Re: Emacs Arbitrary Code Execution and How to Avoid It

[Jean Louis]

* Christopher Howard <christopher@librehacker.com> [2024-12-03 20:56]:
> Hi, I read the interesting write up here:
> 
> https://eshelyaron.com/posts/2024-11-27-emacs-aritrary-code-execution-and-how-to-avoid-it.html
> 
> I wasn't terribly worried about this, as I don't *automatically* activate 
> Flymake or Flycheck. But the article did mention that "code completion runs 
> arbitrary code", and I was wondering more about that. I do not currently use 
> Completion Preview mode. I have used Company in the past but company-mode is 
> not currently activated. So, if I am just viewing an elisp file, i.e., not 
> typing anything it in, nor running dabbrev commands, is there any danger? 
> Should I setup Emacs to, by default, open all elisp files in View Mode?
> 
> Regarding dabbrev, I know dabbrev can search all buffers but I don't know if 
> it does any macro expansion.
> 
> I was going to e-mail the author of the post, but cloudflare won't let me see 
> his e-mail address.

In every programming language it is possible to obscure the code and execute 
arbitrary code.

I do not see it as special security issue, it is common, known.

-- 
Jean Louis