Standalone conversions

[avidseeker]

Pandoc is getting too big of a program.

Have there been any thoughts or discussions to separate Pandoc into separate standalone conversion programs. For example, users who are only interested in markdown <--> latex conversions would only have to install md2tex, instead of downloading the whole conversion package.

[jgm]

How, practically, does its bigness affect you?

[avidseeker]

It's easy to list the advantages of Unix philosophy. But for me the main concern is security. There has been multiple vulnerabilities in parsers in the past. The fewer they are, the smaller the attack surface.

Shipping tons of converters (md2tex, doc2md, etc) could be asking for too much. But maybe having compile options like the existing embed-data-files could be a good start.

[jgm]

You'd only benefit from such a change, from the point of view of security, if you're currently letting untrusted users run pandoc on your machine with arbitrary options. Don't do that. You can set things up already so that pandoc is only ever called with a specific reader and writer. And for security I'd recommend using pandoc in server mode or with --sandbox.

[avidseeker]

Untrusted content is also a big threat.

Consider my setup where I read lecture slides and notes only after converting them from MS office formats to pdf (i.e: Pandoc is the only way for me to preview such binary files). If there is a vulnerability in the parser to .pptx for example, then I assume it should be possible to craft a malicious file acting as a powerpoint file exploiting the vulnerability in that specific parser.

[alerque]

Breaking up the binary into separate programs for every pair of input2output formats wouldn't change your attack surface area in this case. If you are using the PPTX reader and worried about it it won't help you that the binary doesn't happen to have other readers built in or not. You're already able to control what reader is being used, not your untrusted content creator.