MIME-Version: 1.0
References: <7aac3298-e217-7dfe-6787-ad1b69f43fc4@morningstar2.co.uk>
            <CALD=Yf9vd=b2GRr9G7ro=kNg0JttdH6TGmGNiaMDbeYNDTGGzQ@mail.gmail.com>
            <5164150e-54e3-0f63-a2ac-09cc724dcf96@earthlink.net>
Content-Type: multipart/alternative; boundary="00000000000035f40c057448a27b"
Message-ID:  <CALD=Yf9rxKWbXzKK3omWM+PPjF1V=qmFtC1iGakfErwFVKBebg@mail.gmail.com>
Date:         Sat, 25 Aug 2018 21:49:50 +0100
Reply-To:     Mailing list for the LaTeX3 project
              <LATEX-L@LISTSERV.UNI-HEIDELBERG.DE>
Sender:       Mailing list for the LaTeX3 project <LATEX-L@LISTSERV.UNI-HEIDELBERG.DE>
From:         Jonathan Fine <jfine2358@GMAIL.COM>
Subject: Re: System shell functions
To:           LATEX-L@LISTSERV.UNI-HEIDELBERG.DE
In-Reply-To:  <5164150e-54e3-0f63-a2ac-09cc724dcf96@earthlink.net>
Precedence: list
Envelope-To: <rainer.schoepf@GMX.NET>
Status: R

--00000000000035f40c057448a27b
Content-Type: text/plain; charset="UTF-8"

Hi

Peter: I'm wanting to get responses from security experts, not TeX experts.
Ideally, we want a security expert who's also a TeX expert.

But if it's one or the other, this question needs a security expert. In
other words, someone who understands:
> https://xkcd.com/327 - the famous Bobby Drop Tables story.

Bruno: Yes, my thoughts exactly, but better expressed. Thank you. And they
could do much more than just remove a file.

They could, probably, execute an arbitrary command. Something that might
escalate the exploit.

best regards

Jonathan

On Sat, Aug 25, 2018 at 9:24 PM, Peter Wilson <herries.press@earthlink.net>
wrote:

> Jonathon,
>
> You might have had more responses if you had posted to
> https://tex.stackechange.com
>
> Peter W.
>
> On 24/08/18 18:10, Jonathan Fine wrote:
>
> Hi Joseph
>
> Thank you for your email on l3sys-shell. You wrote:
>
> There are two broad questions we have. First, how do people feel about
>> these concepts? We can see that there may be some security concerns, hence
>> not adding directly to the expl3 core. However, as one has to be running
>> with unrestricted shell escape anyway, we are not sure if providing macro
>> wrappers makes these worse:
>
>
> I'm not a security expert. Are you, Joseph? In any case, I've asked your
> question on stack exchange, and put a code review comment on github. Here's
> the URLs
>
>    - https://security.stackexchange.com/questions/
>    192249/concerns-about-latex-3-shell-escape-code
>    <https://security.stackexchange.com/questions/192249/concerns-about-latex-3-shell-escape-code>
>    - https://github.com/latex3/latex3/commit/
>    7b62e64dde239f9cb6ae0f08400c0b5ccde815d8#diff-
>    09def3f98d60fce78fbcc00e77c65795R3093
>    <https://github.com/latex3/latex3/commit/7b62e64dde239f9cb6ae0f08400c0b5ccde815d8#diff-09def3f98d60fce78fbcc00e77c65795R3093>
>
> I hope you'll get a useful response from a security expert.
>
> best regards
>
> Jonathan
>
>
>

--00000000000035f40c057448a27b
Content-Type: text/html; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable

