mailing-list for TeXmacs Users

[Giovanni Piredda <address@hidden>]

Thanks for the links. I will report when I am done (or ask for help if 
there are obstacles which I cannot overcome).

The other packages I published do not load arbitrary files so they 
should be safe (I will check again though).


G.

On 24.03.20 15:45, Massimiliano Gubinelli wrote:
> You should give a look at:
>
> https://www.gnu.org/software/guile/docs/docs-1.8/guile-ref/Creating-Guile-Modules.html#Creating-Guile-Modules
>
> in particular at #:pure keyword
>
> maybe is enough to create a module where you import only 'safe' 
> symbols and the pass this module to eval
>
> https://www.gnu.org/software/guile/docs/docs-1.8/guile-ref/Fly-Evaluation.html#Fly-Evaluation
>
> you will have to read the file by yourself since it seems that 'load' 
> do not take the module as input.
>
> good luck!
>
> max
>
>
> > On 24. Mar 2020, at 15:35, Giovanni Piredda <address@hidden 
> > <mailto:address@hidden>> wrote:
> >
> > By the way the same holds for the package csvTable which I wrote time 
> > ago; I have commented out the loading of the format there too (so 
> > that package is broken too at the moment), will fix both.
> >
> >
> > G.
> >
> > On 24.03.20 15:24, Giovanni Piredda wrote:
> > > Hi Max,
> > >
> > > thanks for the hint, I did not realize that it is possible to filter 
> > > the commands one allows through load. I will work on it, take down 
> > > the dangerous command for the time being (it means that the program 
> > > presently won't work but it is fine) and if I need some help will 
> > > write again.
> > >
> > >
> > > Giovanni
> > >
> > > On 24.03.20 15:20, Massimiliano Gubinelli wrote:
> > > > Dear Giovanni,
> > > >   is quite dangereous (as you observe in the readme) to allow 
> > > > arbitrary scritps to execute. One should make available to the 
> > > > executing script only the commands needed to create a picture (and 
> > > > maybe mathematical/string pure functions). This is possible since 
> > > > load take (if I remember correctly) as argument an 'environment' or 
> > > > 'module' with the available bindings. This would make execution safe.
> > > >
> > > > That is a nice exercise in scheme/guile for you. :)
> > > >
> > > > max
> > > >
> > > >
> > > > > On 24. Mar 2020, at 15:11, Giovanni Piredda <address@hidden 
> > > > > <mailto:address@hidden>> wrote:
> > > > >
> > > > >
> > > > > On 24.03.20 14:18, Giovanni Piredda wrote:
> > > > > > There is an error - I think at loading - which does not stop the 
> > > > > > package from working; I would appreciate help to fix it. The error is
> > > > > >
> > > > > > <unnamed port>: In procedure struct-vtable in expression 
> > > > > > (struct-vtable obj):
> > > > > > <unnamed port>: Wrong type argument in position 1 (expecting 
> > > > > > struct): #<procedure insertGraphics (graphicsFile)>
> > > > > > <unnamed port>: In procedure struct-vtable in expression 
> > > > > > (struct-vtable obj):
> > > > > > <unnamed port>: Wrong type argument in position 1 (expecting 
> > > > > > struct): #<procedure insertGraphics (graphicsFile)>
> > > > > >
> > > > > > (the repetition is in the output)
> > > > > >
> > > > > > Giovanni
> > > > > I found the reason, the path argument of the use-module statement 
> > > > > was wrong, will upload the correction presently in the GitHub 
> > > > > repository.
> > > > >
> > > > >
> > > > > G.