rst2epub2 icon indicating copy to clipboard operation
rst2epub2 copied to clipboard

Add hook for adding local extensions

Open msdemlei opened this issue 7 years ago • 3 comments

This patch lets rst2epub execute a local_extensions.py module that is in the current directory.

The idea is that people can add RST extension through that mechanism. The downside is that if someone gets a victim to check out a repo (or untar a zip) and tells them to run rst2epub on it, the victims might not be aware that they've given the attackers the right to execute arbitrary code on their machine. I consider this a bit far-fetched, but perhaps we should still add a flag ("--execute-localext") and only read local_extensions.py if that flag is given?

msdemlei avatar Sep 23 '18 09:09 msdemlei

This PR got rotten a bit, and it seems to me that the easiest way how to help is to attach this rebased patch.

mcepl avatar Jan 17 '19 00:01 mcepl

Actually, looking into it, it is a bit unfortunate, this patch still uses imp library, which has been deprecated instead of the supported importlib.

mcepl avatar Jan 17 '19 00:01 mcepl

Sorry for the long silence – for some reason I wasn't watching this.

I've updated the patch, which should now apply to current master (sorry for force-pushing). As to using imp -- well, the trouble with python2 importlib is that it's really not expressive enough for what we want to do here: Pull a module from a well-defined place.

python2 is deprecated as a whole, so I'd not worry about another use of imp. If you do, I could add an implementation based on python3 importlib in a comment – but then again, once rst2epub is ported to python3, I'll be happy to update the code.

msdemlei avatar Aug 09 '20 15:08 msdemlei