From: Ihor Radchenko <yantar92@posteo.net>
To: Max Nikulin <manikulin@gmail.com>
Cc: emacs-orgmode@gnu.org
Subject: Re: Warn about shell-expansion in the docstring of org-latex-to-html-convert-command
Date: Sun, 31 Mar 2024 08:25:31 +0000 [thread overview]
Message-ID: <87v852g64k.fsf@localhost> (raw)
In-Reply-To: <ushuu6$hpn$1@ciao.gmane.io>
[-- Attachment #1: Type: text/plain, Size: 453 bytes --]
Max Nikulin <manikulin@gmail.com> writes:
>> Attaching tentative patch that fixes the problem.
>
> I think it is in the right direction.
> - Manual needs update as well.
> - I would explicitly stress that quotes causes undefined or even
> dangerous behavior. See e.g. the last paragraph
> https://specifications.freedesktop.org/desktop-entry-spec/latest/ar01s07.html
I have incorporated the above suggestions into the attached version of
the patch.
[-- Warning: decoded text below may be mangled, UTF-8 assumed --]
[-- Attachment #2: 0001-org-latex-to-mathml-html-convert-command-Prevent-she.patch --]
[-- Type: text/x-patch, Size: 5262 bytes --]
From 5dbe4457d0d938e8830888bc3ac58d6a43136558 Mon Sep 17 00:00:00 2001
Message-ID: <5dbe4457d0d938e8830888bc3ac58d6a43136558.1711873441.git.yantar92@posteo.net>
From: Ihor Radchenko <yantar92@posteo.net>
Date: Fri, 8 Mar 2024 14:05:12 +0300
Subject: [PATCH] org-latex-to-mathml/html-convert-command: Prevent shell
expansion
* lisp/org.el (org-create-math-formula):
(org-format-latex-as-html): Shell-quote LaTeX fragment text when
replacing %i placeholder. This prevents shell expansion of
$... and similar constructs inside the code.
(org-latex-to-mathml-convert-command):
(org-latex-to-html-convert-command): Update the docstring.
* etc/ORG-NEWS (~org-latex-to-mathml-convert-command~ and
~org-latex-to-html-convert-command~ shell-escape LaTeX code): Announce
the breaking change.
* doc/org-manual.org (LaTeX math snippets): Update example.
Reported-by: Max Nikulin <manikulin@gmail.com>
Link: https://orgmode.org/list/735645dd-1ddf-4579-a6dd-2700f3e83c94@gmail.com
---
doc/org-manual.org | 2 +-
etc/ORG-NEWS | 10 ++++++++++
lisp/org.el | 21 ++++++++++-----------
3 files changed, 21 insertions(+), 12 deletions(-)
diff --git a/doc/org-manual.org b/doc/org-manual.org
index c4f62644f..acc4512a5 100644
--- a/doc/org-manual.org
+++ b/doc/org-manual.org
@@ -15176,7 +15176,7 @@ **** LaTeX math snippets
#+begin_src emacs-lisp
(setq org-latex-to-mathml-convert-command
- "latexmlmath \"%i\" --presentationmathml=%o")
+ "latexmlmath %i --presentationmathml=%o")
#+end_src
To quickly verify the reliability of the LaTeX-to-MathML
diff --git a/etc/ORG-NEWS b/etc/ORG-NEWS
index ee2cdfd16..739c3a43b 100644
--- a/etc/ORG-NEWS
+++ b/etc/ORG-NEWS
@@ -13,6 +13,16 @@ Please send Org bug reports to mailto:emacs-orgmode@gnu.org.
* Version 9.7 (not released yet)
** Important announcements and breaking changes
+*** ~org-latex-to-mathml-convert-command~ and ~org-latex-to-html-convert-command~ shell-escape LaTeX code
+
+Previously, ~org-latex-to-mathml-convert-command~ and
+~org-latex-to-html-convert-command~ replaced %i placeholders with raw
+LaTeX fragment text, potentially triggering shell-expansion.
+
+Now, the %i placeholders are shell-escaped to prevent shell expansion.
+
+The existing customizations that assume no shell-escaping must be updated.
+
*** Built-in HTML, LaTeX, Man, Markdown, ODT, and Texinfo exporters preserve the link protocol during export
Previously, some link types where not exported as =protocol:uri= but
diff --git a/lisp/org.el b/lisp/org.el
index f3fae134d..f56767a1a 100644
--- a/lisp/org.el
+++ b/lisp/org.el
@@ -3266,7 +3266,9 @@ (defcustom org-latex-to-mathml-convert-command nil
%j: Executable file in fully expanded form as specified by
`org-latex-to-mathml-jar-file'.
%I: Input LaTeX file in fully expanded form.
-%i: The latex fragment to be converted.
+%i: Shell-escaped LaTeX fragment to be converted.
+ It must not be used inside a quoted argument, the result of %i
+ expansion inside a quoted argument is undefined.
%o: Output MathML file.
This command is used by `org-create-math-formula'.
@@ -3275,7 +3277,7 @@ (defcustom org-latex-to-mathml-convert-command nil
\"java -jar %j -unicode -force -df %o %I\".
When using LaTeXML set this option to
-\"latexmlmath \"%i\" --presentationmathml=%o\"."
