Jonathon,

You might have had more responses if you had posted to 
https://tex.stackechange.com

Peter W.


On 24/08/18 18:10, Jonathan Fine wrote:
> Hi Joseph
>
> Thank you for your email on l3sys-shell. You wrote:
>
>     There are two broad questions we have. First, how do people feel
>     about these concepts? We can see that there may be some security
>     concerns, hence not adding directly to the expl3 core. However, as
>     one has to be running with unrestricted shell escape anyway, we
>     are not sure if providing macro wrappers makes these worse: 
>
>
> I'm not a security expert. Are you, Joseph? In any case, I've asked 
> your question on stack exchange, and put a code review comment on 
> github. Here's the URLs
>
>   * https://security.stackexchange.com/questions/192249/concerns-about-latex-3-shell-escape-code
>   * https://github.com/latex3/latex3/commit/7b62e64dde239f9cb6ae0f08400c0b5ccde815d8#diff-09def3f98d60fce78fbcc00e77c65795R3093
>
> I hope you'll get a useful response from a security expert.
>
> best regards
>
> Jonathan