Hi! Not saying we need to remove this but wondering about your take on it. Currently depends on :0 which is an old (the oldest) dev-lang/spidermonkey slot and doesn't seem to be any sign of that changing upstream. Use of old SM isn't always a security issue because it depends on how input is sourced, but it seems like there might be an attack vector here. Debian actually disable the JS functionality entirely (although we could just force usage of Rhino instead?): https://sources.debian.org/patches/plowshare/2.1.7-4/01-disable-javascript.patch/ "Plowshare uses rhino CLI or similar to execute javascript downloaded from the Internet. Since this is not filtered or sandboxed at all, the javascript can obtain arbitrary access to the system and so this patch disables it by default." What do you think? Drop it? Force Rhino? Leave it as-is?
I do not use it a lot anymore, but modules are still updated: https://github.com/mcrapet/plowshare-modules-legacy/commits/master Given JS is needed in quite a few of them and it only runs on a short list of sites, I'd be tempted to leave JS support in. As for spidermonkey, now that it is not needed anymore for polkit, depending on old version does not sound worth it. tl;dr I think I would revbump to force rhino, what do you think?
The bug has been closed via the following commit(s): https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=dffe3a0550df3c4b017d69a8dfc275cb6c33f252 commit dffe3a0550df3c4b017d69a8dfc275cb6c33f252 Author: Bernard Cafarelli <voyageur@gentoo.org> AuthorDate: 2022-03-14 20:58:09 +0000 Commit: Bernard Cafarelli <voyageur@gentoo.org> CommitDate: 2022-03-14 20:58:53 +0000 net-misc/plowshare: only keep rhino for USE=javascript Disable USE-flag by default Closes: https://bugs.gentoo.org/834829 Signed-off-by: Bernard Cafarelli <voyageur@gentoo.org> .../{plowshare-2.1.7-r1.ebuild => plowshare-2.1.7-r2.ebuild} | 8 ++++---- net-misc/plowshare/plowshare-9999.ebuild | 8 ++++---- 2 files changed, 8 insertions(+), 8 deletions(-)
(In reply to Bernard Cafarelli from comment #1) > I do not use it a lot anymore, but modules are still updated: > https://github.com/mcrapet/plowshare-modules-legacy/commits/master > > Given JS is needed in quite a few of them and it only runs on a short list > of sites, I'd be tempted to leave JS support in. > > As for spidermonkey, now that it is not needed anymore for polkit, depending > on old version does not sound worth it. > > tl;dr I think I would revbump to force rhino, what do you think? I'm sorry I missed your comment! But agreed with what you ended up doing :)
