help-fns unsolicited elisp loading (was Re: bug#28048: 26.0.50; behaviour of C-h f semantic-mode)

[Mark Oteiza <mvoteiza@udel.edu>]

On 12/08/17 at 01:47am, npostavs@users.sourceforge.net wrote:
> Mark Oteiza <mvoteiza@udel.edu> writes:
> 
> > Is there a bug associated with the new C-h f behaviour?
> 
> No, it was introduced on emacs-devel, see [1] and followups.
> 
> [1]: http://lists.gnu.org/archive/html/emacs-devel/2016-05/msg00441.html

Now I know why I'd get seemingly random messages about MH-E not being
present on my system.

https://git.savannah.gnu.org/cgit/emacs.git/commit/?id=fd8084aaf9

Why are we loading (effectively) arbitrary elisp without the user asking
for it?  Any elisp in Emacs--including installed 3rdp packages--can get
loaded when looking for function or variable help.  Further, loading
elisp can do anything, so a PoC is trivial.  Not even considering the
security part of it, I'm going to end up with way more stuff loaded,
potentially having more crap to sift through in apropos.  Please at the
very least disable this by default before it goes into a release.

For the record, the following init.el shim restores the previous
behavior:

(with-eval-after-load "help-fns"
  (defun my-obarray (string pred action)
    (complete-with-action action obarray string pred))
  (fset 'help--symbol-completion-table 'my-obarray))