Re: New properties to deny some untrusted code execution

------=_Part_12660_1562766148.1783640014498
Content-Type: multipart/alternative; 
	boundary="----=_Part_12661_1100562214.1783640014498"

------=_Part_12661_1100562214.1783640014498
Content-Type: text/plain; charset="UTF-8"

Some more changes are being made to improve safety and precision when 
running commands from SciTE.

All properties files included with SciTE now quote path name variables in 
commands with double quotes so that paths that include spaces (as is common 
on Windows) or some other special characters work correctly.
For example,
command.build.*.tex=dvips -f $(FileName).dvi > $(FileName).ps
has changed to
command.build.*.tex=dvips -f "$(FileName).dvi" > "$(FileName).ps"

On Unix, it is possible to execute commands inside a string with the 
`command` or $(command) syntaxes. This can be exploited by distributing a 
file with a name containing an invocation like doesNot`doEvil`.c and hoping 
someone runs a compiler or linter on the file through a shell.

To prevent this, SciTE added an unsafe.path.characters property that can be 
set in user options. It currently defaults to `$\" on Unix and is empty on 
Windows. For any path that includes any of these characters, SciTE refuses 
to run commands through shell. Most people never use these characters in 
file names so this should have little impact but if you want to you can set 
unsafe.path.characters to empty.

It is also possible to perform Unix shell escaping on commands with the 
properties escape function like this:
command.go.*.py=py $(escape FileNameExt)
Escaping can be tricky to get just right in some circumstances and 
unsafe.path.characters is more robust so should be the default strategy 
here.

The committed changes can be examined either in the repositories

hg clone http://hg.code.sf.net/p/scintilla/scite

or from

https://www.scintilla.org/scite.zip Source
https://www.scintilla.org/wscite.zip Windows executable (64-bit)

Neil

-- 
You received this message because you are subscribed to the Google Groups "scite-interest" group.
To unsubscribe from this group and stop receiving emails from it, send an email to [email protected].
To view this discussion visit https://groups.google.com/d/msgid/scite-interest/5fc8a679-902e-4ee3-ba46-7f4b446f744bn%40googlegroups.com.

------=_Part_12661_1100562214.1783640014498
Content-Type: text/html; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable

Some more changes are being made to improve safety and precision when runni=
ng commands from SciTE.<br /><br />All properties files included with SciTE=
 now quote path name variables in commands with double quotes so that paths=
 that include spaces (as is common on Windows) or some other special charac=
ters work correctly.<br />For example,<br />command.build.*.tex=3Ddvips -f =
$(FileName).dvi &gt; $(FileName).ps<br />has changed to<br />command.build.=
*.tex=3Ddvips -f "$(FileName).dvi" &gt; "$(FileName).ps"<br /><br />On Unix=
, it is possible to execute commands inside a string with the `command` or =
$(command) syntaxes. This can be exploited by distributing a file with a na=
me containing an invocation like doesNot`doEvil`.c and hoping someone runs =
a compiler or linter on the file through a shell.<br /><br />To prevent thi=
s, SciTE added an unsafe.path.characters property that can be set in user o=
ptions. It currently defaults to `$\" on Unix and is empty on Windows. For =
any path that includes any of these characters, SciTE refuses to run comman=
ds through shell. Most people never use these characters in file names so t=
his should have little impact but if you want to you can set  unsafe.path.c=
haracters to empty.<br /><br />It is also possible to perform Unix shell es=
caping on commands with the properties escape function like this:<br />comm=
and.go.*.py=3Dpy $(escape FileNameExt)<br />Escaping can be tricky to get j=
ust right in some circumstances and unsafe.path.characters is more robust s=
o should be the default strategy here.<br /><br /> The committed changes ca=
n be examined either in the repositories<br /><br />   hg clone <a href=3D"=
http://hg.code.sf.net/p/scintilla/scite">http://hg.code.sf.net/p/scintilla/=
scite</a><br /><br />or from<br /><br />   <a href=3D"https://www.scintilla=
.org/scite.zip">https://www.scintilla.org/scite.zip</a> Source<br />   <a h=
ref=3D"https://www.scintilla.org/wscite.zip">https://www.scintilla.org/wsci=
te.zip</a> Windows executable (64-bit)<br /> <br />Neil

<p></p>

-- <br />
You received this message because you are subscribed to the Google Groups &=
quot;scite-interest&quot; group.<br />
To unsubscribe from this group and stop receiving emails from it, send an e=
mail to <a href=3D"mailto:[email protected]">scit=
[email protected]</a>.<br />
To view this discussion visit <a href=3D"https://groups.google.com/d/msgid/=
scite-interest/5fc8a679-902e-4ee3-ba46-7f4b446f744bn%40googlegroups.com?utm=
_medium=3Demail&utm_source=3Dfooter">https://groups.google.com/d/msgid/scit=
e-interest/5fc8a679-902e-4ee3-ba46-7f4b446f744bn%40googlegroups.com</a>.<br=
 />

------=_Part_12661_1100562214.1783640014498--

------=_Part_12660_1562766148.1783640014498--