On 2025-05-23 08:51, Remind list wrote: > On Fri, 23 May 2025 07:43:32 -0500 >>> - MINOR NEW FEATURE: remind: Add eval() built-in function that >>> takes a string argument and evaluates it as an expression. > >> Interesting...not sure if this would need some sort of "secure mode" >> to prevent problematic evals? > > I can't think of a way this can be exploited... but if you can come up > with a way, I'll consider adding a way to disable eval()
I didn't see anything in particular, and most remind-files are user-generated, so any shooting-yourself-in-the-foot is self-induced. I'd start by poking at ways that a string could be returned from an untrusted source and causing problems like some sort of system() or RUN directive. But it's mostly my spidey-sense alarms going off when eval() functions are on the scene :-) >>> - MINOR NEW FEATURE: remind: Add the trigbase() function and >>> corresponding $Tb system variable. See the remind(1) man page for >>> details. >>> >>> - MINOR IMPROVEMENT: remind: Make $Tu a synonym for triguntil(). >> >> $ grep -e trigbase '\$Tu\>' man/remind.1 || echo not found >> not found > > man/remind.1 is generated from man/remind.1.in by ./configure, so you > have to run ./configure to get the man page changes. Ah, that's what I'd missed. Indeed they're present now. >> it didn't prompt me for anything when using HTTPS > > I do some user-agent detection as well to give "git" a free pass... > ssshhh... Ah, sneaky you :-) Thanks again! -tkc -- _______________________________________________ Remind-fans mailing list [email protected] https://dianne.skoll.ca/mailman/listinfo/remind-fans Remind is at https://dianne.skoll.ca/projects/remind/
