Re: [SECURITY] Arbitrary code evaluation security in Org (was: [PATCH] ob-core: add org-confirm-babel-evaluate-cell custom variable)

2023-01-07 Thread Ihor Radchenko
Ihor Radchenko writes: >> I do wonder if the idea of a document classification model and some form >> of heuristic algorithms to handle default document classification might >> be useful. > > I do not think that we need to go in this direction. > I doubt that we are qualified to get the

Re: [SECURITY] Arbitrary code evaluation security in Org (was: [PATCH] ob-core: add org-confirm-babel-evaluate-cell custom variable)

2023-01-03 Thread Ihor Radchenko
Tim Cross writes: >> 1. Introduce a new customization `org-confirm-evaluate-safe-regexps' >>listing regexps that are considered safe or cons cells >>(src-body/header-arg/table/macro/diary . regexp) >> >> 2. Introduce a new customization `org-confirm-evaluate' that can be set >>to

Re: [SECURITY] Arbitrary code evaluation security in Org (was: [PATCH] ob-core: add org-confirm-babel-evaluate-cell custom variable)

2023-01-02 Thread Tim Cross
Ihor Radchenko writes: > Ihor Radchenko writes: > >> P.S. Considering intense discussion around the topic, what about >> reverting my commit from the release? We can then re-consider the whole >> design and apply something more elaborate later. > > I now reverted the discussed commit. >

Re: [PATCH] ob-core: add org-confirm-babel-evaluate-cell custom variable

2023-01-02 Thread Ihor Radchenko
Bastien Guerry writes: > Ihor Radchenko writes: > >> We may, however, make `org-confirm-babel-evaluate' function value accept >> an extra third argument - context ('code or 'vars). This will retain the >> required flexibility without introducing an extra variable. > > Yes, this is an

Re: [PATCH] ob-core: add org-confirm-babel-evaluate-cell custom variable

2023-01-02 Thread Bastien
Hi Tom, thanks a lot for the detailed explanations: I get your point and I understand the need. I think the revert is a good move, though, as the solution was not really good enough. Thanks! -- Bastien

Re: [PATCH] ob-core: add org-confirm-babel-evaluate-cell custom variable

2023-01-02 Thread Bastien Guerry
Ihor Radchenko writes: > We may, however, make `org-confirm-babel-evaluate' function value accept > an extra third argument - context ('code or 'vars). This will retain the > required flexibility without introducing an extra variable. Yes, this is an interesting possibility. > P.S. Considering

[SECURITY] Arbitrary code evaluation security in Org (was: [PATCH] ob-core: add org-confirm-babel-evaluate-cell custom variable)

2023-01-02 Thread Ihor Radchenko
Ihor Radchenko writes: > P.S. Considering intense discussion around the topic, what about > reverting my commit from the release? We can then re-consider the whole > design and apply something more elaborate later. I now reverted the discussed commit.

Re: [PATCH] ob-core: add org-confirm-babel-evaluate-cell custom variable

2022-12-31 Thread Tom Gillespie
> P.S. Considering intense discussion around the topic, what about > reverting my commit from the release? We can then re-consider the whole > design and apply something more elaborate later. I was actually going to mention that in my previous message but forgot. I think that given the potential

Re: [PATCH] ob-core: add org-confirm-babel-evaluate-cell custom variable

2022-12-31 Thread Ihor Radchenko
Tom Gillespie writes: >> What about modifying `org-confirm-babel-evaluate' to allow these values: >> >> - t : confirm header vars *and* code blocks >> - 'code : confirm code blocks >> - 'vars : confirm vars >> - nil: don't confirm >> >> and set the default value to 'code, while

Re: [PATCH] ob-core: add org-confirm-babel-evaluate-cell custom variable

2022-12-30 Thread Tom Gillespie
Hi Bastien, In short, we need two variables due to the case where a user wants to set nil for all vars and a function for code. More replies in line. Best! Tom > I see nothing in etc/ORG-NEWS that describes this change: am I missing > something? Looks like any mention of the change is missing