<div dir=3D"ltr">Hi<div><br></div><div>Peter: I&#39;m wanting to get respon=
ses from security experts, not TeX experts. Ideally, we want a security exp=
ert who&#39;s also a TeX expert.</div><div><br></div><div>But if it&#39;s o=
ne or the other, this question needs a security expert. In other words, som=
eone who understands:</div><div>&gt;=C2=A0<a href=3D"https://xkcd.com/327" =
rel=3D"noreferrer" target=3D"_blank" style=3D"color:rgb(17,85,204);font-siz=
e:12.8px;background-color:rgb(255,255,255)">https://xkcd.com/327</a>=C2=A0-=
=C2=A0<span style=3D"font-size:12.8px;background-color:rgb(255,255,255);tex=
t-decoration-style:initial;text-decoration-color:initial;float:none;display=
:inline">the famous Bobby Drop Tables story.</span><br><div><br></div><div>=
Bruno: Yes, my thoughts exactly, but better expressed. Thank you. And they =
could do much more than just remove a file.</div><div><br></div><div>They c=
ould, probably, execute an arbitrary command. Something that might escalate=
 the exploit.</div><div><br></div><div>best regards</div><div><br></div><di=
v>Jonathan</div></div></div><div class=3D"gmail_extra"><br><div class=3D"gm=
ail_quote">On Sat, Aug 25, 2018 at 9:24 PM, Peter Wilson <span dir=3D"ltr">=
&lt;<a href=3D"mailto:herries.press@earthlink.net" target=3D"_blank">herrie=
s.press@earthlink.net</a>&gt;</span> wrote:<br><blockquote class=3D"gmail_q=
uote" style=3D"margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1e=
x">
 =20
   =20
 =20
  <div bgcolor=3D"#FFFFFF" text=3D"#000000">
    <p>Jonathon,</p>
    <p>You might have had more responses if you had posted to
      <a class=3D"m_-337598490214435808moz-txt-link-freetext" href=3D"https=
://tex.stackechange.com" target=3D"_blank">https://tex.stackechange.com</a>=
</p>
    <p>Peter W.<br>
    </p><div><div class=3D"h5">
    <br>
    <div class=3D"m_-337598490214435808moz-cite-prefix">On 24/08/18 18:10, =
Jonathan Fine wrote:<br>
    </div>
    <blockquote type=3D"cite">
      <div dir=3D"ltr">Hi Joseph
        <div><br>
        </div>
        <div>Thank you for your email on l3sys-shell. You wrote:
          <div><br>
            <div class=3D"gmail_extra">
              <div class=3D"gmail_quote">
                <blockquote class=3D"gmail_quote" style=3D"margin:0px 0px 0=
px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex">There are=
 two broad
                  questions we have. First, how do people feel about
                  these concepts? We can see that there may be some
                  security concerns, hence not adding directly to the
                  expl3 core. However, as one has to be running with
                  unrestricted shell escape anyway, we are not sure if
                  providing macro wrappers makes these worse: </blockquote>
                <div><br>
                </div>
                <div>I&#39;m not a security expert. Are you, Joseph? In any
                  case, I&#39;ve asked your question on stack exchange, and
                  put a code review comment on github. Here&#39;s the URLs<=
/div>
                <div>
                  <ul>
                    <li><a href=3D"https://security.stackexchange.com/quest=
ions/192249/concerns-about-latex-3-shell-escape-code" target=3D"_blank">htt=
ps://security.<wbr>stackexchange.com/questions/<wbr>192249/concerns-about-l=
atex-3-<wbr>shell-escape-code</a><br>
                    </li>
                    <li><a href=3D"https://github.com/latex3/latex3/commit/=
7b62e64dde239f9cb6ae0f08400c0b5ccde815d8#diff-09def3f98d60fce78fbcc00e77c65=
795R3093" target=3D"_blank">https://github.com/latex3/<wbr>latex3/commit/<w=
br>7b62e64dde239f9cb6ae0f08400c0b<wbr>5ccde815d8#diff-<wbr>09def3f98d60fce7=
8fbcc00e77c657<wbr>95R3093</a><br>
                    </li>
                  </ul>
                </div>
                <div>I hope you&#39;ll get a useful response from a securit=
y
                  expert.</div>
                <div><br>
                </div>
                <div>best regards</div>
                <div><br>
                </div>
                <div>Jonathan</div>
              </div>
            </div>
          </div>
        </div>
      </div>
    </blockquote>
    <br>
  </div></div></div>

</blockquote></div><br></div>

--00000000000035f40c057448a27b--