User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:52.0) Gecko/20100101
            Thunderbird/52.9.1
MIME-Version: 1.0
Content-Type: text/plain; charset=utf-8; format=flowed
Content-Language: en-GB
Content-Transfer-Encoding: 7bit
Message-ID:  <7aac3298-e217-7dfe-6787-ad1b69f43fc4@morningstar2.co.uk>
Date:         Fri, 24 Aug 2018 11:34:27 +0100
Reply-To:     Mailing list for the LaTeX3 project
              <LATEX-L@LISTSERV.UNI-HEIDELBERG.DE>
Sender:       Mailing list for the LaTeX3 project <LATEX-L@LISTSERV.UNI-HEIDELBERG.DE>
From:         Joseph Wright <joseph.wright@MORNINGSTAR2.CO.UK>
Subject: System shell functions
To:           LATEX-L@LISTSERV.UNI-HEIDELBERG.DE
Precedence: list
Envelope-To: <rainer.schoepf@GMX.NET>
Status: R

Hello all,

Following some discussion at TUG2018, the team have added an 
experimental package, l3sys-shell, to the l3experimental bundle.
This package provides platform-agnostic interfaces to common file/system 
operations, for example file copying. These only work if shell escape is 
enabled: they will be blocked by the TeX system otherwise but in any 
case are set up as macro-level no-ops.

There are two broad questions we have. First, how do people feel about 
these concepts? We can see that there may be some security concerns, 
hence not adding directly to the expl3 core. However, as one has to be 
running with unrestricted shell escape anyway, we are not sure if 
providing macro wrappers makes these worse: a suitably-motivated person 
could after all write their own malicious code in this area. How do 
people see this? (Note that existing packages already set up their own 
file copying/deletion/etc.)

The second is more tightly focussed on the two (relatively) 'safe' 
operations, getting the absolute path of the working directory, and 
listing all files in a given directory. Both of these could be done 
without unrestricted shell escape given a suitable 'wrapper' layer. 
Would this be worth pursuing?

Joseph