From mboxrd@z Thu Jan 1 00:00:00 1970 X-Msuck: nntp://news.gmane.io/gmane.text.pandoc/30546 Path: news.gmane.io!.POSTED.blaine.gmane.org!not-for-mail From: Albert Krewinkel Newsgroups: gmane.text.pandoc Subject: Re: Lua filter security: safe mode? Date: Thu, 12 May 2022 14:16:25 +0200 Message-ID: <87r14yzzb1.fsf@zeitkraut.de> References: <13cd1f3a-bc26-49cf-a7df-ec8d56fcf05an@googlegroups.com> Reply-To: pandoc-discuss-/JYPxA39Uh5TLH3MbocFFw@public.gmane.org Mime-Version: 1.0 Content-Type: text/plain; charset="UTF-8" Injection-Info: ciao.gmane.io; posting-host="blaine.gmane.org:116.202.254.214"; logging-data="35589"; mail-complaints-to="usenet@ciao.gmane.io" To: pandoc-discuss-/JYPxA39Uh5TLH3MbocFFw@public.gmane.org Original-X-From: pandoc-discuss+bncBCZJF7XJTILRBB4H6SJQMGQEZWYP6OA-/JYPxA39Uh5TLH3MbocFFw@public.gmane.org Thu May 12 14:54:36 2022 Return-path: Envelope-to: gtp-pandoc-discuss@m.gmane-mx.org Original-Received: from mail-lj1-f184.google.com ([209.85.208.184]) by ciao.gmane.io with esmtps (TLS1.3:ECDHE_RSA_AES_128_GCM_SHA256:128) (Exim 4.92) (envelope-from ) id 1np8Ky-0009Ak-EZ for gtp-pandoc-discuss@m.gmane-mx.org; Thu, 12 May 2022 14:54:36 +0200 Original-Received: by mail-lj1-f184.google.com with SMTP id f10-20020a2e9e8a000000b00250925fec6asf1555683ljk.20 for ; Thu, 12 May 2022 05:54:36 -0700 (PDT) ARC-Seal: i=2; a=rsa-sha256; t=1652360076; cv=pass; d=google.com; s=arc-20160816; b=NqJ7Dha2kK8pX8vSKvI7yPMCdkM0mbepNBoe1QbHTpOxI4Bftc/Q+28t3r0/OY49w6 z8+cAnDvqWW6bmWw78A5zR/8Gmbb0J8jyfCptWEDUim/5W3HnHz/afyjG3Ftqkg1PZL1 kRe03N0QgNYBmZSeQmJPEvDDhgfSyFVtaOgt+9eyJTeadsM/iJpMqIPBK9vHFs9mSTQj Q/QIDSh6zGrVKrvBTEXdWmvGDFjjGqAkRKukZ4AJBUEhJEovm2BebEIANzFolqgrYfs5 dIYlRW22AEwKDYzUc3Jm1JRdwvdHHjSyqmStDX1YZXih/WbsRngm5uucoPy+0/5tNjGC HvKA== ARC-Message-Signature: i=2; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=list-unsubscribe:list-subscribe:list-archive:list-help:list-post :list-id:mailing-list:precedence:reply-to:mime-version:message-id :in-reply-to:date:subject:to:from:references:sender:dkim-signature; bh=L5zgaiuZAJk42Q8L4Wf1vgnrk1b7dAVMdAljrT+BHaw=; b=mi3GlZhCFNwxiaaqDTEXXn+z3tl7U7DNm88c1+iUbi+XKTUy5xNAzP3nq3xjYoXcwS mVekhYNF47DlyIQBVYyirhTMsprzYb7pTJbKf2TtoZe/Jim1ACmRWbLLQb3ElQyUGV9a px9Hp9ZjRHaUe+DTEuxhylsyZCOFtKHcSR95eGjHxaO/KT49voMzNCmNG5+kIpF7iAv5 //N9hvN/HnTo82OKSG4IABr4YKbJibmHJa2q7JGyXFJxKTdJlID12KUqnFwlaw4Og81d mq7HDWc3R4DwDv3oEDJh8M3gHS//126+fgzGX6f5GvKMUWlLm31o2OrNWZLCy4LLgbkM a0SQ== ARC-Authentication-Results: i=2; gmr-mx.google.com; spf=pass (google.com: domain of albert+pandoc-9EawChwDxG8hFhg+JK9F0w@public.gmane.org designates 2001:67c:2050:0:465::102 as permitted sender) smtp.mailfrom=albert+pandoc-9EawChwDxG8hFhg+JK9F0w@public.gmane.org DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=googlegroups.com; s=20210112; h=sender:references:from:to:subject:date:in-reply-to:message-id :mime-version:x-original-sender:x-original-authentication-results :reply-to:precedence:mailing-list:list-id:list-post:list-help :list-archive:list-subscribe:list-unsubscribe; bh=L5zgaiuZAJk42Q8L4Wf1vgnrk1b7dAVMdAljrT+BHaw=; b=iPvGLN926fK4EbVhsSozfhblySpwvZqnZFwZ7CE5I7Vgq+QCLeGtsK0NWvOs315Iav ZQjHUHxT8+xd4bJ27k6LusLDRs2XxFfeS2Lrk06fW9caN9aM1dHdf5PcH2IQk6SXPgBk