Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Rga: Ripgrep, but also search in PDFs, E-Books, Office documents, zip, etc.

github.com

Post reply on HN
Print view View original

11–20 of 59 posts

Re: Rga: Ripgrep, but also search in PDFs, E-Books, Office documents, zip, etc.

#11

Post by rectang »

fwip wrote: post #10
rectang wrote: post #9

To what extent does reading these formats accurately require the execution of code within the documents ? In other words, not just stuff like zip expansion by a library dependency of rga, but for example macros inside office documents or JavaScript inside PDFs. Note: I have no reason to believe such code execution is actually happening — so please don't take this as FUD. My assumption is that a secure design would in…

Also note that it's not necessarily safe to read these documents even if you don't intend on executing embedded code. For example, reading from pdfs uses poppler, which has had a few CVEs that could result in arbitrary code execution, mostly around image decoding. https://cve.mitre.org/cgi-bin/cvekey.cgi?keyword=poppler (No shade to poppler intended, just the first tool on the list I looked at.)

That's a qualitatively different kind of security topic, though. On the one hand, we have a bug in a tool that reads a passive format with complete accuracy. On the other we have the need to sacrifice some amount of accuracy to avoid executing embedded code in a dynamic file format.

Re: Rga: Ripgrep, but also search in PDFs, E-Books, Office documents, zip, etc.

#12

Post by anthk »

Use Recoll for that; check the recommended dependencies from your package manager. Synaptic it's good for this with a click from the right mouse button on the package.

EDIT: For instance, under Trisquel/Ubuntu/Debian and derivatives, click on 'recollcmd', and with the right click button mark all the dependencies.

Install RecollGUI for a nice UI.

Now you will have something like Google Search but libre in your own desktop.

Re: Rga: Ripgrep, but also search in PDFs, E-Books, Office documents, zip, etc.

#14

Post by sim7c00 »

fwip wrote: post #10
rectang wrote: post #9

To what extent does reading these formats accurately require the execution of code within the documents ? In other words, not just stuff like zip expansion by a library dependency of rga, but for example macros inside office documents or JavaScript inside PDFs. Note: I have no reason to believe such code execution is actually happening — so please don't take this as FUD. My assumption is that a secure design would in…

Also note that it's not necessarily safe to read these documents even if you don't intend on executing embedded code. For example, reading from pdfs uses poppler, which has had a few CVEs that could result in arbitrary code execution, mostly around image decoding. https://cve.mitre.org/cgi-bin/cvekey.cgi?keyword=poppler (No shade to poppler intended, just the first tool on the list I looked at.)

this is why i do like to try and parse shit myself for my own tools, not that thats without risk but i dont share my.code so its untargeted. however, to support a wide variety like this the tools are ok. most code honestly in a pdf will not target pdftotext , i think. i think it would target the thing people open pdfs with like browsers and maybe a few readers like adobe and foxit reader. pdftotext seems more like an 'academic target', like a nice exersize but not very fruitful in an actual attack. i might be wrong tho.

Re: Rga: Ripgrep, but also search in PDFs, E-Books, Office documents, zip, etc.

#17

Post by sadboi31 »

sim7c00 wrote: post #14
fwip wrote: post #10

Earlier quoted context omitted.

Also note that it's not necessarily safe to read these documents even if you don't intend on executing embedded code. For example, reading from pdfs uses poppler, which has had a few CVEs that could result in arbitrary code execution, mostly around image decoding. https://cve.mitre.org/cgi-bin/cvekey.cgi?keyword=poppler (No shade to poppler intended, just the first tool on the list I looked at.)

this is why i do like to try and parse shit myself for my own tools, not that thats without risk but i dont share my.code so its untargeted. however, to support a wide variety like this the tools are ok. most code honestly in a pdf will not target pdftotext , i think. i think it would target the thing people open pdfs with like browsers and maybe a few readers like adobe and foxit reader. pdftotext seems more like an…

Citation indexes are the devil and Google is hell. Try as you might to avoid it but you're already on an index. Security through obscurity isn't secure or obscure in this modern age. https://www.tandfonline.com/doi/full/10.1080/03054985.2024.2...

Re: Rga: Ripgrep, but also search in PDFs, E-Books, Office documents, zip, etc.

#18

Post by traverseda »

rectang wrote: post #9

To what extent does reading these formats accurately require the execution of code within the documents ? In other words, not just stuff like zip expansion by a library dependency of rga, but for example macros inside office documents or JavaScript inside PDFs. Note: I have no reason to believe such code execution is actually happening — so please don't take this as FUD. My assumption is that a secure design would in…

None of them really execute "code". Pandoc has a pretty good write up of the security implications or running it, which I think applies just as much to the other ones, with the added caveat of zip bombs.

https://pandoc.org/MANUAL.html#a-note-on-security

It's just text, this isn't ripgrepping through your excel macros, just the data that's actually in the excel file.

Re: Rga: Ripgrep, but also search in PDFs, E-Books, Office documents, zip, etc.

#20

Post by gjadi »

anthk wrote: post #12

Use Recoll for that; check the recommended dependencies from your package manager. Synaptic it's good for this with a click from the right mouse button on the package. EDIT: For instance, under Trisquel/Ubuntu/Debian and derivatives, click on 'recollcmd', and with the right click button mark all the dependencies. Install RecollGUI for a nice UI. Now you will have something like Google Search but libre in your own des…

For emacs users in the room, there is consult-recoll.
Post reply on HN