GNU bug report logs - #44837
28.0.50; Local-variables: in middle of file wants to get executed

Previous Next

Full log

View this message in rfc822 format

From: Jean Louis <bugs <at> gnu.support>
To: 44837 <at> debbugs.gnu.org
Subject: bug#44837: 28.0.50; Local-variables: in middle of file wants to get executed
Date: Tue, 24 Nov 2020 12:54:25 +0300

How to reproduce:

- make email with the text containing Local-variables as below.

-------------------- text begin below-----------------------
* Eric S Fraga <e.fraga <at> ucl.ac.uk> [2020-11-24 12:46]:
> On Tuesday, 24 Nov 2020 at 12:00, Jean Louis wrote:
> > Can I automated the execution of Babel code upon opening of the Org
> > file?
> 
> You can, by using file local variables.  For instance, for some files, I
> do this:
> 
> #+begin_src org
>   ,* local variables                         :noexport:
>   # Local Variables:
>   # eval: (org-sbe "startup")
>   # End:
> #+end_src
> 
> which will evaluate the named src block "startup" when file is opened.
> 
> Note that this is a potential security hole so only do this for files
> you trust!

For me is fine, as I do that for files I create.

When I have opened this email i was also asked to set local variables,
imagine. So that could maybe also mean that one could send email that
is constructed as Org file and if user answers YES, one could inject
malicious stuff.

--------------- the text above -------------------
still asks me if I like to allow eval: (org-sbe "startup")

So I think this is bug in Emacs as Local-variables should be on the
end of the file.

I am asked when editing such email to execute those local variables
above quoted even though they are not on the end of the file. I think
this is security issue as described above in the same file. People
could spam other users, include some local variables and those
answering with Emacs could send them their email addresses, or
passwods or other private information, it could also invoke various
modes like Org mode and execute various scripts.

-- 
Thanks,
Jean Louis
⎔ λ 🄯 𝍄 𝌡 𝌚

Previous Next

GNU bug tracking system
Copyright (C) 1999 Darren O. Benham, 1997,2003 nCipher Corporation Ltd, 1994-97 Ian Jackson.