From mboxrd@z Thu Jan 1 00:00:00 1970 Path: news.gmane.io!.POSTED.blaine.gmane.org!not-for-mail From: Yuri D'Elia Newsgroups: gmane.emacs.devel Subject: Re: Allowing symlinked dir-locals files? Date: Sat, 18 Sep 2021 16:10:47 +0200 Message-ID: <87pmt6dleg.fsf@wavexx.thregr.org> References: <8735r91d73.fsf@wavexx.thregr.org> <83o89x6yyn.fsf@gnu.org> <874kbpkzdy.fsf@igel.home> Mime-Version: 1.0 Content-Type: text/plain Injection-Info: ciao.gmane.io; posting-host="blaine.gmane.org:116.202.254.214"; logging-data="17255"; mail-complaints-to="usenet@ciao.gmane.io" User-Agent: Gnus/5.13 (Gnus v5.13) Emacs/28.0.50 (gnu/linux) To: emacs-devel@gnu.org Cancel-Lock: sha1:lxxtupW4KABu2R9tUg5KNS21Hyw= Original-X-From: emacs-devel-bounces+ged-emacs-devel=m.gmane-mx.org@gnu.org Sat Sep 18 16:12:41 2021 Return-path: Envelope-to: ged-emacs-devel@m.gmane-mx.org Original-Received: from lists.gnu.org ([209.51.188.17]) by ciao.gmane.io with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.92) (envelope-from ) id 1mRb57-0004M3-6A for ged-emacs-devel@m.gmane-mx.org; Sat, 18 Sep 2021 16:12:41 +0200 Original-Received: from localhost ([::1]:59000 helo=lists1p.gnu.org) by lists.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1mRb55-00043y-KA for ged-emacs-devel@m.gmane-mx.org; Sat, 18 Sep 2021 10:12:39 -0400 Original-Received: from eggs.gnu.org ([2001:470:142:3::10]:50528) by lists.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1mRb3P-0003M7-5O for emacs-devel@gnu.org; Sat, 18 Sep 2021 10:10:55 -0400 Original-Received: from ciao.gmane.io ([116.202.254.214]:33364) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1mRb3N-00086r-Dd for emacs-devel@gnu.org; Sat, 18 Sep 2021 10:10:54 -0400 Original-Received: from list by ciao.gmane.io with local (Exim 4.92) (envelope-from ) id 1mRb3L-0002Fz-Ss for emacs-devel@gnu.org; Sat, 18 Sep 2021 16:10:51 +0200 X-Injected-Via-Gmane: http://gmane.org/ Received-SPF: pass client-ip=116.202.254.214; envelope-from=ged-emacs-devel@m.gmane-mx.org; helo=ciao.gmane.io X-Spam_score_int: -15 X-Spam_score: -1.6 X-Spam_bar: - X-Spam_report: (-1.6 / 5.0 requ) BAYES_00=-1.9, HEADER_FROM_DIFFERENT_DOMAINS=0.25, SPF_HELO_NONE=0.001, SPF_PASS=-0.001 autolearn=no autolearn_force=no X-Spam_action: no action X-BeenThere: emacs-devel@gnu.org X-Mailman-Version: 2.1.23 Precedence: list List-Id: "Emacs development discussions." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: emacs-devel-bounces+ged-emacs-devel=m.gmane-mx.org@gnu.org Original-Sender: "Emacs-devel" Xref: news.gmane.io gmane.emacs.devel:274995 Archived-At: On Mon, Aug 16 2021, Andreas Schwab wrote: >>> Looking at the current files.el:4330, we explicitly check if the file is >>> a regular file. > > Why is that a problem? If the symlink points to a regular file, it is > still a file-regular-p. > >> Yes. It could also be a symlink injected by malevolent hackers. > > Is that different from a regular file injected by malevolent hackers? I was giving more thought to this. I don't think there's any difference. Assuming we're reading a versioned .dir-locals.el file, there's no way to distinguish between a benevolent (local) file and the versioned file. We still need to obey safe-local-variable-values just like any other file, and AFAIK we have no concept of "trusted paths" for dir-locals where resolution could be ambiguous.