Re: Undocumented RCE potential with emacsclient and socket forwarding

Perry Fraser [31/Jul 10:30am -04] wrote:
> Sean Whitton <[email protected]> writes:
>
>> Perry Fraser [31/Jul  9:49am -04] wrote:
>>> Sean Whitton <[email protected]> writes:
>>>> I think it would be okay just to document it.
>>>>
>>>> FWIW as a user I would not expect that a forwarded socket would be
>>>> locked down in any particular way.
>>>
>>> Do you have any particular reason not to do a backwards-compatible
>>> customization var that allows disabling the `-eval' command?
>>
>> I'm concerned that it would provide a false sense of security because
>> there would be other equivalent ways to make emacsclient do something
>> unwanted.
>
> Are these intentional ways? I'm not familiar with what they'd be if
> so.

I don't know, but we haven't audited emacsclient for ways to make it
misbehave in this sort of way.

-- 
Sean Whitton