Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

make 'magit-todos-exclude-globs' a safe local variable #94

Open
wsw0108 opened this issue Jan 15, 2020 · 6 comments
Open

make 'magit-todos-exclude-globs' a safe local variable #94

wsw0108 opened this issue Jan 15, 2020 · 6 comments
Assignees
Labels
enhancement New feature or request
Milestone

Comments

@wsw0108
Copy link

wsw0108 commented Jan 15, 2020

otherwise, it will always ask whether to apply this local variable

@wsw0108
Copy link
Author

wsw0108 commented Jan 15, 2020

I can make this variable as safe local variable in my init.el.
But I think it should be better to do this in this library.

@alphapapa
Copy link
Owner

That seems like a good idea. Are there any other variables that should also be marked as safe?

@wsw0108
Copy link
Author

wsw0108 commented Jan 16, 2020

No other variables needed for me.

@alphapapa alphapapa added the enhancement New feature or request label Jan 28, 2020
@wsw0108 wsw0108 closed this as completed Mar 16, 2020
@alphapapa
Copy link
Owner

Why did you close this issue?

@alphapapa alphapapa reopened this Mar 16, 2020
@alphapapa alphapapa added this to the 1.6 milestone Nov 1, 2020
@alphapapa alphapapa self-assigned this Nov 1, 2020
@alphapapa alphapapa modified the milestones: 1.6, 1.7 Mar 7, 2023
@alphapapa
Copy link
Owner

Since this option is passed to other programs, it should be considered carefully, so deferring until v1.7.

@alphapapa
Copy link
Owner

I'd like to do this, but I'm still not sure if it's a good idea. Since we call commands with lists of arguments (rather than as a shell command string), it seems like it ought to be safe, but to be sure we'd need to carefully look at each command that is called, how the arguments are built using the values in this variable, and consider whether there's any way that the arguments could be manipulated into something nefarious.

As an analogy, see this discussion about marking a similar variable as safe in Emacs; Eli is being very cautious about it, and we should be as cautious, IMO.

So I'm targeting this at a later version. In the meantime, users can press ! to mark sets of values as safe in their configuration so as to not be prompted anymore, like other variables.

@alphapapa alphapapa modified the milestones: 1.7, 1.8 Aug 26, 2023
@alphapapa alphapapa modified the milestones: 1.8, Future Sep 9, 2024
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
enhancement New feature or request
Projects
None yet
Development

No branches or pull requests

2 participants