Re: [SECURITY] Arbitrary code evaluation security in Org (was: [PATCH] ob-core: add org-confirm-babel-evaluate-cell custom variable)

2023-01-07 Thread Ihor Radchenko
Ihor Radchenko writes: >> I do wonder if the idea of a document classification model and some form >> of heuristic algorithms to handle default document classification might >> be useful. > > I do not think that we need to go in this direction. > I doubt that we are qualified to get the heuristic

Re: [SECURITY] Arbitrary code evaluation security in Org (was: [PATCH] ob-core: add org-confirm-babel-evaluate-cell custom variable)

2023-01-03 Thread Ihor Radchenko
Tim Cross writes: >> 1. Introduce a new customization `org-confirm-evaluate-safe-regexps' >>listing regexps that are considered safe or cons cells >>(src-body/header-arg/table/macro/diary . regexp) >> >> 2. Introduce a new customization `org-confirm-evaluate' that can be set >>to t/ni

[SECURITY] Tangling can overwrite arbitrary tangling targets, including important user files (was: [SECURITY] Arbitrary code evaluation security in Org)

2023-01-03 Thread Ihor Radchenko
Greg Minshall writes: > one additional item (i don't *think* we discussed this before; apologies > if i'm forgetting): tangling. if one is prompted to "merely" tangle ... > > #+begin_src sh :tangle /var/tmp/foo.org.tangled > echo 'hi!' > #+end_src > > > one could imagine more siniste

Re: [SECURITY] Arbitrary code evaluation security in Org (was: [PATCH] ob-core: add org-confirm-babel-evaluate-cell custom variable)

2023-01-02 Thread Tim Cross
Ihor Radchenko writes: > Ihor Radchenko writes: > >> P.S. Considering intense discussion around the topic, what about >> reverting my commit from the release? We can then re-consider the whole >> design and apply something more elaborate later. > > I now reverted the discussed commit. > https:

Re: [SECURITY] Arbitrary code evaluation security in Org

2023-01-02 Thread Greg Minshall
Ihor, thanks for this. one additional item (i don't *think* we discussed this before; apologies if i'm forgetting): tangling. if one is prompted to "merely" tangle ... #+begin_src sh :tangle /var/tmp/foo.org.tangled echo 'hi!' #+end_src one could imagine more sinister scenarios for

[SECURITY] Arbitrary code evaluation security in Org (was: [PATCH] ob-core: add org-confirm-babel-evaluate-cell custom variable)

2023-01-02 Thread Ihor Radchenko
Ihor Radchenko writes: > P.S. Considering intense discussion around the topic, what about > reverting my commit from the release? We can then re-consider the whole > design and apply something more elaborate later. I now reverted the discussed commit. https://git.savannah.gnu.org/cgit/emacs/org-