+\"latexmlmath %i --presentationmathml=%o\"."
:group 'org-latex
:version "24.1"
:type '(choice
@@ -3288,15 +3290,12 @@ (defcustom org-latex-to-html-convert-command nil
directly replace the LaTeX fragment in the resulting HTML.
Replace format-specifiers in the command as noted below and use
`shell-command' to convert LaTeX to HTML.
-%i: The LaTeX fragment to be converted.
+%i: The LaTeX fragment to be converted (shell-escaped).
+ It must not be used inside a quoted argument, the result of %i
+ expansion inside a quoted argument is undefined.
For example, this could be used with LaTeXML as
-\"latexmlc \\='literal:%i\\=' --profile=math --preload=siunitx.sty 2>/dev/null\".
-
-The LaTeX fragment is replaced as is, without escaping special shell
-syntax. It may be necessary to use single-quotes around \\='%i\\=', not
-double-quotes. Else a math fragment such as \"$y = 200$\" may be
-expanded to \" = 200\"."
+\"latexmlc literal:%i --profile=math --preload=siunitx.sty 2>/dev/null\"."
:group 'org-latex
:package-version '(Org . "9.4")
:type '(choice
@@ -16332,7 +16331,7 @@ (defun org-create-math-formula (latex-frag &optional mathml-file)
(expand-file-name
org-latex-to-mathml-jar-file))))
(?I . ,(shell-quote-argument tmp-in-file))
- (?i . ,latex-frag)
+ (?i . ,(shell-quote-argument latex-frag))
(?o . ,(shell-quote-argument tmp-out-file)))))
mathml shell-command-output)
(when (called-interactively-p 'any)
@@ -16400,7 +16399,7 @@ (defun org-format-latex-as-html (latex-fragment)
"Convert LATEX-FRAGMENT to HTML.
This uses `org-latex-to-html-convert-command', which see."
(let ((cmd (format-spec org-latex-to-html-convert-command
- `((?i . ,latex-fragment)))))
+ `((?i . ,(shell-quote-argument latex-fragment))))))
(message "Running %s" cmd)
(shell-command-to-string cmd)))
--
2.44.0
[-- Attachment #3: Type: text/plain, Size: 224 bytes --]
--
Ihor Radchenko // yantar92,
Org mode contributor,
Learn more about Org mode at <https://orgmode.org/>.
Support Org development at <https://liberapay.com/org-mode>,
or support my work at <https://liberapay.com/yantar92>
next prev parent reply other threads:[~2024-03-31 8:26 UTC|newest]
Thread overview: 33+ messages / expand[flat|nested] mbox.gz Atom feed top
2024-02-16 23:10 Warn about shell-expansion in the docstring of org-latex-to-html-convert-command Martin Edström
2024-02-18 16:06 ` Ihor Radchenko
2024-02-18 18:56 ` Martin Edström
2024-02-18 19:36 ` Martin Edström
2024-02-19 8:30 ` Ihor Radchenko
2024-02-21 14:38 ` Max Nikulin
2024-02-21 14:57 ` Martin Edström
2024-02-21 15:04 ` Martin Edström
2024-02-21 15:08 ` Martin Edström
2024-02-23 12:46 ` Ihor Radchenko
2024-02-25 10:41 ` Max Nikulin
2024-02-26 10:48 ` Ihor Radchenko
2024-02-26 16:37 ` Max Nikulin
2024-03-08 11:16 ` Ihor Radchenko
2024-03-09 15:23 ` Max Nikulin
2024-03-10 5:02 ` [PATCH] Unit tests for function calling MathML converters (Re: Warn about shell-expansion in the docstring of org-latex-to-html-convert-command) Max Nikulin
2024-03-31 8:27 ` Ihor Radchenko
2024-04-01 10:39 ` Max Nikulin
2024-04-01 11:23 ` Ihor Radchenko
2024-03-12 13:03 ` Warn about shell-expansion in the docstring of org-latex-to-html-convert-command Ihor Radchenko
2024-03-13 14:27 ` Max Nikulin
2024-03-15 13:49 ` Ihor Radchenko
2024-03-18 10:50 ` Max Nikulin
2024-03-19 14:48 ` Ihor Radchenko
2024-03-19 14:49 ` Ihor Radchenko
2024-03-19 16:22 ` Max Nikulin
2024-03-19 16:27 ` Ihor Radchenko
2024-03-19 16:45 ` fixup! and git Max Nikulin
2024-03-19 16:50 ` Ihor Radchenko
2024-03-31 8:25 ` Ihor Radchenko [this message]
2024-04-01 10:29 ` Warn about shell-expansion in the docstring of org-latex-to-html-convert-command Max Nikulin
2024-04-01 11:15 ` Ihor Radchenko
2024-03-05 12:01 ` Max Nikulin
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
List information: https://www.orgmode.org/
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=87v852g64k.fsf@localhost \
--to=yantar92@posteo.net \
--cc=emacs-orgmode@gnu.org \
--cc=manikulin@gmail.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
Code repositories for project(s) associated with this public inbox
https://git.savannah.gnu.org/cgit/emacs/org-mode.git
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for read-only IMAP folder(s) and NNTP newsgroup(s).