Re: [PATCH] ob-core: add org-confirm-babel-evaluate-cell custom variable

2022-12-30 Thread Max Nikulin
On 30/12/2022 15:52, Bastien wrote: But are we sure that users need to confirm header args evaluation separately from code blocks evaluation? I do not think we need to confirm header arguments *separately*, but they should not be executed before asking users. It is not easy to implement

Re: [PATCH] ob-core: add org-confirm-babel-evaluate-cell custom variable

2022-12-30 Thread Bastien
Thanks a lot for the detailed answer, very helpful. > What changed: The prompt previously displayed on code block evaluation > is now also displayed when expanding header arguments: I see nothing in etc/ORG-NEWS that describes this change: am I missing something? >> Whether it changed or not,

Re: [PATCH] ob-core: add org-confirm-babel-evaluate-cell custom variable

2022-12-29 Thread Ihor Radchenko
Bastien Guerry writes: > I've skimmed through the discussion but I'm not entirely clear about > the situation. > > Has the situation changed between 9.5 and 9.6? Tom first message > seems to suggest it did, but etc/ORG-NEWS does not say. I considered this change as a bugfix. Though it was more

Re: [PATCH] ob-core: add org-confirm-babel-evaluate-cell custom variable

2022-12-29 Thread Max Nikulin
On 29/12/2022 22:58, Bastien Guerry wrote: From: Tom Gillespie Date: Sat, 10 Dec 2022 12:11:17 -0800 Subject: [PATCH 1/2] ob-core: add org-confirm-babel-evaluate-cell custom variable ... Has the situation changed between 9.5 and 9.6? Yes, it has. In 9.6 C-c C-c for #+begin_src elisp :var

Re: [PATCH] ob-core: add org-confirm-babel-evaluate-cell custom variable

2022-12-29 Thread Bastien Guerry
Ihor Radchenko writes: > Tom Gillespie writes: > >> From 4a78e1b5ea98dee569ff690037c661ab5c300194 Mon Sep 17 00:00:00 2001 >> From: Tom Gillespie >> Date: Sat, 10 Dec 2022 12:11:17 -0800 >> Subject: [PATCH 1/2] ob-core: add org-confirm-babel-evaluate-cell custom >> variable > > Bastien, may

Re: [PATCH] ob-core: add org-confirm-babel-evaluate-cell custom variable

2022-12-25 Thread Ihor Radchenko
Tom Gillespie writes: > From 4a78e1b5ea98dee569ff690037c661ab5c300194 Mon Sep 17 00:00:00 2001 > From: Tom Gillespie > Date: Sat, 10 Dec 2022 12:11:17 -0800 > Subject: [PATCH 1/2] ob-core: add org-confirm-babel-evaluate-cell custom > variable Bastien, may you please take a look at this

Re: [PATCH] ob-core: add org-confirm-babel-evaluate-cell custom variable

2022-12-25 Thread Ihor Radchenko
Tom Gillespie writes: > One more correction. The source of the issue is that the two values in the > list need to be different, one for the message and one for the actual test. > Best, > Tom > > (list "emacs-lisp" cell > '((:eval . yes)) nil (format "%S" cell) >

Re: [PATCH] ob-core: add org-confirm-babel-evaluate-cell custom variable

2022-12-19 Thread Tom Gillespie
One more correction. The source of the issue is that the two values in the list need to be different, one for the message and one for the actual test. Best, Tom (list "emacs-lisp" cell '((:eval . yes)) nil (format "%S" cell) nil nil)

Re: [PATCH] ob-core: add org-confirm-babel-evaluate-cell custom variable

2022-12-19 Thread Tom Gillespie
By the way, while we're on bugfixes. I just noticed that (format "%S" cell) is being used to create the fake body for info. This is incorrect because cell is already a string at this point and this makes the behavior inconsistent with the rest of org babel as a result. Fix below. Best, Tom The

Re: [PATCH] ob-core: add org-confirm-babel-evaluate-cell custom variable

2022-12-18 Thread Tim Cross
Ihor Radchenko writes: > Tim Cross writes: > >> Based on the information in section 17.13, how do I configure my Emacs >> so that >> >> 1. All the code in the files I wrote just runs and doesn't bother me with >> annoying execute questions. >> >> 2. Code in files from colleagues is shown to

Re: [PATCH] ob-core: add org-confirm-babel-evaluate-cell custom variable

2022-12-18 Thread Ihor Radchenko
Tim Cross writes: > Based on the information in section 17.13, how do I configure my Emacs > so that > > 1. All the code in the files I wrote just runs and doesn't bother me with > annoying execute questions. > > 2. Code in files from colleagues is shown to me and I'm asked if it > should be

Re: [PATCH] ob-core: add org-confirm-babel-evaluate-cell custom variable

2022-12-18 Thread Ihor Radchenko
Max Nikulin writes: >> I disagree. If anything, we can set the default value of >> `org-confirm-babel-evaluate-cell' to nil and apply this patch. >> >> Then, we can get the old behaviour back yet allowing concerned users to >> have more security. > > I am leaving it up to you. Form my point of

Re: [PATCH] ob-core: add org-confirm-babel-evaluate-cell custom variable

2022-12-15 Thread Tim Cross
Ihor Radchenko writes: > Tim Cross writes: > >> I do wonder if it would be a good idea to try and document when org will >> evaluate code in org files. This would include not just babel block >> evaluation, but also elisp evaluation in table formulas, block header >> arguments, file option

Re: [PATCH] ob-core: add org-confirm-babel-evaluate-cell custom variable

2022-12-15 Thread Ihor Radchenko
Tim Cross writes: > I do wonder if it would be a good idea to try and document when org will > evaluate code in org files. This would include not just babel block > evaluation, but also elisp evaluation in table formulas, block header > arguments, file option arguments and possibly other subtle

Re: [PATCH] ob-core: add org-confirm-babel-evaluate-cell custom variable

2022-12-15 Thread Tim Cross
Max Nikulin writes: > On 15/12/2022 19:25, Ihor Radchenko wrote: >> Max Nikulin writes: >> >>> I would consider reverting the commit causing user prompt for every >>> variable. >> I disagree. If anything, we can set the default value of >> `org-confirm-babel-evaluate-cell' to nil and apply

Re: [PATCH] ob-core: add org-confirm-babel-evaluate-cell custom variable

2022-12-15 Thread Max Nikulin
On 15/12/2022 19:25, Ihor Radchenko wrote: Max Nikulin writes: I would consider reverting the commit causing user prompt for every variable. I disagree. If anything, we can set the default value of `org-confirm-babel-evaluate-cell' to nil and apply this patch. Then, we can get the old

Re: [PATCH] ob-core: add org-confirm-babel-evaluate-cell custom variable

2022-12-15 Thread Ihor Radchenko
Max Nikulin writes: >> Should we then extend `org-babel-check-evaluate' to accept "All" answer >> in the coming bugfix release? > > I would consider reverting the commit causing user prompt for every > variable. I disagree. If anything, we can set the default value of

Re: [PATCH] ob-core: add org-confirm-babel-evaluate-cell custom variable

2022-12-15 Thread Max Nikulin
On 15/12/2022 16:10, Ihor Radchenko wrote: Max Nikulin writes: I am still in doubts if 10e857d42 2022-10-28 11:09:50 +0800 Ihor Radchenko: org-babel-read: Obey `org-confirm-babel-evaluate' was an unambiguous improvement. Perhaps it just forces more users to set `org-confirm-babel-evaluate'

