GNU bug report logs - #74218
[PATCH] Ask confirmation before sending region to search engine.

Previous Next

Full log

View this message in rfc822 format

From: Eshel Yaron <me <at> eshelyaron.com>
To: Stefan Kangas <stefankangas <at> gmail.com>
Cc: 74218 <at> debbugs.gnu.org, Eli Zaretskii <eliz <at> gnu.org>, Fabio Natali <me <at> fabionatali.com>
Subject: bug#74218: [PATCH] Ask confirmation before sending region to search engine.
Date: Thu, 07 Nov 2024 09:42:29 +0100

Hi,

Stefan Kangas <stefankangas <at> gmail.com> writes:

> Fabio Natali writes:
>
>> From cdd17053befac8298a04d0cdfc4cafe5a410166b Mon Sep 17 00:00:00 2001
>> From: Fabio Natali <me <at> fabionatali.com>
>> Date: Tue, 5 Nov 2024 23:52:30 +0000
>> Subject: [PATCH v2] Ask confirmation before sending region to search engine
>>
>> With 'eww-search-words' (by default bound to 'M-s M-w') a user
>> can type in some search terms and get back the results of a web
>> search from a predefined search engine. If a region is selected,
>> 'eww-search-words' will use that for the web search instead of
>> prompting the user.
>>
>> In its current form, 'eww-search-words' presents a security and
>> usability problem. It is relatively too easy to mistakenly
>> launch the function and, if a region of text is selected, have
>> potentially sensitive data sent out to a third-party service.
>>
>> This commit changes the search function's default behaviour so
>> that explicit confirmation is required before a region is sent
>> to a search engine. The behaviour can be adjusted via the
>> newly-introduced 'eww-search-confirm-send-region' variable,
>> which is set to true by default.
>
> This is a good addition, thanks.

I too agree that it's a good idea to optionally require confirmation.
However, I suspect that a yes/no question is not the best interface in
this case.  Instead, it's better to simply prepopulate the minibuffer
with the contents of the region.  Then you confirm with RET and cancel
with C-g.  In addition, this lets you examine and edit your input.

Namely, we can implement eww-search-words along the following lines:

--8<---------------cut here---------------start------------->8---
(defun eww-search-words ()
  "..."
  (interactive)
  (eww (eww-read-url-or-search-string
        (and (use-region-p)
             (string-trim (buffer-substring-no-properties (point) (mark)))))))
--8<---------------cut here---------------end--------------->8---

Where eww-read-url-or-search-string is a new function extracted from the
interactive spec of eww:

--8<---------------cut here---------------start------------->8---
(defun eww-read-url-or-search-string (&optional initial-input)
  (let ((uris (eww-suggested-uris)))
    (completing-read (format-prompt "Enter URL or keywords" uris)
                     (seq-uniq (append eww-prompt-history uris))
                     nil nil initial-input 'eww-prompt-history uris)))
--8<---------------cut here---------------end--------------->8---


Just my 2c,

Eshel

Previous Next

GNU bug tracking system
Copyright (C) 1999 Darren O. Benham, 1997,2003 nCipher Corporation Ltd, 1994-97 Ian Jackson.