Re: Emacs Arbitrary Code Execution and How to Avoid It

[Jean Louis <bugs@gnu.support>]

* Christopher Howard <christopher@librehacker.com> [2024-12-03 20:56]:
> Hi, I read the interesting write up here:
> 
> https://eshelyaron.com/posts/2024-11-27-emacs-aritrary-code-execution-and-how-to-avoid-it.html
> 
> I wasn't terribly worried about this, as I don't *automatically* activate Flymake or Flycheck. But the article did mention that "code completion runs arbitrary code", and I was wondering more about that. I do not currently use Completion Preview mode. I have used Company in the past but company-mode is not currently activated. So, if I am just viewing an elisp file, i.e., not typing anything it in, nor running dabbrev commands, is there any danger? Should I setup Emacs to, by default, open all elisp files in View Mode?
> 
> Regarding dabbrev, I know dabbrev can search all buffers but I don't know if it does any macro expansion.
> 
> I was going to e-mail the author of the post, but cloudflare won't let me see his e-mail address.

In every programming language it is possible to obscure the code and execute arbitrary code.

I do not see it as special security issue, it is common, known.

-- 
Jean Louis