Re: [PATCH] ob-core: add org-confirm-babel-evaluate-cell custom variable

2022-12-15 Thread tomas
On Thu, Dec 15, 2022 at 09:18:14AM +, Ihor Radchenko wrote: > Tom Gillespie writes: [...] > I am generally skeptical about our ability to provide universal way to > judge if a given sexp is safe or not. It should be left to the user. This might live in the middle of some thicket deep in

Re: [PATCH] ob-core: add org-confirm-babel-evaluate-cell custom variable

2022-12-15 Thread Tom Gillespie
> It's purpose is also different. > I am generally skeptical about our ability to provide universal way to > judge if a given sexp is safe or not. It should be left to the user. I am in complete agreement.

Re: [PATCH] ob-core: add org-confirm-babel-evaluate-cell custom variable

2022-12-15 Thread Ihor Radchenko
Tom Gillespie writes: > Interestingly, as I was looking through my notes in > orgstrap, I see my past self had found a macro > org-babel-one-header-arg-safe-p which pointed to > defconst org-babel-safe-header-args, but that is > a const and not really user configurable. It's purpose is also

Re: [PATCH] ob-core: add org-confirm-babel-evaluate-cell custom variable

2022-12-15 Thread Ihor Radchenko
Max Nikulin writes: > I am still in doubts if > > 10e857d42 2022-10-28 11:09:50 +0800 Ihor Radchenko: org-babel-read: Obey > `org-confirm-babel-evaluate' > > was an unambiguous improvement. Perhaps it just forces more users to set > `org-confirm-babel-evaluate' to nil compromising their

Re: [PATCH] ob-core: add org-confirm-babel-evaluate-cell custom variable

2022-12-14 Thread Tom Gillespie
Interestingly, as I was looking through my notes in orgstrap, I see my past self had found a macro org-babel-one-header-arg-safe-p which pointed to defconst org-babel-safe-header-args, but that is a const and not really user configurable. Of course the user could cl-setf on it, but it also only

Re: [PATCH] ob-core: add org-confirm-babel-evaluate-cell custom variable

2022-12-14 Thread Max Nikulin
Tom, does not the following allow to achieve the same without your patch? #+begin_src elisp :results none (setq-local org-confirm-babel-evaluate (lambda (lang body) (not (and (member lang '("elisp" "emacs-lisp")) (let ((rb (read body))) (or

Re: [PATCH] ob-core: add org-confirm-babel-evaluate-cell custom variable

2022-12-13 Thread Tom Gillespie
> Will it be clear to users what "cell" means in this context? I assume the language was originally chosen with tables in mind, but I think it is clear? The one issue is that using org-babel-confirm-evaluate doesn't use the word "cell" in the yes-or-no-p prompt. > Am I wrong that, roughly

Re: [PATCH] ob-core: add org-confirm-babel-evaluate-cell custom variable

2022-12-13 Thread Max Nikulin
On 13/12/2022 08:53, Tom Gillespie wrote: +(defcustom org-confirm-babel-evaluate-cell t + "Confirm before evaluating a cell. +This follows the same conventions as `org-confirm-babel-evaluate'." Will it be clear to users what "cell" means in this context? Am I wrong that, roughly speaking,

Re: [PATCH] ob-core: add org-confirm-babel-evaluate-cell custom variable

2022-12-13 Thread Max Nikulin
On 12/12/2022 03:27, Tom Gillespie wrote: #+begin_src elisp :results none (setq-local org-confirm-babel-evaluate-cell (lambda (lang body) (ignore lang) (let ((rb (read body))) (not ; aka (unless condition t) (or (member rb '((or)

Re: [PATCH] ob-core: add org-confirm-babel-evaluate-cell custom variable

2022-12-13 Thread Ihor Radchenko
Tom Gillespie writes: > Hi Ihor, >Here's the updated patch using :safe, and an additional > patch for the news entry to make it easier to apply the > core change to bugfix if needed. Best! LGTM. I will wait a few more days in case if other contributors have something to say and then apply

Re: [PATCH] ob-core: add org-confirm-babel-evaluate-cell custom variable

2022-12-12 Thread Kyle Meyer
Ihor Radchenko writes: > I am also wondering if we should include this into bugfix. > This is a new feature, but it appears to be important enough to be > merged into built-in Org. > Bastien, Kyle, any thoughts? Sounds reasonable to me.

