bug#48452: 28.0.50; flymake for elisp does not respect `load-path`

["João Távora" <joaotavora@gmail.com>]

Lars Ingebrigtsen <larsi@gnus.org> writes:

> João Távora <joaotavora@gmail.com> writes:

> Speaking of which, I was surprised that flymake adds "./" to the load
> path -- we never use that in real Emacsen exactly because of security
> considerations (we don't want to pick up stray files when working under
> /tmp/, for instance).

Right.  Adding anything to the load path is "dangerous".  The default
"./" is a good compromise, as it enables developing packages with
multiple .el files that require each other in the same dir, which is a
very common thing IME.

>> Anyway, because the directories under ~/.emacs.d/elpa are somewhat special
>> and/or security-vetted it _could_ make sense to add them to the default
>> value of the variable. This would amount to more or less the same as 
>> calling the underlying process with `-f package-initialize` I think.
>>
>> But I'm still not sure this should be the default, or merely an option to 
>> the flymake-elisp-byte-compile backend.  I think the second is safer.
>
> An option here would be nice, yes.

Here's a very minimally tested patch:

diff --git a/lisp/progmodes/elisp-mode.el b/lisp/progmodes/elisp-mode.el
index 0c4a9bfdbe..7e1141acf1 100644
--- a/lisp/progmodes/elisp-mode.el
+++ b/lisp/progmodes/elisp-mode.el
@@ -2119,6 +2119,11 @@ elisp-flymake-byte-compile-load-path
                                   (dolist (path x t) (unless (stringp path)
                                                        (throw 'tag nil)))))))
 
+(defcustom elisp-flymake-byte-compile-use-elpa-dirs nil
+  "If non-nil, add ELPA package dirs to elisp Flymake load path."
+  :type 'boolean
+  :group 'lisp)
+
 ;;;###autoload
 (defun elisp-flymake-byte-compile (report-fn &rest _args)
   "A Flymake backend for elisp byte compilation.
@@ -2146,6 +2151,8 @@ elisp-flymake-byte-compile
                    ;; "--eval" "(setq load-prefer-newer t)" ; for testing
                    ,@(mapcan (lambda (path) (list "-L" path))
                              elisp-flymake-byte-compile-load-path)
+                   ,@(when elisp-flymake-byte-compile-use-elpa-dirs
+                       `("-f" "package-initialize"))
                    "-f" "elisp-flymake--batch-compile-for-flymake"
                    ,temp-file)
         :connection-type 'pipe