Re: [PATCH] Re: [BUG][Security] begin_src :var evaluated before the prompt to confirm execution

2022-11-09 Thread Ihor Radchenko
Ihor Radchenko writes: > See the attached tentative patch. > I tried to balance between annoying users with query and not evaluating > unsafe code: '-quoted lists and symbols are still evaluated without > prompt. Fixed. Applied onto main.

Re: [PATCH] Re: [BUG][Security] begin_src :var evaluated before the prompt to confirm execution

2022-10-28 Thread Ihor Radchenko
Max Nikulin writes: > On 28/10/2022 10:15, Ihor Radchenko wrote: >> >> See the attached tentative patch. >> I tried to balance between annoying users with query and not evaluating >> unsafe code: '-quoted lists and symbols are still evaluated without >> prompt. >> >> Let me know if you see any

Re: [PATCH] Re: [BUG][Security] begin_src :var evaluated before the prompt to confirm execution

2022-10-28 Thread Max Nikulin
On 28/10/2022 10:15, Ihor Radchenko wrote: See the attached tentative patch. I tried to balance between annoying users with query and not evaluating unsafe code: '-quoted lists and symbols are still evaluated without prompt. Let me know if you see any potential issues. If I got it right, it

Re: [BUG][Security] begin_src :var evaluated before the prompt to confirm execution

2022-10-28 Thread Jean Louis
* Ihor Radchenko [2022-10-28 06:19]: > Jean Louis writes: > > > * Max Nikulin [2022-10-27 06:21]: > >> Expected result: > >> No code from the Org buffer and linked files is executed prior to > >> confirmation from the user. > > > > Should that be or is it a general policy for Org mode? > >

Re: [BUG][Security] begin_src :var evaluated before the prompt to confirm execution

2022-10-27 Thread Ihor Radchenko
Max Nikulin writes: >> Should that be or is it a general policy for Org mode? > > I am afraid, it is unrealistic. Spreadsheet feature will be unusable. > And it is another reason why I am strongly against formats designed for > personal use rather than for web in browser context. I disagree.

Re: [BUG][Security] begin_src :var evaluated before the prompt to confirm execution

2022-10-27 Thread Max Nikulin
On 28/10/2022 10:19, Ihor Radchenko wrote: Jean Louis writes: * Max Nikulin [2022-10-27 06:21]: Expected result: No code from the Org buffer and linked files is executed prior to confirmation from the user. Should that be or is it a general policy for Org mode? Yes, it is a general

Re: [BUG][Security] begin_src :var evaluated before the prompt to confirm execution

2022-10-27 Thread Ihor Radchenko
Jean Louis writes: > * Max Nikulin [2022-10-27 06:21]: >> Expected result: >> No code from the Org buffer and linked files is executed prior to >> confirmation from the user. > > Should that be or is it a general policy for Org mode? Yes, it is a general policy. Org should not execute

[PATCH] Re: [BUG][Security] begin_src :var evaluated before the prompt to confirm execution

2022-10-27 Thread Ihor Radchenko
Max Nikulin writes: > Consider the following source block > > >8 > #+begin_src elisp :var a=(message "%s" "pwnd") >a > #+end_src > 8< > > Open the "*Messages*" buffer (C-h e) and try to evaluate the source > block (C-c C-c). > > Actual result: > "pwnd" message appears in

Re: [BUG][Security] begin_src :var evaluated before the prompt to confirm execution

2022-10-26 Thread Max Nikulin
On 27/10/2022 11:22, Jean Louis wrote: * Max Nikulin [2022-10-27 06:21]: Expected result: No code from the Org buffer and linked files is executed prior to confirmation from the user. Should that be or is it a general policy for Org mode? I am afraid, it is unrealistic. Spreadsheet feature

Re: [BUG][Security] begin_src :var evaluated before the prompt to confirm execution

2022-10-26 Thread Jean Louis
* Max Nikulin [2022-10-27 06:21]: > Expected result: > No code from the Org buffer and linked files is executed prior to > confirmation from the user. Should that be or is it a general policy for Org mode? > Emacs-26.3, Org version is current main HEAD: > > 6bbd08f5a 2022-10-26 15:15:42 +0800

[BUG][Security] begin_src :var evaluated before the prompt to confirm execution

2022-10-26 Thread Max Nikulin
Hi, At first I am apologizing. I believed that a dedicated report raising this issue was posted to this mailing list by somebody. I can not find such message and in my notes the heading is linked to a quite general discussion related to source blocks. Consider the following source block