Re: [racket-users] Deserializing snips from untrusted input

2020-08-20 Thread Daniel Melcer
code in certain situations" at >> https://github.com/racket/gui/issues/157. A concrete problem I found is >> that you can have a snip running `struct->vector` and it will successfully >> extract private fields of that struct value, even though it won't be able >>

[racket-users] Deserializing snips from untrusted input

2020-08-20 Thread Daniel Melcer
There are some well-known vulnerabilities that are a result of deserializing untrusted inputs. Are editor snips restrictive enough that their deserialization is safe? After all, they are already loaded when a file is opened in DrRacket, and a file on the disk may originate from an untrusted

[racket-users] Debugging a tool

2020-08-19 Thread Daniel Melcer
Is it possible to run the debugger on an IDE tool? Or if that isn't possible, is there a way to get a repl? #lang debug ( https://docs.racket-lang.org/debug/index.html) works for printing out values to the console, but adding a call to (debug-repl) causes the code to fail raco setup: write: