Rga: Ripgrep, but also search in PDFs, E-Books, Office documents, zip, etc.

mbrubeck wrote: post #6

seanthemon wrote: post #4

Earlier quoted context omitted.

Seems this project predates ugrep and has a nicer interface.

Both projects were started around the same time in 2019. The initial git commits were about five weeks apart: https://github.com/Genivia/ugrep/commit/e37c986dd842adc3b2c2... https://github.com/phiresky/ripgrep-all/commit/16b4277d361ce...

Wow! That's interesting.

Re: Rga: Ripgrep, but also search in PDFs, E-Books, Office documents, zip, etc.

#9

Post by rectang » Tue, Sep 17, 2024, 6:12 PM UTC

To what extent does reading these formats accurately require the execution of code within the documents? In other words, not just stuff like zip expansion by a library dependency of rga, but for example macros inside office documents or JavaScript inside PDFs.

Note: I have no reason to believe such code execution is actually happening — so please don't take this as FUD. My assumption is that a secure design would involve running only external code and thus would sacrifice a small amount of accuracy, possibly negligible.

Re: Rga: Ripgrep, but also search in PDFs, E-Books, Office documents, zip, etc.

#10

Post by fwip » Tue, Sep 17, 2024, 6:38 PM UTC

rectang wrote: post #9

To what extent does reading these formats accurately require the execution of code within the documents ? In other words, not just stuff like zip expansion by a library dependency of rga, but for example macros inside office documents or JavaScript inside PDFs. Note: I have no reason to believe such code execution is actually happening — so please don't take this as FUD. My assumption is that a secure design would in…

Also note that it's not necessarily safe to read these documents even if you don't intend on executing embedded code. For example, reading from pdfs uses poppler, which has had a few CVEs that could result in arbitrary code execution, mostly around image decoding. https://cve.mitre.org/cgi-bin/cvekey.cgi?keyword=poppler

(No shade to poppler intended, just the first tool on the list I looked at.)