<?xml version="1.0" encoding="windows-1252"?>
<node id="842303" title="Vulnerabilities when editing untrusted code... (Komodo)" created="2010-05-30 18:30:33" updated="2010-05-30 18:30:33">
<type id="120">
perlmeditation</type>
<author id="708738">
LanX</author>
<data>
<field name="doctext">
I'm just having a look at the Komodo IDE 5.1 and am observing a nice bundle of diverse Emacs features (though perceptibly slower and limited by python implementation ...).&lt;P&gt;

For instance there is a feature called [http://flymake.sourceforge.net/|flymake-mode] in Emacs lingo, to automatically compile check the code currently editet and to flag errors "on the fly".&lt;P&gt;

...BUT with the difference that this is enabled per default in Komodo (maybe you already wondered how Komodo achieves to underline problematic code lines in red)&lt;P&gt;

Unfortunately this opens a new security issue, not only [id://841239|installing a Perl module can be dangerous], already &lt;u&gt;just opening in some editors can be harmful&lt;/u&gt;.&lt;P&gt;

Just putting a &lt;c&gt;BEGIN { ...do something evil ...}&lt;/c&gt; hidden somewhere in investigated code will cause surprising effects for unwary Komodo users opening it...&lt;P&gt;

Maybe someone feels motivated now to mail some files to colleagues using Active State editors? &lt;P&gt;

Or do you know fellow programmers automatically opening perl code web links in their editor of choice? ;-)&lt;P&gt;

&lt;!-- Node text goes above. Div tags should contain sig only --&gt;
&lt;div class="pmsig"&gt;&lt;div class="pmsig-708738"&gt;
&lt;p&gt;Cheers Rolf
&lt;/div&gt;&lt;/div&gt;&lt;P&gt;

PS: I remember slightly that one of the first big hacking attacks was carried out in the 80s by abusing an emacs vulnerability ...&lt;P&gt;


The only approach I can think of to solve this issue (beside deactivating the feature by default) is to automatically replace each [doc://perlmod#BEGIN%2c-UNITCHECK%2c-CHECK%2c-INIT-and-END|BEGIN, CHECK and UNITCHECK block] with something like &lt;c&gt; sub __BEGIN__ { ... }&lt;/c&gt; before running &lt;c&gt;perl -c&lt;/c&gt;...
</field>
</data>
</node>
