Security #9

New issue

Open

opened 2021-08-18 11:54:18 +00:00 by chaoslama · 0 comments

chaoslama commented

2021-08-18 11:54:18 +00:00

Owner

Since we execute pandoc directly on the machine this is running on, we should have some security-considerations:

Inclusion of files (images, the lua-file-inclusion) would allow to include system files. E.g. including ~/.ssh/key might expose private keys on the server. Thus we should cage the pandoc-files into the given directory (somehow).
We should make sure, no random code-execution is possible. Since we allow executing LaTeX (in header-files, as well as in the input files) we should check there's no downside here.

Since we execute pandoc directly on the machine this is running on, we should have some security-considerations: - Inclusion of files (images, the lua-file-inclusion) would allow to include system files. E.g. including `~/.ssh/key` might expose private keys on the server. Thus we should cage the pandoc-files into the given directory (somehow). - We should make sure, no random code-execution is possible. Since we allow executing LaTeX (in header-files, as well as in the input files) we should check there's no downside here.