Re: [Emacs-diffs] /srv/bzr/emacs/trunk r111747: * doc-view.el (doc-view-odf->pdf-converter-soffice): Use separate

[Tassilo Horn]

Andreas Schwab <address@hidden> writes:

Hi!

>>> +                      ;; A workaround is to start soffice with a
>>> +                      ;; separate UserInstallation directory.
>>> +                      (concat "-env:UserInstallation=file://"
>>> + (expand-file-name (format "libreoffice-docview%d" (user-uid))
>>> +                                                temporary-file-directory))
>>
>> I'm pretty sure there's some kind of race condition here that lets an
>> attacker on the same machine make you write files you didn't intend.
>> Also what if you have two doc-view buffers showing different ODF documents?
>> Will one soffice process cause the other to return immediately as well?

Yes, right.  Shortly after the change you cited, I've handled the latter
problem.  I tested that it works by marking several MS Office/ODF files
in dired and opening them all at once using F (from dired-x).  It works
flawlessly.

--8<---------------cut here---------------start------------->8---
(defun doc-view-odf->pdf-converter-soffice (odf callback)
  "Convert ODF to PDF asynchronously and call CALLBACK when finished.
The converted PDF is put into the current cache directory, and it
is named like ODF with the extension turned to pdf."
  ;; FIXME: soffice doesn't work when there's another running
  ;; LibreOffice instance, in which case it returns success without
  ;; actually doing anything.  See LibreOffice bug
  ;; https://bugs.freedesktop.org/show_bug.cgi?id=37531.  A workaround
  ;; is to start soffice with a separate UserInstallation directory.
  (let ((tmp-user-install-dir (make-temp-file "libreoffice-docview" t)))
    (doc-view-start-process "odf->pdf" doc-view-odf->pdf-converter-program
                            (list
                             (concat "-env:UserInstallation=file://"
                                     tmp-user-install-dir)
                             "--headless" "--convert-to" "pdf"
                             "--outdir" (doc-view-current-cache-dir) odf)
                            (lambda ()
                              (delete-directory tmp-user-install-dir t)
                              (funcall callback)))))
--8<---------------cut here---------------end--------------->8---

> It should be put in a directory like server.el and doc-view.el do.
> server-ensure-safe-dir and doc-view-make-safe-dir should probably be
> factored out into a generic function.

Is there still a problem with this?  LibreOffice doesn't write any
sensitive data into that temporary directory, and as you can see, it's
immediately deleted after the ODF->PDF conversion.

Bye,
Tassilo