhaps doing an flet of eval and apply would work.
>
>
> --
> Dr Richard Stallman
> President, Free Software Foundation (https://gnu.org, https://fsf.org)
> Internet Hall-of-Famer (https://internethalloffame.org)
>
>