~ushin/ushin#178: 
Safely load Org remote resources

Opening a file like hyper://aaj45d88g4eenu76rpmwzjiabsof1w8u6fufq6oogyhjk1ubygxy/needs-list.org

which contains

#+SETUPFILE: ./setup.org

displays the warning

Unable to read file "/tmp/setup.org"
Status
REPORTED
Submitter
~ushin
Assigned to
No-one
Submitted
11 months ago
Updated
4 months ago
Labels
0.7.0 hyperdrive.el

~ushin 10 months ago

See #188

~ushin 10 months ago*

IIUC org-file-contents is already capable of downloading hyperdrive file contents so long as the hyperdrive ("resource") is marked as safe. Can we refactor/extend org--confirm-resource-safe to handle hyper:// links/domains?

~alphapapa 9 months ago*

  1. [ ] Cause the setupfile to be read from the hyperdrive the Org file is loaded from.
  2. [ ] Ensure that it's done so according to security settings.
    • org-safe-remote-resources was added in Org 9.6, so we may need to depend on it going forward. (And if we do that, we might want to skip to the recently released 9.7.)

~alphapapa 9 months ago*

Decided: We're going to require Org 9.7.3.

Item 2 above appears to be working already, but we should reverify after doing item 1.

Item 1 can probably be safely deferred until v0.5, when we add support for magic file name handlers.

~ushin 9 months ago

See #168 for magic file name handlers / TRAMP support.

~ushin 9 months ago*

We could add a defcustom (off by default) which would add/remove "^hyper://PUBLIC-KEY" to org-safe-remote-resources when the drive is marked as safe/not unsafe.

~ushin referenced this from #188 9 months ago

~ushin 9 months ago

There's WIP on wip/org-setupfile-directives-links branch.

Register here or Log in to comment, or comment via email.