New properties to deny some untrusted code execution

------=_Part_71814_1976057786.1782083042998
Content-Type: multipart/alternative; 
	boundary="----=_Part_71815_1613621184.1782083042998"

------=_Part_71815_1613621184.1782083042998
Content-Type: text/plain; charset="UTF-8"

Some new properties have been committed to SciTE to prevent some possible 
execution of untrusted code.

When some files are downloaded, perhaps a project from GitHub, there may be 
SciTE.properties files included to customize settings for those files. Some 
of these are minor like changing the set of keywords for a programming 
language or the colour of comments but some may have further ramifications.

SciTE.properties may set the Lua scripting file with ext.lua.startup.script 
which is automatically run. This has legitimate uses such as providing new 
commands for the downloaded files but may also read and write files or 
execute commands. Setting  ext.lua.startup.script in SciTE.properties will 
now be disabled unless allow.local.script is set to 1 in user or global 
options. allow.local.script also controls whether the 
extension.<filepattern> property may be set in SciTE.properties.

Script lexers may be implemented in Lua and accessed by specifying 
lexer.<filepattern>=script_<name> and this is now disabled 
unless allow.script.lexer is set to 1 in user or global options.

These features are rarely used so requiring an extra property setting is 
not a large burden.

The properties.local.enable property may be set to 0 to completely disable 
reading SciTE.properties files. This is a drastic reduction in SciTE 
capabilities but can be used in particularly security-conscious situations. 
This setting may evolve in the future with allow-lists or deny-lists for 
where local options files may be used.

While I haven't heard of any exploits that target SciTE.properties, other 
more popular editors have been targeted.

The committed changes can be examined either in the repositories

   hg clone http://hg.code.sf.net/p/scintilla/scite

or from

   https://www.scintilla.org/scite.zip Source
   https://www.scintilla.org/wscite.zip Windows executable (64-bit)

Neil

-- 
You received this message because you are subscribed to the Google Groups "scite-interest" group.
To unsubscribe from this group and stop receiving emails from it, send an email to [email protected].
To view this discussion visit https://groups.google.com/d/msgid/scite-interest/16780357-6861-4eb2-a652-a225117bff4an%40googlegroups.com.

------=_Part_71815_1613621184.1782083042998
Content-Type: text/html; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable

Some new properties have been committed to SciTE to prevent some possible e=
xecution of untrusted code.<div><br /></div><div>When some files are downlo=
aded, perhaps a project from GitHub, there may be SciTE.properties files in=
cluded to customize settings for those files. Some of these are minor like =
changing the set of keywords for a programming language or the colour of co=
mments but some may have further ramifications.</div><div><br /></div><div>=
SciTE.properties may set the Lua scripting file with=C2=A0ext.lua.startup.s=
cript which is automatically run. This has legitimate uses such as providin=
g new commands for the downloaded files but may also read and write files o=
r execute commands. Setting=C2=A0

