Re: [RFC] MIME attachments for comint

[Stefan Monnier]

Augusto Stoffel [2021-09-28 18:05:35] wrote:
> On Mon, 27 Sep 2021 at 16:37, Stefan Monnier <monnier@iro.umontreal.ca> wrote:
>> Sounds like a cute package, thanks.
>>> Here are some more assorted observations:
>> Anything to say about security implications/measures?
> Good question, I didn't think about this.

I think such a feature needs to be quite careful and proactively
defensive about that.

> I guess it's safe to feed `create-image', `svg-image' and shr with any
> kind of evil data, no?

What could go wrong, right?
I recommend you place strong restrictions on the formats supported so as
to stay within bounds which you positively know are safe (e.g. no worse
than what happens already with SHR rendering when viewing HTML email).


        Stefan