GUzikOIM8+2ABp5qVUsVpvedGxqLhYVONj+38+g3ceH0tIgpJSnbdjUIf+O9SjxcCnRa GY4IdZqmgm2xvnpX1U52DunMiTdInM3MNqwRiceE3sFic7WFSdCGBnk+ijiL1AlDFjYO G3JHHTlCj5Z1LSiZ39lZaUiNMFsgXrooGNtSMM9XACBCt9RSrSWevhEk+Z4XUz6alLPu ix/A== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20210112; h=sender:x-gm-message-state:references:from:to:subject:date :in-reply-to:message-id:mime-version:x-original-sender :x-original-authentication-results:reply-to:precedence:mailing-list :list-id:x-spam-checked-in-group:list-post:list-help:list-archive :list-subscribe:list-unsubscribe; bh=L5zgaiuZAJk42Q8L4Wf1vgnrk1b7dAVMdAljrT+BHaw=; b=RWhjvsn6anZzLBUvAHIm/aZXGI2Gj0m1XkR3a5MPPhk1T0ecbxV6y2q4Rpg4aWUOKY +Mhlk6wJhGioRlvjIOTD6foH2q11KIpad64y1WZtVWVXx6vHOuW7uMqQkDui0OQ+5pLk 5CbXVTHUxhVwFtTXHLoLPXn0rXkN58bDfg/Rz8bcD4W6pP33V1X0YzDKyK6z+DCUyY+D isGCSDl/HQAdXzO7Xjy37WyD2EELQfsSshivhopiTkGswyit/eIWKrs62guw9r1rXV8E SkDF42ibrKrSmvxdh+mYyjBDxn+RMJ72CYDeKC+aTeHG/9XLriN7kaRDUPkLxITGtu/q YDCw== Original-Sender: pandoc-discuss-/JYPxA39Uh5TLH3MbocFFw@public.gmane.org X-Gm-Message-State: AOAM5333qLuOAmdqE6KjWijKMuGQyYQQS/PBboQdmpkyTlaPqeBPSxPE 02FgWjlVcwIFcFKA+0kAz7I= X-Google-Smtp-Source: ABdhPJylPv2Uujk3e4a8/cOaq/T8m86HxIi0tN7cX4t1uq+whMaokxtT7L4E2GeAg0/lyBvG3kA7oA== X-Received: by 2002:a05:6512:400e:b0:450:e09d:c9a6 with SMTP id br14-20020a056512400e00b00450e09dc9a6mr25299540lfb.243.1652360075888; Thu, 12 May 2022 05:54:35 -0700 (PDT) X-BeenThere: pandoc-discuss-/JYPxA39Uh5TLH3MbocFFw@public.gmane.org Original-Received: by 2002:a05:6512:1693:b0:448:3742:2320 with SMTP id bu19-20020a056512169300b0044837422320ls1935467lfb.1.gmail; Thu, 12 May 2022 05:54:30 -0700 (PDT) X-Received: by 2002:a05:6512:3305:b0:471:fbfa:5e5 with SMTP id k5-20020a056512330500b00471fbfa05e5mr24268855lfe.221.1652360070551; Thu, 12 May 2022 05:54:30 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1652360070; cv=none; d=google.com; s=arc-20160816; b=CNYDFkVUemG4n83TqOONXJ2TVajGdO3D68hY3DS3c4IgOrj8PS8cDjPsyPXtIw0E6F rBcVczzdSk33hG9jU4Kx1n8zKbPtgaOxTHXdPhI9ncObw5mAwurhpBEvoF4wgXNp/cxl H3LTh87ENQ1mJFFN83DEQy7QL+X0sIAK0D3vtIdum9OROTt+KRW6zIn2fY6U9usDnWX/ 3zfXst5H8ZiJEnIbJkP2oEeGoI5YU9F0szvFFGs/egvadAVNJcJMOpEZtMUmroYr6lPI WR3GRSFZpOXc824SR9a5d98lXF4o9rcjQksBHoLM6eIPySQeQgNYQ4ThdPli6gtul/g8 xpGQ== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=mime-version:message-id:in-reply-to:date:subject:to:from:references; bh=5+yiQlYj1VKYwQTyAcltmbrna7nqcS5hqeO9ipUfbLk=; b=AMoCveQXreFz4jdKyUrzqKTVPUZrizrT/WcEt/z4k6eGbaoy7NPZkaKJwYkWLdJEO0 UE9YSEFwqAICPWodXlHz1LL8BCGC4tkrXMflO28mBqoyEAFwRf8DBRXoIA5cB6mY+BnT M7SGThGKZ0tRcthxwLX6tgcD7UixSQrTbMIQyLbDPVAzGiy00cfxli6zJ4tjwKISwpU3 R/pbaEdSg6zgq41fHJDKsUzGHDda3J9iMn6que+SWEEdluUcFflBMHcnh62+9eeR8JHc AOMIff0g36Y02TVhr7xQ+xsSXe7X7GUrUVjfGhjqtu0O87PrZyFTdcoGTyAgUitND5rP MblA== ARC-Authentication-Results: i=1; gmr-mx.google.com; spf=pass (google.com: domain of albert+pandoc-9EawChwDxG8hFhg+JK9F0w@public.gmane.org designates 2001:67c:2050:0:465::102 as permitted sender) smtp.mailfrom=albert+pandoc-9EawChwDxG8hFhg+JK9F0w@public.gmane.org Original-Received: from mout-p-102.mailbox.org (mout-p-102.mailbox.org. [2001:67c:2050:0:465::102]) by gmr-mx.google.com with ESMTPS id v8-20020a056512348800b0047238f0bc72si274219lfr.12.2022.05.12.05.54.30 for (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Thu, 