ext.lua.startup.script in SciTE.properties will now be disabled unless=C2=
=A0allow.local.script is set to 1 in user or global options. allow.local.sc=
ript also controls whether the extension.&lt;filepattern&gt; property may b=
e set in SciTE.properties.</div><div><br /></div><div>Script lexers may be =
implemented in Lua and accessed by specifying lexer.&lt;filepattern&gt;=3Ds=
cript_&lt;name&gt; and this is now disabled unless=C2=A0allow.script.lexer =
is set to 1 in=C2=A0user or global options.</div><div><br /></div><div>Thes=
e features are rarely used so requiring an extra property setting is not a =
large burden.</div><div><br /></div><div>The=C2=A0properties.local.enable p=
roperty may be set to 0 to completely disable reading SciTE.properties file=
s. This is a drastic reduction in SciTE capabilities but can be used in par=
ticularly security-conscious situations. This setting may evolve in the fut=
ure with allow-lists or deny-lists for where local options files may be use=
d.</div><div><br /></div><div>While I haven't heard of any exploits that ta=
rget SciTE.properties, other more popular editors have been targeted.<br />=
<div><br /></div><div><span style=3D"color: rgb(34, 34, 34); font-family: A=
rial, Helvetica, sans-serif; font-size: small;">The committed changes can b=
e examined either in the repositories</span><br style=3D"color: rgb(34, 34,=
 34); font-family: Arial, Helvetica, sans-serif; font-size: small;" /><br s=
tyle=3D"color: rgb(34, 34, 34); font-family: Arial, Helvetica, sans-serif; =
font-size: small;" /><span style=3D"color: rgb(34, 34, 34); font-family: Ar=
ial, Helvetica, sans-serif; font-size: small;">=C2=A0 =C2=A0hg clone=C2=A0<=
/span><a href=3D"http://hg.code.sf.net/p/scintilla/scite" rel=3D"noreferrer=
" target=3D"_blank" style=3D"color: rgb(17, 85, 204); font-family: Arial, H=
elvetica, sans-serif; font-size: small;">http://hg.code.sf.net/p/scintilla/=
scite</a><br style=3D"color: rgb(34, 34, 34); font-family: Arial, Helvetica=
, sans-serif; font-size: small;" /><br style=3D"color: rgb(34, 34, 34); fon=
t-family: Arial, Helvetica, sans-serif; font-size: small;" /><span style=3D=
"color: rgb(34, 34, 34); font-family: Arial, Helvetica, sans-serif; font-si=
ze: small;">or from</span><br style=3D"color: rgb(34, 34, 34); font-family:=
 Arial, Helvetica, sans-serif; font-size: small;" /><br style=3D"color: rgb=
(34, 34, 34); font-family: Arial, Helvetica, sans-serif; font-size: small;"=
 /><span style=3D"color: rgb(34, 34, 34); font-family: Arial, Helvetica, sa=
ns-serif; font-size: small;">=C2=A0 =C2=A0</span><a href=3D"https://www.sci=
ntilla.org/scite.zip" rel=3D"noreferrer" target=3D"_blank" style=3D"color: =
rgb(17, 85, 204); font-family: Arial, Helvetica, sans-serif; font-size: sma=
ll;">https://www.scintilla.org/scite.zip</a><span style=3D"color: rgb(34, 3=
4, 34); font-family: Arial, Helvetica, sans-serif; font-size: small;">=C2=
=A0Source</span><br style=3D"color: rgb(34, 34, 34); font-family: Arial, He=
lvetica, sans-serif; font-size: small;" /><span style=3D"color: rgb(34, 34,=
 34); font-family: Arial, Helvetica, sans-serif; font-size: small;">=C2=A0 =
=C2=A0</span><a href=3D"https://www.scintilla.org/wscite.zip" rel=3D"norefe=
rrer" target=3D"_blank" style=3D"color: rgb(17, 85, 204); font-family: Aria=
l, Helvetica, sans-serif; font-size: small;">https://www.scintilla.org/wsci=
te.zip</a><span style=3D"color: rgb(34, 34, 34); font-family: Arial, Helvet=
ica, sans-serif; font-size: small;">=C2=A0Windows executable (64-bit)</span=
><font color=3D"#888888" style=3D"font-family: Arial, Helvetica, sans-serif=
; font-size: small;"><br /><br />Neil</font></div></div>

<p></p>

-- <br />
You received this message because you are subscribed to the Google Groups &=
quot;scite-interest&quot; group.<br />
To unsubscribe from this group and stop receiving emails from it, send an e=
mail to <a href=3D"mailto:[email protected]">scit=
[email protected]</a>.<br />
To view this discussion visit <a href=3D"https://groups.google.com/d/msgid/=
scite-interest/16780357-6861-4eb2-a652-a225117bff4an%40googlegroups.com?utm=
_medium=3Demail&utm_source=3Dfooter">https://groups.google.com/d/msgid/scit=
e-interest/16780357-6861-4eb2-a652-a225117bff4an%40googlegroups.com</a>.<br=
 />

------=_Part_71815_1613621184.1782083042998--

------=_Part_71814_1976057786.1782083042998--