Re: Security implications of loading custom reports

2014-10-24 Thread John Ralls
> On Oct 24, 2014, at 7:29 AM, Derek Atkins wrote: > > John Ralls writes: > >> On Oct 23, 2014, at 9:25 AM, Derek Atkins wrote: >> >>> John Ralls writes: >>> > I'm not sure this is possible in guile only. A report is written as > a guile module. Loading the module already executes

Re: Security implications of loading custom reports

2014-10-24 Thread Derek Atkins
John Ralls writes: > On Oct 23, 2014, at 9:25 AM, Derek Atkins wrote: > >> John Ralls writes: >> I'm not sure this is possible in guile only. A report is written as a guile module. Loading the module already executes code (gnc:define-report). That code can be abused do bad thing

Re: Security implications of loading custom reports

2014-10-23 Thread John Ralls
On Oct 23, 2014, at 9:25 AM, Derek Atkins wrote: > John Ralls writes: > >>> I'm not sure this is possible in guile only. A report is written as >>> a guile module. Loading the module already executes code >>> (gnc:define-report). That code can be abused do bad things when >>> loading a custom

Re: Security implications of loading custom reports

2014-10-23 Thread Derek Atkins
John Ralls writes: >> I'm not sure this is possible in guile only. A report is written as >> a guile module. Loading the module already executes code >> (gnc:define-report). That code can be abused do bad things when >> loading a custom report. > > Wow. That’s an incredible failure for something

Re: Security implications of loading custom reports (was: Re: Custom reports do not load after upgrade to 2.6.4 on OSX)

2014-10-21 Thread John Ralls
On Oct 21, 2014, at 9:27 AM, Geert Janssens wrote: > I have moved this thread from gnucash-user as it was getting rather > technical... > > On Tuesday 21 October 2014 08:43:04 John Ralls wrote: > > > > > > > > One possible solution is to get Guile out of the file-opening > > > > loop. > > >

Security implications of loading custom reports (was: Re: Custom reports do not load after upgrade to 2.6.4 on OSX)

2014-10-21 Thread Geert Janssens
I have moved this thread from gnucash-user as it was getting rather technical... On Tuesday 21 October 2014 08:43:04 John Ralls wrote: > > > > > > One possible solution is to get Guile out of the file-opening > > > loop. > > > Having a configuration file that’s directly executed by Guile is a > >