[texworks] Script: Questions about the API

[Stefan Löffler]

Hi,

Am 2010-04-13 15:49, schrieb T T:
> On 13 April 2010 07:06, Stefan Löffler <st.loeffler at gmail.com> wrote:
>   
>> If you can write arbitrary data to arbitrary positions on the
>> disk, this can be pretty serious security vulnerability.
>>     
> Why?  The extension script will not get more permissions than the
> program (process) in which it runs and I see no reason why it should
> have less permissions.  After all, extension scripts are logically a
> part of an application and not a part of a document as in case of,
> say, html and browsers.
>   

You imply a (working) system of permissions. As Paul pointed out, this
is not necessarily guaranteed all the time (in particular Windows users
tend to abuse some functions). Now of course you can argue that that's
their own fault, but since Tw is targeting all audiences, in particular
people who are not PC pros, I am a bit reluctant to provide additional
functions that can potentially cause a lot of chaos.
That said, we don't limit any of the functions of the respective
scripting languages. So if you use Python, for example, it's very easy
to gain file access. I don't know enough about the other scripting
languages to properly assess the situation for them. I can only
speculate that QtScript, being based on a similar basis as JavaScript,
doesn't naturally come with file access functions.

Besides, providing general purpose file access functions wouldn't be as
easy as it sounds. We could of course provide a QFile object wrapper,
but I think that most methods in there are not exposed to scripting. So
we'd end up with the need to write our own classes for that, which I
think is more effort than it's worth at the moment (seeing that there
are alternatives).

Cheers,
Stefan