REST API to interact with fish_config

[gretel]

i like the universal scope in fish and do use it quite often. i thought about a way to change the value of a variable from the outside of fish. then i stumbled upon https://github.com/typicode/json-server - while serving a different purpose i like it's simplicity. what'd be wonderful for me to have is using curl to interact with a little API reflecting set. i'd be glad if you'd share your thoughts. regards 💾

[zanchey]

The fish_config server has some glue code which converts between HTTP requests and universal variables, so you could use that for inspiration.

I'm not sure shipping something like this turned on in fish by default is a good idea. In particular, it is possible to execute arbitrary code from universal variables, so some consideration should be given to securing the interface. (See #1438 for how this caused problems in the past.)

[gretel]

@zanchey thanks for pointing that out, i didn't connect the existing code in regards to http to my idea. of course, i should have added

• should not be enabled by default
• have some sort of authentication in place
• bind to localhost only even if enabled

[zanchey]

The existing Python doesn't fully follow the REST model, but it does marshall between universal variables and JSON, so if you wanted to convert the API that might be the way to go - then at least you have one known consumer in the codebase. I'm not sure how AngularJS goes with the full REST experience, so that might be something to get worked out before altering the server side.

[krader1961]

I am closing this issue since there is no compelling use case and the security implications are significant.