Re: [SECURITY] Arbitrary code evaluation security in Org (was: [PATCH] ob-core: add org-confirm-babel-evaluate-cell custom variable)

2023-01-07 Thread Ihor Radchenko
Ihor Radchenko writes: >> I do wonder if the idea of a document classification model and some form >> of heuristic algorithms to handle default document classification might >> be useful. > > I do not think that we need to go in this direction. > I doubt that we are qualified to get the

Re: [SECURITY] Arbitrary code evaluation security in Org (was: [PATCH] ob-core: add org-confirm-babel-evaluate-cell custom variable)

2023-01-03 Thread Ihor Radchenko
Tim Cross writes: >> 1. Introduce a new customization `org-confirm-evaluate-safe-regexps' >>listing regexps that are considered safe or cons cells >>(src-body/header-arg/table/macro/diary . regexp) >> >> 2. Introduce a new customization `org-confirm-evaluate' that can be set >>to

Re: [SECURITY] Arbitrary code evaluation security in Org (was: [PATCH] ob-core: add org-confirm-babel-evaluate-cell custom variable)

2023-01-02 Thread Tim Cross
Ihor Radchenko writes: > Ihor Radchenko writes: > >> P.S. Considering intense discussion around the topic, what about >> reverting my commit from the release? We can then re-consider the whole >> design and apply something more elaborate later. > > I now reverted the discussed commit. >

[SECURITY] Arbitrary code evaluation security in Org (was: [PATCH] ob-core: add org-confirm-babel-evaluate-cell custom variable)

2023-01-02 Thread Ihor Radchenko
Ihor Radchenko writes: > P.S. Considering intense discussion around the topic, what about > reverting my commit from the release? We can then re-consider the whole > design and apply something more elaborate later. I now reverted the discussed commit.