12 May 2022 05:54:30 -0700 (PDT) Received-SPF: pass (google.com: domain of albert+pandoc-9EawChwDxG8hFhg+JK9F0w@public.gmane.org designates 2001:67c:2050:0:465::102 as permitted sender) client-ip=2001:67c:2050:0:465::102; Original-Received: from smtp202.mailbox.org (smtp202.mailbox.org [IPv6:2001:67c:2050:b231:465::202]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange ECDHE (P-384) server-signature RSA-PSS (4096 bits) server-digest SHA256) (No client certificate requested) by mout-p-102.mailbox.org (Postfix) with ESMTPS id 4KzWv756yvz9smd for ; Thu, 12 May 2022 14:54:27 +0200 (CEST) In-reply-to: <13cd1f3a-bc26-49cf-a7df-ec8d56fcf05an-/JYPxA39Uh5TLH3MbocFFw@public.gmane.org> X-Rspamd-Queue-Id: 4KzWv756yvz9smd X-Original-Sender: albert+pandoc-9EawChwDxG8hFhg+JK9F0w@public.gmane.org X-Original-Authentication-Results: gmr-mx.google.com; spf=pass (google.com: domain of albert+pandoc-9EawChwDxG8hFhg+JK9F0w@public.gmane.org designates 2001:67c:2050:0:465::102 as permitted sender) smtp.mailfrom=albert+pandoc-9EawChwDxG8hFhg+JK9F0w@public.gmane.org Precedence: list Mailing-list: list pandoc-discuss-/JYPxA39Uh5TLH3MbocFFw@public.gmane.org; contact pandoc-discuss+owners-/JYPxA39Uh5TLH3MbocFFw@public.gmane.org List-ID: X-Google-Group-Id: 1007024079513 List-Post: , List-Help: , List-Archive: , List-Unsubscribe: , Xref: news.gmane.io gmane.text.pandoc:30546 Archived-At: Julien Dutant writes: > As discussed a while ago on > https://github.com/pandoc/lua-filters/issues/207#issuecomment-1067959808 > and said in Pandoc's manual, running Lua filters downloaded from > internet is a security risk as Pandoc is run with full privileges. > > But doesn't all the risk only comes for Lua's `os` module (and perhaps > io?), which few filters actually use? If so, would it be possible for > Pandoc to run Lua filters without this module, providing an alternative > flag (something like --lua-filter-safe) to run a filter safely? I had the intention of building a safe Lua filter system, but have given up on that. There are just too many things that could go wrong. For one, there are just too many potentially risky Lua functions. Basically all functions in the `os` and `io` modules are unsafe, as are `load`, `loadfile`, `dofile`, and `require`. Most functions in `pandoc.system`, and `pandoc.mediabag` are problematic, as are the functions `pandoc.utils.pipe` and `pandoc.utils.run_json_filter`, both of which allow to run arbitrary programs. Even seemingly innocent functions like `pandoc.read` and `pandoc.references` can be used to access the file system and could be used to exfiltrate information. But the main reason for not attempting such a thing is actually that I have security concerns about the basic pandoc-Lua-bridge. I'm not confident enough that we could reliably prevent sandbox escapes; nobody ever did an security audit of HsLua. I *think* there are no obvious exploits, but I still wouldn't want to label something as "safe" unless I'm 100% sure that the description is justified. TL;DR: Implementing `--lua-filter-safe` might be possible, but it would require a lot of work as well as expertise that's different from mine. -- Albert Krewinkel GPG: 8eed e3e2 e8c5 6f18 81fe e836 388d c0b2 1f63 1124