Potential security issue in ESSR #429
Assignees
Labels
Comments
|
This is high priority. We really need to do something about it. That probably means shipping a tar.gz with the distribution. |
|
Can we not just switch from http: to https: ? |
vspinu
added a commit
that referenced
this issue
Jun 3, 2017
|
Ok. I have done that. There was a reason why it's fetched from a remote. Back then I couldn't find a satisfactory solution for the file transfer, but things might have changed. |
|
Out of interest, why pull a binary from a personal server containing an R environment, containing a single R function? Why not just include that function as part of ESS? (This behavior has spooked me a little.) |
|
It contains quite a bit more than one function. I think the right approach would be to send the archive through TRAMP. Current situation is clearly unsatisfactory. |
jabranham
added a commit
to jabranham/ESS
that referenced
this issue
Aug 23, 2018
Instead of downloading ESSR.rda from a website, we'll transfer it from the local machine to the remote machine. This will probably be faster anyway if the two computers are on the same network. Closes emacs-ess#429
jabranham
added a commit
to jabranham/ESS
that referenced
this issue
Aug 26, 2018
Instead of downloading ESSR.rda from a website, we'll transfer it from the local machine to the remote machine. This will probably be faster anyway if the two computers are on the same network. Closes emacs-ess#429
jabranham
added a commit
to jabranham/ESS
that referenced
this issue
May 29, 2019
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Hi!
While using ESS remotely (which worked great), I noticed that ESS instructs the remote server to load and execute a .rda file from a 3rd party server over HTTP (see
etc/ESSR/LOADREMOTE) Since this file can contain arbitrary code, this could be an issue. Would it be possible to either load the .rda from a more secure address (e.g. https://raw.github...), or even better, just send the R source code over ssh? On my machine it takes <100 ms to parse, and I think this would increase reliability too, for example in cases where the remote server is behind a firewall.The text was updated successfully, but these errors were encountered: