On Sat, 2023-03-11 at 10:47 +0000, Ihor Radchenko wrote: > > I am afraid that we cannot make things universally safe here without > breaking changes. The best way will be treating :cmd and similar > header > args as unsafe and include them into the planned safety prompt system > we > discussed in https://orgmode.org/list/87edsd5o89.fsf@localhost >
Ok, I'll undo this part of the changes first, and repost patch.
From b48784a16c5806694498f072ffdd98e5a3c144b5 Mon Sep 17 00:00:00 2001 From: Xi Lu <l...@shellcodes.org> Date: Sat, 11 Mar 2023 18:53:37 +0800 Subject: [PATCH] * lisp/ob-latex.el: Fix command injection vulnerability (org-babel-execute:latex): Replaced the `(shell-command "mv BAR NEWBAR")' with `rename-file'. --- lisp/ob-latex.el | 13 +++++-------- 1 file changed, 5 insertions(+), 8 deletions(-) diff --git a/lisp/ob-latex.el b/lisp/ob-latex.el index a2c24b3d9..ce39628d6 100644 --- a/lisp/ob-latex.el +++ b/lisp/ob-latex.el @@ -218,17 +218,14 @@ This function is called by `org-babel-execute-src-block'." (if (string-suffix-p ".svg" out-file) (progn (shell-command "pwd") - (shell-command (format "mv %s %s" - (concat (file-name-sans-extension tex-file) "-1.svg") - out-file))) + (rename-file (concat (file-name-sans-extension tex-file) "-1.svg") + out-file t)) (error "SVG file produced but HTML file requested"))) ((file-exists-p (concat (file-name-sans-extension tex-file) ".html")) (if (string-suffix-p ".html" out-file) - (shell-command "mv %s %s" - (concat (file-name-sans-extension tex-file) - ".html") - out-file) - (error "HTML file produced but SVG file requested"))))) + (rename-file (concat (file-name-sans-extension tex-file) ".html") + out-file t) + (error "HTML file produced but SVG file requested"))))) ((or (string= "pdf" extension) imagemagick) (with-temp-file tex-file (require 'ox-latex) -- 2.39.2
