From: Leo Butler <Leo.Butler@umanitoba.ca>
To: Max Nikulin <manikulin@gmail.com>
Cc: "emacs-orgmode@gnu.org" <emacs-orgmode@gnu.org>
Subject: Re: [BUG] Unsolicited download of remote resources
Date: Fri, 2 Feb 2024 19:04:44 +0000 [thread overview]
Message-ID: <87h6iq662c.fsf@t14.reltub.ca> (raw)
In-Reply-To: <upj6uk$b7o$1@ciao.gmane.io> (Max Nikulin's message of "Fri, 2 Feb 2024 23:57:54 +0700")
On Fri, Feb 02 2024, Max Nikulin <manikulin@gmail.com> wrote:
> Hi,
>
> Org git main HEAD, try to open the following file:
>
> --- 8< ---
>
> #+setupfile: http://localhost:8000/setup-1234567890.org
>
> test
> --- >8 ---
>
> I am trying to decline attempts to download the remote resource by
> hitting "n" (skip), but Org still tries to fetch that file and does it
> twice. I see in the *Messages*
>
> Please type y, n, d, or !: n
> Contacting host: localhost:8000
> Org couldn’t download "http://localhost:8000/setup-1234567890.org":
> file-error ("make client process failed" "Connection refused" :name
> "localhost" :buffer #<killed buffer> :host "localhost" :service 8000
> :nowait nil :tls-parameters nil :coding nil)
>
> Please type y, n, d, or !: n
> Contacting host: localhost:8000
> Org couldn’t download "http://localhost:8000/setup-1234567890.org":
> file-error ("make client process failed" "Connection refused" :name
> "localhost" :buffer #<killed buffer> :host "localhost" :service 8000
> :nowait nil :tls-parameters nil :coding nil)
>
> From my point of view Org should not do it. Assume it is not a file I
> created myself, but it is downloaded from some web server or received in
> a e-mail message.
When I opened your email in Gnus, I was greeted with the same
(bewildering) message. Given that Org still tried to download the
setupfile after being told not to, I think this is a majour security
hole.
This is also related to another thread concerning Org and email.
https://list.orgmode.org/orgmode/87cyteyhif.fsf@localhost/
Leo
next prev parent reply other threads:[~2024-02-02 19:10 UTC|newest]
Thread overview: 13+ messages / expand[flat|nested] mbox.gz Atom feed top
2024-02-02 16:57 [BUG] Unsolicited download of remote resources Max Nikulin
2024-02-02 19:04 ` Leo Butler [this message]
2024-02-04 12:45 ` Max Nikulin
2024-02-05 19:19 ` Leo Butler
2024-02-05 21:24 ` Ihor Radchenko
2024-02-06 16:32 ` Leo Butler
2024-02-06 16:49 ` Ihor Radchenko
2024-02-02 20:03 ` Ihor Radchenko
2024-02-04 12:21 ` Max Nikulin
2024-02-04 12:32 ` Ihor Radchenko
2024-02-04 12:56 ` Ihor Radchenko
2024-02-08 10:55 ` Max Nikulin
2024-02-08 15:08 ` Ihor Radchenko
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
List information: https://www.orgmode.org/
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=87h6iq662c.fsf@t14.reltub.ca \
--to=leo.butler@umanitoba.ca \
--cc=emacs-orgmode@gnu.org \
--cc=manikulin@gmail.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
Code repositories for project(s) associated with this public inbox
https://git.savannah.gnu.org/cgit/emacs/org-mode.git
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for read-only IMAP folder(s) and NNTP newsgroup(s).