GNU bug report logs - #18476
24.3.93; ede-emacs-version: Searching for program: no such file or directory, egrep

Previous Next

Full log

Message #20 received at 18476 <at> debbugs.gnu.org (full text, mbox):

From: David Engster <deng <at> randomsample.de>
To: Stefan Monnier <monnier <at> iro.umontreal.ca>
Cc: 18476 <at> debbugs.gnu.org, Lars Ljung <lars <at> matholka.se>
Subject: Re: bug#18476: 24.3.93;
 ede-emacs-version: Searching for program: no such file or directory,
 egrep
Date: Tue, 16 Sep 2014 23:33:22 +0200

Stefan Monnier writes:
>> - has the Emacs source in a directory which is considered 'safe'
>>   (w.r.t. ede-project-directories), and
>
> I.e. either ede-project-directories explicitly accepts this particular
> directory or it's set to t.  If the dir is explicitly listed, then we
> can say "the user gets what she asked for".  But indeed if it's t we
> don't have that defense.
>
> You say "safe" but the docstring of ede-project-directories doesn't
> mention anything about safety or lack thereof.  Is it dangerous to set
> it to t?

I don't think so.

The Long Answer:

This variable was part of the EDE security fix which lead to the 23.4
release. If you remember, EDE used to simply evaluate the "Project.ede"
files to load a project - code is data, after all - but that made it
easy for an attacker to let your Emacs execute arbitrary code.

The "real" fix was that EDE now parses the Project.ede files if it
actually contains a project definition. However, that code which does
the parsing isn't really trivial, so we also added
`ede-project-directories' with 'nil' as default. The idea was that when
people create their own projects, those should get added
semi-automatically, but if you wanted to load external ones, you'd have
to add those directories by hand.

> By the way, looking at the code of ede-emacs-version, we need to fix all
> those "match-string without checking the success of the previous
> re-search-forward".

Yes, definitely. I can do that, but at least for the emacs-24 branch I
wanted to keep the patch short.

-David

Previous Next

GNU bug tracking system
Copyright (C) 1999 Darren O. Benham, 1997,2003 nCipher Corporation Ltd, 1994-97 Ian Jackson.