Comparing changes
Open a pull request
We have many constants such as \c_underscore_str. Of course they belong to the "str" module, but if someone were to write an "underscore" package it would not necessarily be crazy for them to have some parameter \g_underscore_tl to customize the package. To avoid confusion, reserve these names. I've not reserved two, three, ..., thirty because we are deprecating these integer constants. Sorry for the last commit, it was a bit messed up, now fixed.
That was still listing names of the form \ptex_... and \uptex_... as existing.
I'll do other areas later. Note that as we have a single repo the 'compare' links see _everything_.
Even though not much happened here that was public.
This alters the results but also makes f-typ expandable.
The non-expandable \lua_shipout_x:n still to do: need to check on exact details!
The behaviour of # here is e-type not x-type.
These variants are likely useful anyway.
The meaning here is very different from other uses.
The expansion here is not quite :ee - the second e-type is 'hidden'. So we almost go back to _e, except it is _e due to the handling of #, and expandability.
This will help with piped input.
Not currently setting x-type from pipe.
Thanks to BLF for the suggestion.
This then works without needing to worry about Windows vs Unix issues.
I changed \meat to \meta in one place.
Showing you all comments on commits in this comparison.
This comment has been minimized.
This comment has been minimized.
|
why the extension is |
This comment has been minimized.
This comment has been minimized.
|
@stone-zeng Because I wrote it in TeXworks and failed to tidy that up on the first pass. Should now all be correct. |
This comment has been minimized.
This comment has been minimized.
|
There is a typo: should be |
This comment has been minimized.
This comment has been minimized.
|
Quoting this line of code, I've asked this question
|
This comment has been minimized.
This comment has been minimized.
|
Do we need to worry about quoting or escaping special (per-shell) characters at this level? For example, if I write |
This comment has been minimized.
This comment has been minimized.
|
At present this is all highly experimental, and spaces are likely out. The reason is that we need to quote them to allow the I'll need to think about quoting more generally: we may well need to provide some functions in this area. |
This comment has been minimized.
This comment has been minimized.
|
Yeah, quoting and escaping is always a bit tricky—compounded by trying to do it in a cross-platform way. Without quoting, you could potentially do something like Also, should these macros emit a warning for the Finally, I should mention that I'm generally in favor of providing some cross-platform abstractions for common file system operations that are likely to be useful in multiple packages and by document authors. One benefit from a security standpoint is that it provides a smaller attack surface. If there's a bug, fixing it solves the issue for all the packages using the |
This comment has been minimized.
This comment has been minimized.
|
Please take a look at https://xkcd.com/327. It is the famous little Bobby Drop Tables story.
There's an exploit here. Publish the TeX source for a 'major research result'. Which requires this package. The eager user trusts the LaTeX 3 team, and so enables shell escape. They want to read the paper. And now we're in the Bobby Drop Tables situation.
This is similar to the many of Microsoft Word exploits. Send an expected email, apparently from a colleague, containing a document, etc.
|
This comment has been minimized.
This comment has been minimized.
I don't agree, even with completely safe escaping. Once 'unrestricted shell escape' is enabled, the door is completely wide open. We have Bobby Drop Tables. For me the big attack vector is persuading the user (or system admin or whatever) to enable unrestricted shell escape. Don't help the bad guy use the social authority of the LaTeX project. Dear user, just click on a button, so the document can compile. |
This comment has been minimized.
This comment has been minimized.
|
@jfine2358 There are security issues inherent in using the These macros don't enable shell escape. Neither do they encourage the use shell escape per se. They merely provide a common interface for package authors to perform some basic file system manipulation so they don't have to each write their own (potentially buggy) implementations. If LaTeX 3 handles the quoting and escaping well, then that solves a lot of the more common issues. It sounds like you're taking issue with the |
This comment has been minimized.
This comment has been minimized.
|
I've added issue
I suggest we move the discussion there. |
There are no files selected for viewing