Re: Help wanted evaluating claimed security vulnerability in groff

"G. Branden Robinson" <[email protected]> writes:

>> I suggest not trying to validate the directives, which is bound to be
>> a headache and just using posix_spawn or fork + exec. If that is
>> possible.
>
> While I like the idea of using Bruno's "new" (relative to groff) support
> for posix_spawn() in gnulib, and he and I have mooted the issue
> before,[A] I'm a little leery of screwing with this aspect of the code
> unless I can establish a review loop with Eli Zaretskii, who seems to be
> the only contributor for many years to groff's Windows support, and
> Windows is the only non-POSIX platform for which I have any evidence of
> any groff release being circulated on the Web in the past decade or so.

Ah, I see. I saw that the Windows code exists and assumed it worked
reasonably well. I didn't know about [A] where Bruno mentioned some
issues/considerations with regards to Cygwin. I guess executing BSHELL
on Windows also seems a bit weird to me. But like you, I do not use
Windows enough (ever) to know. I probably should test it more, given
that I roughly recall Eli mentioning maintaining Emacs on it could use
more people.

Collin

> [A] https://lists.gnu.org/archive/html/groff/2023-04/msg00163.html