Re: state of the art in pandoc CLI wrappers?

[Albert Krewinkel <albert+pandoc-9EawChwDxG8hFhg+JK9F0w@public.gmane.org>]

Joseph Reagle <joseph.2011-T1oY19WcHSwdnm+yROfE0A@public.gmane.org> writes:

> Does Quarto allow you to specify filters or csl files in the document
> itself? For example, I like to use the pantable filter in some
> documents but not all -- it's too slow for that.

See <https://quarto.org/docs/authoring/filters.html>
CSL can be set via metadata, no wrapper needed for that.

> I would worry about a document compromised on a webhost and then
> synced locally compromising my local machine, so I appreciate pandoc's
> constraint against running arbitrary filters from the document's
> metadata.

Pandoc follows the design principle that, if an attacker can control a
document but not the command that's being run, then the worst they
should be able to do is cause pandoc to hang. On the other hand, tools
like Quarto or Jupyter Notebooks treat documents as programs; the
assumption that anything can happen is already built-in. That's why
running arbitrary filters is not a problem under their thread model.

-- 
Albert Krewinkel
GPG: 8eed e3e2 e8c5 6f18 81fe  e836 388d c0b2 1f63 1124