bug#32495: 26.1; Arbitrary code execution when completing inside untrusted elisp code

[Stefan Monnier]

> 1. pass in an environment with all untrusted macros replaced with dummies:

Sounds like a good first step.

We could even start with a blacklist rather than a whitelist
(eval-when-compile, eval-and-compile, cl-eval-when, ...), so the point
would be to protect oneself from accidental problems rather than from
malign adversaries.

> 2. bind all eval-capable functions first (INCOMPLETE, there are other
> eval-capable functions, such as load):

Trying to plug each and every hole sounds like a losing game
(e.g. you can implement `eval` by building a `(lambda () ,exp) and then
causing it to be called one way or another).

Ideally, we'd have some way to confine Elisp code to a sandbox of some
sort (e.g. no access to any I/O and all changes to global vars are ignored).


        Stefan