Re: [PATCH] Fix ob-latex.el command injection vulnerability.

[Max Nikulin]

On 09/03/2023 19:22, Ihor Radchenko wrote:
> lux writes:
> > Hi, this is a new patch, let me briefly explain this patch:

Thank you for scratching my itch related to unsafe shell commands in Org 
Mode.

> > 2. `org-babel-latex-convert-pdf' is not safe, simple test:
...
> I am not sure if blindly adding `shell-quote-argument' is safe here.

I believe, first hunk still can be committed.

> >       (shell-command cmd)))
>
> im-in-options and im-out-options, according to
> https://orgmode.org/worg/org-contrib/babel/languages/ob-doc-LaTeX.html,
> are options passed to ImageMagick.

ImageMagick is disaster per se.

Ideally `call-process' or `process-file' should be here instead of 
`shell-command' making `shell-quote-argument' unnecessary. Sorry, it is 
not clear for me if remote files (e.g. /ssh:...) are supported here. 
Unfortunately options as a string, not as a list, means compatibility 
issue. `split-string-and-unquote' may cause new bugs.

I have not evaluated it yet, but from discussions on this list I have an 
impression that some LaTeX packages need to run external commands. I am 
unsure to which degree it is safe or it may be easily exploited.