References: <7aac3298-e217-7dfe-6787-ad1b69f43fc4@morningstar2.co.uk>
            <CALD=Yf9vd=b2GRr9G7ro=kNg0JttdH6TGmGNiaMDbeYNDTGGzQ@mail.gmail.com>
User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:52.0) Gecko/20100101
            Thunderbird/52.9.1
MIME-Version: 1.0
Content-Type: text/plain; charset=utf-8; format=flowed
Content-Language: en-GB
Content-Transfer-Encoding: 7bit
Message-ID:  <44b7823e-d23a-6662-d777-f3b30ac4b2b5@morningstar2.co.uk>
Date:         Fri, 24 Aug 2018 19:17:43 +0100
Reply-To:     Mailing list for the LaTeX3 project
              <LATEX-L@LISTSERV.UNI-HEIDELBERG.DE>
Sender:       Mailing list for the LaTeX3 project <LATEX-L@LISTSERV.UNI-HEIDELBERG.DE>
From:         Joseph Wright <joseph.wright@MORNINGSTAR2.CO.UK>
Subject: Re: System shell functions
To:           LATEX-L@LISTSERV.UNI-HEIDELBERG.DE
In-Reply-To:  <CALD=Yf9vd=b2GRr9G7ro=kNg0JttdH6TGmGNiaMDbeYNDTGGzQ@mail.gmail.com>
Precedence: list
Envelope-To: <rainer.schoepf@GMX.NET>
Status: R

On 24/08/2018 18:10, Jonathan Fine wrote:
> Hi Joseph
> 
> Thank you for your email on l3sys-shell. You wrote:
> 
> There are two broad questions we have. First, how do people feel about
>> these concepts? We can see that there may be some security concerns, hence
>> not adding directly to the expl3 core. However, as one has to be running
>> with unrestricted shell escape anyway, we are not sure if providing macro
>> wrappers makes these worse:
> 
> 
> I'm not a security expert. Are you, Joseph? In any case, I've asked your
> question on stack exchange, and put a code review comment on github. Here's
> the URLs
> 
>     -
>     https://security.stackexchange.com/questions/192249/concerns-about-latex-3-shell-escape-code
>     -
>     https://github.com/latex3/latex3/commit/7b62e64dde239f9cb6ae0f08400c0b5ccde815d8#diff-09def3f98d60fce78fbcc00e77c65795R3093
> 
> I hope you'll get a useful response from a security expert.
> 
> best regards
> 
> Jonathan
> .

Hello Jonathan,

Once one allows unrestricted shell escape, all bets are off in terms of 
what an arbitrary package can do. However, there are legitimate uses for 
file operations: see e.g. pstool. (Other packages use non-restricted 
escape, for example minted to run pygmentize.)

Thus the question is whether on balance it seems better to say 'each 
package that wants to do such operations should write them out itself' 
or 'we will provide an abstraction'. Clearly, the latter could be seen 
as 'easier' for a malicious actor to use. On the other hand, writing 
platform-neutral abstractions for e.g. "remove all files" is actually 
not that difficult. So the barrier is low.

At present, we've put the operations in a separate file specifically so 
they have to be loaded explicitly. However, one can see that they may be 
loaded by a third-party package, e.g. pstool could be altered to do 
this. They'd then be 'hidden' to some extent.

It's important to emphasise that with a normal TeX Live or MiKTeX set 
up, these macros will not do anything as *they are restricted by the 
engine settings*. As such, there is already a 'user opt-in'.

Joseph