4 ms·

I thought it’s feature. Org mode file can be used as a runable document. You have paragraphs of text and then a section containing executable code.

by ww520 2y ago

tsujamin 2y ago
It is, similarly to how Microsoft Office documents can run legitimate/malicious executable code. Although, Office (and most other software) will at least warn you before executing code/malware in such documents originating from the Internet.
- smitty1e 2y ago
  Most recent Office configurations don't trust any downloaded documents, and most recent email configurations have forced me to send code snippets as .txt or some denuded variation.
  - hobs 2y ago
    Code snippets as text is denuded but word documents are good for code... what universe is this?
    - smitty1e 2y ago
      Word vs. Outlook
exe34 2y ago
might be good if it's not "auto run", but otherwise running code inside org-mode is definitely part of the appeal.
livrem 2y ago
Yes, but that is not what the linked vulnerability is about. https://orgmode.org/worg/org-contrib/babel/intro.html https://orgmode.org/worg/org-contrib/babel/intro.html
metroholografix 2y ago
Unexpected evaluation is never a feature, Emacs should at least warn and prompt before executing code in a file that somebody opens.
- ykonstant 2y ago
  I am on the camp that agrees with that, but there are many who don't :/
  - nequo 2y ago
    As far as I can tell, Emacs prompts you every time it evaluates code when opening a file, and so does Org Babel. This can be turned off but you need to do it explicitly.
- bachmeier 2y ago
  But expected evaluation is a feature, and not everyone wants to inject a permissions system that gets in the way every time you open a document. Not everything is a web browser that needs to run arbitrary code from arbitrarily bad actors. A warning and a prompt would largely be useless in this case anyway. As soon as you'd click the prompt, the evil code would run. What you'd need is an option set in your init file to allow code to execute on opening only if a particular piece of information known only to you is included in the file, like #+runcode: a19ihlkn01nf2n9882n4337974biskjf
  - cobbal 2y ago
    Emacs already restricts what variables can be set as file-local. It will prompt you to ask what to do if you open a file containing: ;; -*- eval: (message "arbitrary code") -*- any mode associated with a file extension should be at least as secure against code execution.
    - bachmeier 2y ago
      Sure, I agree with that behavior assuming the user wants the security. If the user wants to disable it, they should be able to do so. It's awful to assume users can't make the decision for themselves.

I thought it’s feature. Org mode file can be used as a runable document. You have paragraphs of text and then a section containing executable code.

by ww520 2y ago

I thought it’s feature. Org mode file can be used as a runable document. You have paragraphs of text and then a section containing executable code.

tsujamin 2y ago

It is, similarly to how Microsoft Office documents can run legitimate/malicious executable code. Although, Office (and most other software) will at least warn you before executing code/malware in such documents originating from the Internet.

smitty1e 2y ago
Most recent Office configurations don't trust any downloaded documents, and most recent email configurations have forced me to send code snippets as .txt or some denuded variation.
- hobs 2y ago
  Code snippets as text is denuded but word documents are good for code... what universe is this?
  - smitty1e 2y ago
    Word vs. Outlook

exe34 2y ago

might be good if it's not "auto run", but otherwise running code inside org-mode is definitely part of the appeal.

livrem 2y ago

Yes, but that is not what the linked vulnerability is about. https://orgmode.org/worg/org-contrib/babel/intro.html https://orgmode.org/worg/org-contrib/babel/intro.html

metroholografix 2y ago

Unexpected evaluation is never a feature, Emacs should at least warn and prompt before executing code in a file that somebody opens.

ykonstant 2y ago
I am on the camp that agrees with that, but there are many who don't :/
- nequo 2y ago
  As far as I can tell, Emacs prompts you every time it evaluates code when opening a file, and so does Org Babel. This can be turned off but you need to do it explicitly.
bachmeier 2y ago
But expected evaluation is a feature, and not everyone wants to inject a permissions system that gets in the way every time you open a document. Not everything is a web browser that needs to run arbitrary code from arbitrarily bad actors. A warning and a prompt would largely be useless in this case anyway. As soon as you'd click the prompt, the evil code would run. What you'd need is an option set in your init file to allow code to execute on opening only if a particular piece of information known only to you is included in the file, like #+runcode: a19ihlkn01nf2n9882n4337974biskjf
- cobbal 2y ago
  Emacs already restricts what variables can be set as file-local. It will prompt you to ask what to do if you open a file containing: ;; -*- eval: (message "arbitrary code") -*- any mode associated with a file extension should be at least as secure against code execution.
  - bachmeier 2y ago
    Sure, I agree with that behavior assuming the user wants the security. If the user wants to disable it, they should be able to do so. It's awful to assume users can't make the decision for themselves.