texlua-based tool and restricted shell escape

[Joseph Wright]

On 21/02/2024 00:10, Reinhard Kotucha wrote:
> On 2024-02-20 at 15:16:04 -0700, Karl Berry wrote:
> 
>   > Whether the equivalent of "ls" (what texosquery does) should be an
>   > allowed operation [...]
> 
> Is this Java related?
> 
> In my texlua scripts I can read and write files, list contents of
> directories, etc.  Of course, all limited by the settings of
> openin_any and openout_any.

The question is whether one should be able to access that information 
using restricted shell escape - I hope that it makes sense, and in that 
sense it's independent of the language involved. But the details of the 
security setup do depend on how it's implemented.

Joseph