Bug 834829 – net-misc/plowshare: disable javascript? (depends on old dev-lang/spidermonkey slot)

• Product: Gentoo Linux
• Status: RESOLVED FIXED

[Description Sam James 2022-03-09 12:32:40 UTC]

Hi!

Not saying we need to remove this but wondering about your take on it.

Currently depends on :0 which is an old (the oldest) dev-lang/spidermonkey slot and doesn't seem to be any sign of that changing upstream. Use of old SM isn't always a security issue because it depends on how input is sourced, but it seems like there might be an attack vector here.

Debian actually disable the JS functionality entirely (although we could just force usage of Rhino instead?): https://sources.debian.org/patches/plowshare/2.1.7-4/01-disable-javascript.patch/

"Plowshare uses rhino CLI or similar to execute javascript downloaded from the
Internet. Since this is not filtered or sandboxed at all, the javascript can  obtain arbitrary access to the system and so this patch disables it by default."

What do you think? Drop it? Force Rhino? Leave it as-is?

[Comment 1 Bernard Cafarelli 2022-03-10 16:53:43 UTC]

I do not use it a lot anymore, but modules are still updated:
https://github.com/mcrapet/plowshare-modules-legacy/commits/master

Given JS is needed in quite a few of them and it only runs on a short list of sites, I'd be tempted to leave JS support in.

As for spidermonkey, now that it is not needed anymore for polkit, depending on old version does not sound worth it.

tl;dr I think I would revbump to force rhino, what do you think?

[Comment 2 Larry the Git Cow 2022-03-14 20:58:55 UTC]

The bug has been closed via the following commit(s):

https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=dffe3a0550df3c4b017d69a8dfc275cb6c33f252

commit dffe3a0550df3c4b017d69a8dfc275cb6c33f252
Author:     Bernard Cafarelli <[e-mail]>
AuthorDate: 2022-03-14 20:58:09 +0000
Commit:     Bernard Cafarelli <[e-mail]>
CommitDate: 2022-03-14 20:58:53 +0000

    net-misc/plowshare: only keep rhino for USE=javascript
    
    Disable USE-flag by default
    
    Closes: https://bugs.gentoo.org/834829
    Signed-off-by: Bernard Cafarelli <[e-mail]>

 .../{plowshare-2.1.7-r1.ebuild => plowshare-2.1.7-r2.ebuild}      | 8 ++++----
 net-misc/plowshare/plowshare-9999.ebuild                          | 8 ++++----
 2 files changed, 8 insertions(+), 8 deletions(-)

[Comment 3 Sam James 2022-03-23 03:52:06 UTC]

(In reply to Bernard Cafarelli from comment #1)
> I do not use it a lot anymore, but modules are still updated:
> https://github.com/mcrapet/plowshare-modules-legacy/commits/master
> 
> Given JS is needed in quite a few of them and it only runs on a short list
> of sites, I'd be tempted to leave JS support in.
> 
> As for spidermonkey, now that it is not needed anymore for polkit, depending
> on old version does not sound worth it.
> 
> tl;dr I think I would revbump to force rhino, what do you think?

I'm sorry I missed your comment! But agreed with what you ended up doing :)