Re: Undocumented RCE potential with emacsclient and socket forwarding

Sean Whitton <[email protected]> writes:

> Perry Fraser [31/Jul  9:49am -04] wrote:
>> Sean Whitton <[email protected]> writes:
>>> I think it would be okay just to document it.
>>>
>>> FWIW as a user I would not expect that a forwarded socket would be
>>> locked down in any particular way.
>>
>> Do you have any particular reason not to do a backwards-compatible
>> customization var that allows disabling the `-eval' command?
>
> I'm concerned that it would provide a false sense of security because
> there would be other equivalent ways to make emacsclient do something
> unwanted.

Are these intentional ways? I'm not familiar with what they'd be if
so.

Thanks,

― Perry