Re: [PATCH] ob-core: add org-confirm-babel-evaluate-cell custom variable

2022-12-12 Thread Tom Gillespie
Hi Ihor, Here's the updated patch using :safe, and an additional patch for the news entry to make it easier to apply the core change to bugfix if needed. Best! Tom > I am also wondering if we should include this into bugfix. I can vouch for the fact that trying to work around this in any

Re: [PATCH] ob-core: add org-confirm-babel-evaluate-cell custom variable

2022-12-12 Thread Ihor Radchenko
Tom Gillespie writes: > Got it. Here's the updated patch (I think I did it correctly?). Thanks! You also need a NEWS entry here. > * lisp/ob-core.el (org-confirm-babel-evaluate-cell): Added to control > execution of cells separate from execution of src blocks, it works in > exactly the same

Re: [PATCH] ob-core: add org-confirm-babel-evaluate-cell custom variable

2022-12-11 Thread Tom Gillespie
:11:17 -0800 Subject: [PATCH] ob-core: add org-confirm-babel-evaluate-cell custom variable * lisp/ob-core.el (org-confirm-babel-evaluate-cell): Added to control execution of cells separate from execution of src blocks, it works in exactly the same way as org-confirm-babel-evaluate. * lisp/ob-core.e

Re: [PATCH] ob-core: add org-confirm-babel-evaluate-cell custom variable

2022-12-11 Thread Kyle Meyer
Tom Gillespie writes: [...] >> :package-version instead of :version? > > I think because org is part of emacs core we use the emacs version? Please use :package-version and let the mapping be handled by customize-package-emacs-version-alist. > I see "24.1" included with other org defcustoms.

Re: [PATCH] ob-core: add org-confirm-babel-evaluate-cell custom variable

2022-12-11 Thread Tom Gillespie
users. Best! Tom From 54e468b60f17b54d81edafd8ee9e22311e519793 Mon Sep 17 00:00:00 2001 From: Tom Gillespie Date: Sat, 10 Dec 2022 12:11:17 -0800 Subject: [PATCH] ob-core: add org-confirm-babel-evaluate-cell custom variable * lisp/ob-core.el (org-confirm-babel-evaluate-cell): Added to control

Re: [PATCH] ob-core: add org-confirm-babel-evaluate-cell custom variable

2022-12-11 Thread Tom Gillespie
Hi Max, Thank you for the feedback. More replies in lines. Best! Tom > I am not sure concerning "exactly". > > lisp/ob-core.el:248 > `org-confirm-babel-evaluate' is called with 2 arguments. In your patch > `org-confirm-babel-evaluate-cell' has a single argument. You're right, and in point of

Re: [PATCH] ob-core: add org-confirm-babel-evaluate-cell custom variable

2022-12-10 Thread Max Nikulin
On 11/12/2022 03:28, Tom Gillespie wrote: Here is a patch that improves the ergonomics and thus hopefully the security for the recent changes to check evaluation for cells. Tom, thank you for the patch. Frankly speaking, I was expecting this kind of complains, but I could not suggest any

[PATCH] ob-core: add org-confirm-babel-evaluate-cell custom variable

2022-12-10 Thread Tom Gillespie
: Sat, 10 Dec 2022 12:11:17 -0800 Subject: [PATCH] ob-core: add org-confirm-babel-evaluate-cell custom variable * lisp/ob-core.el (org-confirm-babel-evaluate-cell): Added to control execution of cells separate from execution of src blocks, it works in exactly the same way as org-confirm-babel-evaluate