From mboxrd@z Thu Jan 1 00:00:00 1970 Path: news.gmane.io!.POSTED.blaine.gmane.org!not-for-mail From: =?UTF-8?Q?Jo=C3=A3o_?= =?UTF-8?Q?T=C3=A1vora?= Newsgroups: gmane.emacs.bugs Subject: bug#48452: 28.0.50; flymake for elisp does not respect `load-path` Date: Sun, 24 Jul 2022 10:57:23 +0100 Message-ID: References: <8735unafob.fsf@gmail.com> <877d4hs084.fsf@gnus.org> <87v8s1untg.fsf@gmail.com> <874jzlp12v.fsf@gnus.org> <87wnchc75r.fsf@gmail.com> <87ilnzaa49.fsf@gnus.org> <87cze7780j.fsf@gmail.com> <87r12mogh9.fsf@gnus.org> <87fsj1tlgn.fsf@gnus.org> <87sfmy1b95.fsf@gmail.com> <87r12d9b8f.fsf@gnus.org> <87k08497in.fsf@gnus.org> <87wnc474xt.fsf@gnus.org> <87y1wkmba4.fsf@gmail.com> <87h737n2ov.fsf@gmail.com> <87v8rmyilo.fsf@gnus.org> Mime-Version: 1.0 Content-Type: multipart/alternative; boundary="0000000000003218f905e48a14d8" Injection-Info: ciao.gmane.io; posting-host="blaine.gmane.org:116.202.254.214"; logging-data="31482"; mail-complaints-to="usenet@ciao.gmane.io" Cc: Max Brieiev , 48452@debbugs.gnu.org, Stefan Monnier To: Lars Ingebrigtsen Original-X-From: bug-gnu-emacs-bounces+geb-bug-gnu-emacs=m.gmane-mx.org@gnu.org Sun Jul 24 11:57:15 2022 Return-path: Envelope-to: geb-bug-gnu-emacs@m.gmane-mx.org Original-Received: from lists.gnu.org ([209.51.188.17]) by ciao.gmane.io with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.92) (envelope-from ) id 1oFYMM-00081G-8G for geb-bug-gnu-emacs@m.gmane-mx.org; Sun, 24 Jul 2022 11:57:14 +0200 Original-Received: from localhost ([::1]:43394 helo=lists1p.gnu.org) by lists.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1oFYMK-0004Rn-GP for geb-bug-gnu-emacs@m.gmane-mx.org; Sun, 24 Jul 2022 05:57:12 -0400 Original-Received: from eggs.gnu.org ([2001:470:142:3::10]:39406) by lists.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1oFYMA-0004Rd-S4 for bug-gnu-emacs@gnu.org; Sun, 24 Jul 2022 05:57:02 -0400 Original-Received: from debbugs.gnu.org ([209.51.188.43]:57157) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_128_GCM_SHA256:128) (Exim 4.90_1) (envelope-from ) id 1oFYMA-0003Ig-Id for bug-gnu-emacs@gnu.org; Sun, 24 Jul 2022 05:57:02 -0400 Original-Received: from Debian-debbugs by debbugs.gnu.org with local (Exim 4.84_2) (envelope-from ) id 1oFYMA-00051v-Ce for bug-gnu-emacs@gnu.org; Sun, 24 Jul 2022 05:57:02 -0400 X-Loop: help-debbugs@gnu.org Resent-From: =?UTF-8?Q?Jo=C3=A3o_?= =?UTF-8?Q?T=C3=A1vora?= Original-Sender: "Debbugs-submit" Resent-CC: bug-gnu-emacs@gnu.org Resent-Date: Sun, 24 Jul 2022 09:57:02 +0000 Resent-Message-ID: Resent-Sender: help-debbugs@gnu.org X-GNU-PR-Message: followup 48452 X-GNU-PR-Package: emacs X-GNU-PR-Keywords: moreinfo Original-Received: via spool by 48452-submit@debbugs.gnu.org id=B48452.165865658819287 (code B ref 48452); Sun, 24 Jul 2022 09:57:02 +0000 Original-Received: (at 48452) by debbugs.gnu.org; 24 Jul 2022 09:56:28 +0000 Original-Received: from localhost ([127.0.0.1]:46906 helo=debbugs.gnu.org) by debbugs.gnu.org with esmtp (Exim 4.84_2) (envelope-from ) id 1oFYLc-000511-5G for submit@debbugs.gnu.org; Sun, 24 Jul 2022 05:56:28 -0400 Original-Received: from mail-ot1-f47.google.com ([209.85.210.47]:36774) by debbugs.gnu.org with esmtp (Exim 4.84_2) (envelope-from ) id 1oFYLY-00050l-L3 for 48452@debbugs.gnu.org; Sun, 24 Jul 2022 05:56:26 -0400 Original-Received: by mail-ot1-f47.google.com with SMTP id a14-20020a0568300b8e00b0061c4e3eb52aso6557013otv.3 for <48452@debbugs.gnu.org>; Sun, 24 Jul 2022 02:56:24 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20210112; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=VF49t6vX+J476Bf+25HkyEuJTCFVWt0tzVkYOA1MCKA=; b=Fy2vVQ7hHBZe65Wlo2oo7OhG6LHQwr2aVOp87Byk3HUpXophRYljchl0DpEko1YKHa KtTMeBtdz/QsGkZ8phyhtIu92UTL2AYrcOqx6IgjJtAorz5SyFrMC93v1DPiC1112nGf jsk1PIjpsrKxvjOaMGEcPd/PHiAvw2c4IDMWuy51QvWPRF0wO3bhW3nV7LLRcT80qCor K/RSaTXeTZPJwTjMGKaam/Xefcm2i01ULWScaTGcg4H7leJsGzixaQoBFGk9h6y8F2Z5 J/J4k6bMqvSGuE3bbe3GXi2K0WmdHcWBoPNQDo2rci6NoYzxTWgfUdxQsL/ED23E/1mi