[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
Re: [O] [PATCH 1/3] Mark ox-latex variables safe locals under proper con
|
From: |
Nicolas Goaziou |
|
Subject: |
Re: [O] [PATCH 1/3] Mark ox-latex variables safe locals under proper conditions |
|
Date: |
Wed, 30 Oct 2013 09:35:54 +0100 |
Hello,
Aaron Ecay <address@hidden> writes:
> 2013ko urriak 29an, Nicolas Goaziou-ek idatzi zuen:
>> Out of curiosity, why did you skip other variables (e.g.
>> org-latex-footnote-separator)?
>
> Because these variables insert arbitrary latex code into the export
> output, they could be put to nefarious purposes. If I can trick you
> into compiling a latex document that I’ve inserted malicious code into,
> AND into passing a particular non-default command line flag to latex,
> then I can execute arbitrary shell commands on your machine with your
> privileges.
You are right. In my mind, "safe" meant safe Lisp-wise, not LaTeX-wise.
I applied your patch. Thank you.
Regards,
--
Nicolas Goaziou