(Feature request) Point out that libqalculate is (by default) insecure for remote use

[markozajc]

libqalculate will by default (with unfiltered input) allow RCE if the calculations are performed on a remote server. Without first consulting the function list, one might easily miss the rather dangerous command() function, and a few other less dangerous capabilities (leaking system information with the uptime variable, inserting custom messages with message(), warn(), and error(), changing state with save(), potentially others?). It might be worth pointing such capabilities out somewhere clear to prevent unintended system exposure.

[imkunet]

Is there any proper, supported method to disabling the unsafe functions?

[markozajc]

Here's what I do: qalculate-helper.git/tree/qalculate-helper.cpp This prevents the functions from being called directly, but it potentially cause a sigsegv if the function is called by something else (eg. variable := value will call save() internally for example, causing a sigsegv), but I at least don't think that's the ever case with command() and uptime(). save() and function() themselves should be fine as long as you don't reuse the same Calculator object, otherwise global constants and functions can be overwritten.

[hanna-kn]

Is there any proper, supported method to disabling the unsafe functions?

If feasible, recompile libqalculate with --without-gnuplot-call configure option to disable command() and plot(), or comment out relevant lines in the code, in functions loadBuiltinVariables() and loadBuiltinFunctions() in libqalculate/Calculator.cc line 1499.

variable := value will call save() internally for example, causing a sigsegv

I will fix this.