References: <7aac3298-e217-7dfe-6787-ad1b69f43fc4@morningstar2.co.uk>
            <CALD=Yf9vd=b2GRr9G7ro=kNg0JttdH6TGmGNiaMDbeYNDTGGzQ@mail.gmail.com>
User-Agent: Mozilla/5.0 (X11; Linux i686; rv:45.0) Gecko/20100101
            Thunderbird/45.8.0
MIME-Version: 1.0
Content-Type: multipart/alternative; boundary="------------DA4763BF4CBE758DD7CF0EE5"
Message-ID:  <5164150e-54e3-0f63-a2ac-09cc724dcf96@earthlink.net>
Date:         Sat, 25 Aug 2018 21:24:34 +0100
Reply-To:     Mailing list for the LaTeX3 project
              <LATEX-L@LISTSERV.UNI-HEIDELBERG.DE>
Sender:       Mailing list for the LaTeX3 project <LATEX-L@LISTSERV.UNI-HEIDELBERG.DE>
From:         Peter Wilson <herries.press@EARTHLINK.NET>
Subject: Re: System shell functions
To:           LATEX-L@LISTSERV.UNI-HEIDELBERG.DE
In-Reply-To:  <CALD=Yf9vd=b2GRr9G7ro=kNg0JttdH6TGmGNiaMDbeYNDTGGzQ@mail.gmail.com>
Precedence: list
Envelope-To: <rainer.schoepf@GMX.NET>
Status: R

This is a multi-part message in MIME format.
--------------DA4763BF4CBE758DD7CF0EE5
Content-Type: text/plain; charset=utf-8; format=flowed
Content-Transfer-Encoding: 7bit

Jonathon,

You might have had more responses if you had posted to 
https://tex.stackechange.com

Peter W.


On 24/08/18 18:10, Jonathan Fine wrote:
> Hi Joseph
>
> Thank you for your email on l3sys-shell. You wrote:
>
>     There are two broad questions we have. First, how do people feel
>     about these concepts? We can see that there may be some security
>     concerns, hence not adding directly to the expl3 core. However, as
>     one has to be running with unrestricted shell escape anyway, we
>     are not sure if providing macro wrappers makes these worse: 
>
>
> I'm not a security expert. Are you, Joseph? In any case, I've asked 
> your question on stack exchange, and put a code review comment on 
> github. Here's the URLs
>
>   * https://security.stackexchange.com/questions/192249/concerns-about-latex-3-shell-escape-code
>   * https://github.com/latex3/latex3/commit/7b62e64dde239f9cb6ae0f08400c0b5ccde815d8#diff-09def3f98d60fce78fbcc00e77c65795R3093
>
> I hope you'll get a useful response from a security expert.
>
> best regards
>
> Jonathan


--------------DA4763BF4CBE758DD7CF0EE5
Content-Type: text/html; charset=utf-8
Content-Transfer-Encoding: 7bit

<html>
  <head>
    <meta content="text/html; charset=utf-8" http-equiv="Content-Type">
  </head>
  <body bgcolor="#FFFFFF" text="#000000">
    <p>Jonathon,</p>
    <p>You might have had more responses if you had posted to
      <a class="moz-txt-link-freetext" href="https://tex.stackechange.com">https://tex.stackechange.com</a></p>
    <p>Peter W.<br>
    </p>
    <br>
    <div class="moz-cite-prefix">On 24/08/18 18:10, Jonathan Fine wrote:<br>
    </div>
    <blockquote
cite="mid:CALD=Yf9vd=b2GRr9G7ro=kNg0JttdH6TGmGNiaMDbeYNDTGGzQ@mail.gmail.com"
      type="cite">
      <div dir="ltr">Hi Joseph
        <div><br>
        </div>
        <div>Thank you for your email on l3sys-shell. You wrote:
          <div><br>
            <div class="gmail_extra">
              <div class="gmail_quote">
                <blockquote class="gmail_quote" style="margin:0px 0px
                  0px 0.8ex;border-left:1px solid
                  rgb(204,204,204);padding-left:1ex">There are two broad
                  questions we have. First, how do people feel about
                  these concepts? We can see that there may be some
                  security concerns, hence not adding directly to the
                  expl3 core. However, as one has to be running with
                  unrestricted shell escape anyway, we are not sure if
                  providing macro wrappers makes these worse: </blockquote>
                <div><br>
                </div>
                <div>I'm not a security expert. Are you, Joseph? In any
                  case, I've asked your question on stack exchange, and
                  put a code review comment on github. Here's the URLs</div>
                <div>
                  <ul>
                    <li><a moz-do-not-send="true"
href="https://security.stackexchange.com/questions/192249/concerns-about-latex-3-shell-escape-code">https://security.stackexchange.com/questions/192249/concerns-about-latex-3-shell-escape-code</a><br>
                    </li>
                    <li><a moz-do-not-send="true"
href="https://github.com/latex3/latex3/commit/7b62e64dde239f9cb6ae0f08400c0b5ccde815d8#diff-09def3f98d60fce78fbcc00e77c65795R3093">https://github.com/latex3/latex3/commit/7b62e64dde239f9cb6ae0f08400c0b5ccde815d8#diff-09def3f98d60fce78fbcc00e77c65795R3093</a><br>
                    </li>
                  </ul>
                </div>
                <div>I hope you'll get a useful response from a security
                  expert.</div>
                <div><br>
                </div>
                <div>best regards</div>
                <div><br>
                </div>
                <div>Jonathan</div>
              </div>
            </div>
          </div>
        </div>
      </div>
    </blockquote>
    <br>
  </body>
</html>

--------------DA4763BF4CBE758DD7CF0EE5--