i41g== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20210112; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=VF49t6vX+J476Bf+25HkyEuJTCFVWt0tzVkYOA1MCKA=; b=nfGlb1oGYEG+j3rjF+0ZPkBVGtWFz1Z9KkmFO8UHbygA16CvqNgdZqe7C5RTt7q5jV oo3+EbR1Mo4RcfHqRs8OBDR4+q+YsiP23herzUU3aZ1OF7XDSfudqtIIzH8ELXrFbluG Jwq6vEEawBmLPk7IiM0vMPSmZq1FkfBJ1ywmlEt5ZWv4xw+xM7MnKqvWI8St0q1FZSW1 q7kA+QBxV1024MmeyCNiKIeRMbwVUKDu33NNVHGL41xyNglNQXCjpPZmdMP91rXWd4PW TGSAwEAzNQSkz7W7UOfjCQGF+/0pLyfKk/3Dj7tKWD7VpyI8cCdvOuTlwHExM6bkjGGV HhTA== X-Gm-Message-State: AJIora98sxgIJAYRpNSoaEarNy20jLGRVzocICkZmIXRfNBc7dk3B7G7 BdaIZIqTDw5mAeg9pl7ey1pTpqXUF+2AFScH+Xo= X-Google-Smtp-Source: AGRyM1uPS2ROj8R5dZjhZAZ43fyMreDck8ceYgewyXlfU+6hFo8AsJOdI5pX8BXCSPFv8mnpu145m9yggBy11eWE3PM= X-Received: by 2002:a9d:7691:0:b0:61c:9963:7336 with SMTP id j17-20020a9d7691000000b0061c99637336mr3141513otl.317.1658656578999; Sun, 24 Jul 2022 02:56:18 -0700 (PDT) In-Reply-To: <87v8rmyilo.fsf@gnus.org> X-BeenThere: debbugs-submit@debbugs.gnu.org X-Mailman-Version: 2.1.18 Precedence: list X-BeenThere: bug-gnu-emacs@gnu.org List-Id: "Bug reports for GNU Emacs, the Swiss army knife of text editors" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: bug-gnu-emacs-bounces+geb-bug-gnu-emacs=m.gmane-mx.org@gnu.org Original-Sender: "bug-gnu-emacs" Xref: news.gmane.io gmane.emacs.bugs:237830 Archived-At: --0000000000003218f905e48a14d8 Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: quoted-printable On Sun, Jul 24, 2022 at 10:18 AM Lars Ingebrigtsen wrote: > Jo=C3=A3o T=C3=A1vora writes: > > > Or maybe -- again, I'm just guessing -- the danger is that that bad.el > > is disguised under /tmp/pcase.el and /tmp/good.el has a perfectly > > legitimate. > > > > (require 'pcase) > > > > Simply visitng /tmp/good.el with Flymake on would lead to disaster. > > Yes. Sorry, I thought it was self-evident that that's the problem I was > talking about with having "./" in load-path. > OK. I just hope that this thread has left it clear that simply visiting tha= t /tmp/pcase-not-malicious-at-all.el can lead to "disaster" regardless of the value in elisp-flymake-byte-compile-load-path . > If > > that's the case, it's as easy as applying this patch > > [...] > > > - ,@(mapcan (lambda (path) (list "-L" path)) > > + ,@(mapcan (lambda (path) (list "-L" (format ":%s" > path))) > > elisp-flymake-byte-compile-load-path) > > That would be a distinct improvement; yes. (But with a comment about > what that does, because it's not self explanatory.) > > OK, I can do that. Jo=C3=A3o T=C3=A1vora --0000000000003218f905e48a14d8 Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable
On Sun, Jul 24, 2022 at 10:18 AM Lars Ing= ebrigtsen <larsi@gnus.org> wrot= e:
Jo=C3=A3o T=C3=A1vora <joaotavora@gmail.com> writes:

> Or maybe -- again, I'm just guessing -- the danger is that that ba= d.el
> is disguised under /tmp/pcase.el and /tmp/good.el has a perfectly
> legitimate.
>
>=C2=A0 =C2=A0 (require 'pcase)
>
> Simply visitng /tmp/good.el with Flymake on would lead to disaster.
Yes.=C2=A0 Sorry, I thought it was self-evident that that's the problem= I was
talking about with having "./" in load-path.

OK. I just hope that this thread has left it clear that sim= ply visiting that
/tmp/pcase-not-malicious-at-all.el can lead to &q= uot;disaster" regardless
of the value in elisp-flymake-byte-= compile-load-path .

> If
> that's the case, it's as easy as applying this patch

[...]

> -=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0= ,@(mapcan (lambda (path) (list "-L" path))
> +=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0= ,@(mapcan (lambda (path) (list "-L" (format ":%s" path)= ))
>=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 = =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0elisp-flymake-byte-compile-load-pa= th)

That would be a distinct improvement; yes.=C2=A0 (But with a comment about<= br> what that does, because it's not self explanatory.)

OK, I can do that.

Jo=C3=A3o T=C3=A1vora
--0000000000003218f905e48a14d8--