From: "Juan Manuel Macías" <maciaschain@posteo.net>
To: Max Nikulin <manikulin@gmail.com>
Cc: emacs-orgmode@gnu.org
Subject: Re: [tip] Create and Insert a public Nextcloud/Owncloud link
Date: Sun, 09 Oct 2022 12:21:26 +0000 [thread overview]
Message-ID: <87ilktyypl.fsf@posteo.net> (raw)
In-Reply-To: <thtfdb$mm1$1@ciao.gmane.io> (Max Nikulin's message of "Sun, 9 Oct 2022 10:32:58 +0700")
Max Nikulin writes:
>> Many times I need to create and share a public link to a file
>> in my local folder. In the Nextcloud forum I learned how it can be done
>> from the command line using curl,
> ..
>> │ (result-raw (shell-command-to-string
>> │ (concat "curl -u "
>> │ "\""
>> │ my-username
>> │ ":"
>> │ my-passwd
>> │ "\""
>
> Juan Manuel, your function is a nice proof of concept, but posting
> such code you are responsible for users who may try to use it verbatim
> having less experience with elisp.
>
> Use at least `shell-quote-argument' (though it docstring has a link to
> info "(elisp)Security Considerations"). Just adding quote characters
> is unsafe. You may avoid non-alphanumeric characters in passwords and
> file names for good reasons, but for other users a quote character may
> dramatically change the executed command.
>
> When TRAMP support is not necessary, arguments should be passed to
> external binary as a list without intermediate shell command. I know,
> Emacs does not have a convenience function with such calling
> convention similar to `shell-command-to-string'.
>
> I am almost sure that Emacs has a package to send HTTP POST requests
> directly from elisp. Unsure it has convenient enough API (reasonable
> default timeouts, etc.), but it should be safer for working with
> peculiar file names and passwords stuffed with characters having
> special meaning in shell. I admit that the code would be more verbose.
> It may save you time for recovering you system from damage caused by
> unexpected interpretation of a shell command.
Maxim, you are right that the use of shell-quote-argument is preferable
in cases like these to avoid unexpected problems with filenames,
passwords, and so on. I try to use it almost always. If I don't use it
more often, it's either because I'm lazy (because of my way of naming
the files, I don't expect this type of problems) or because I think it's
unnecessary, although not 100% free of danger[1], as in this case. I'm not
saying my behavior is exemplary, I'm just saying what I tend to do. I
should probably always use shell-quote-argument. In this case, the
affected part of my function would perhaps look better like this:
(shell-command-to-string
(mapconcat #'shell-quote-argument
`("curl"
"-u"
,(format
"%s:%s"
my-user
my-password)
"-H"
"OCS-APIRequest:true"
"-X"
"POST"
,(format
"%s/ocs/v1.php/apps/files_sharing/api/v1/shares"
nextcloud-url)
"-d"
,(format
"path=%s/%s"
nextcloud-public-folder-name
file)
"-d"
"shareType=3"
"-d"
"permissions=1")
" "))
[1] I think that a problem in this context would not go beyond the fact
that the function simply did not work as expected.
Perhaps it would have been better to use call-process-shell-command,
instead of shell-command-to-string, and extract the resulting string
from the output buffer.
On the other hand, I agree with you that whenever possible it is better
to use an Elisp solution than a shell command.
Best regards,
Juan Manuel
--
--
------------------------------------------------------
Juan Manuel Macías
https://juanmanuelmacias.com
https://lunotipia.juanmanuelmacias.com
https://gnutas.juanmanuelmacias.com
prev parent reply other threads:[~2022-10-09 12:22 UTC|newest]
Thread overview: 3+ messages / expand[flat|nested] mbox.gz Atom feed top
2022-10-08 14:29 [tip] Create and Insert a public Nextcloud/Owncloud link Juan Manuel Macías
2022-10-09 3:32 ` Max Nikulin
2022-10-09 12:21 ` Juan Manuel Macías [this message]
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
List information: https://www.orgmode.org/
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=87ilktyypl.fsf@posteo.net \
--to=maciaschain@posteo.net \
--cc=emacs-orgmode@gnu.org \
--cc=manikulin@gmail.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
Code repositories for project(s) associated with this public inbox
https://git.savannah.gnu.org/cgit/emacs/org-mode.git
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for read-only IMAP folder(s) and NNTP newsgroup(s).