all messages for Emacs-related lists mirrored at yhetil.org
 help / color / mirror / code / Atom feed
* bug#33264: Whitelist vc-follow-symlinks as a safe file variable
@ 2018-11-05  2:54 Eugene J.
  2019-07-10 13:11 ` Lars Ingebrigtsen
  2022-01-22 15:44 ` Lars Ingebrigtsen
  0 siblings, 2 replies; 8+ messages in thread
From: Eugene J. @ 2018-11-05  2:54 UTC (permalink / raw)
  To: 33264

[-- Attachment #1: Type: text/plain, Size: 246 bytes --]

It is useful to have directory local `vc-follow-symlinks` with value `nil`
when you have to use symlink paths in a particular case while having it
`ask` or `t` as a default.
Marking the variable as  "safe file variable" will reduce the friction.

[-- Attachment #2: Type: text/html, Size: 407 bytes --]

^ permalink raw reply	[flat|nested] 8+ messages in thread

* bug#33264: Whitelist vc-follow-symlinks as a safe file variable
  2018-11-05  2:54 bug#33264: Whitelist vc-follow-symlinks as a safe file variable Eugene J.
@ 2019-07-10 13:11 ` Lars Ingebrigtsen
  2019-07-15 15:29   ` Dmitry Gutov
  2022-01-22 15:44 ` Lars Ingebrigtsen
  1 sibling, 1 reply; 8+ messages in thread
From: Lars Ingebrigtsen @ 2019-07-10 13:11 UTC (permalink / raw)
  To: Eugene J.; +Cc: 33264

"Eugene J." <w3techplayground@gmail.com> writes:

> It is useful to have directory local `vc-follow-symlinks` with value
> `nil` when you have to use symlink paths in a particular case while
> having it `ask` or `t` as a default.  Marking the variable as "safe
> file variable" will reduce the friction.

That seems reasonable.  Does anybody else object to marking this
variable as a safe file variable?

-- 
(domestic pets only, the antidote for overdose, milk.)
   bloggy blog: http://lars.ingebrigtsen.no





^ permalink raw reply	[flat|nested] 8+ messages in thread

* bug#33264: Whitelist vc-follow-symlinks as a safe file variable
  2019-07-10 13:11 ` Lars Ingebrigtsen
@ 2019-07-15 15:29   ` Dmitry Gutov
  2019-07-15 15:50     ` Lars Ingebrigtsen
  0 siblings, 1 reply; 8+ messages in thread
From: Dmitry Gutov @ 2019-07-15 15:29 UTC (permalink / raw)
  To: Lars Ingebrigtsen, Eugene J.; +Cc: 33264

On 10.07.2019 16:11, Lars Ingebrigtsen wrote:
> "Eugene J." <w3techplayground@gmail.com> writes:
> 
>> It is useful to have directory local `vc-follow-symlinks` with value
>> `nil` when you have to use symlink paths in a particular case while
>> having it `ask` or `t` as a default.  Marking the variable as "safe
>> file variable" will reduce the friction.
> 
> That seems reasonable.  Does anybody else object to marking this
> variable as a safe file variable?

Sounds good to me.

I've tried to imagine a security issue stemming from it (e.g. linking to 
an external directory tree with its own dir-locals values, and then... 
what?), but didn't really come up with anything significant.





^ permalink raw reply	[flat|nested] 8+ messages in thread

* bug#33264: Whitelist vc-follow-symlinks as a safe file variable
  2019-07-15 15:29   ` Dmitry Gutov
@ 2019-07-15 15:50     ` Lars Ingebrigtsen
  2019-07-15 16:23       ` Gustavo Barros
  2019-07-15 18:21       ` Dmitry Gutov
  0 siblings, 2 replies; 8+ messages in thread
From: Lars Ingebrigtsen @ 2019-07-15 15:50 UTC (permalink / raw)
  To: Dmitry Gutov; +Cc: Eugene J., 33264

Dmitry Gutov <dgutov@yandex.ru> writes:

> I've tried to imagine a security issue stemming from it (e.g. linking
> to an external directory tree with its own dir-locals values, and
> then... what?), but didn't really come up with anything significant.

The doc string says that a nil is "dangerous", but doesn't say what the
danger is:

---
What to do if visiting a symbolic link to a file under version control.
Editing such a file through the link bypasses the version control system,
which is dangerous and probably not what you want.

If this variable is t, VC follows the link and visits the real file,
telling you about it in the echo area.  If it is ‘ask’, VC asks for
confirmation whether it should follow the link.  If nil, the link is
visited and a warning displayed.
---

I'm guessing it doesn't really mean "dangerous", but instead "not
optimal in most cases".

Anyway, what would the safe-local values be?  nil, t and ask or just
nil?

-- 
(domestic pets only, the antidote for overdose, milk.)
   bloggy blog: http://lars.ingebrigtsen.no





^ permalink raw reply	[flat|nested] 8+ messages in thread

* bug#33264: Whitelist vc-follow-symlinks as a safe file variable
  2019-07-15 15:50     ` Lars Ingebrigtsen
@ 2019-07-15 16:23       ` Gustavo Barros
  2019-07-15 17:34         ` Lars Ingebrigtsen
  2019-07-15 18:21       ` Dmitry Gutov
  1 sibling, 1 reply; 8+ messages in thread
From: Gustavo Barros @ 2019-07-15 16:23 UTC (permalink / raw)
  To: Lars Ingebrigtsen; +Cc: Eugene J., 33264, Dmitry Gutov

Hi all,

On Mon, Jul 15 2019, Lars Ingebrigtsen wrote:

> Dmitry Gutov <dgutov@yandex.ru> writes:
>
>> I've tried to imagine a security issue stemming from it (e.g. linking
>> to an external directory tree with its own dir-locals values, and
>> then... what?), but didn't really come up with anything significant.
>
> The doc string says that a nil is "dangerous", but doesn't say what the
> danger is:
>
> ---
> What to do if visiting a symbolic link to a file under version control.
> Editing such a file through the link bypasses the version control system,
> which is dangerous and probably not what you want.
>
> If this variable is t, VC follows the link and visits the real file,
> telling you about it in the echo area.  If it is ‘ask’, VC asks for
> confirmation whether it should follow the link.  If nil, the link is
> visited and a warning displayed.
> ---
>
> I'm guessing it doesn't really mean "dangerous", but instead "not
> optimal in most cases".


I’ve been following this thread and, if I may chime in, I think a good
reference in this respect is to note that `find-file-visit-truename` is
marked as a safe-local-variable in "files.el".

(Except that, as far as I can tell, it doesn’t work as a local
variable. See https://emacs.stackexchange.com/q/51495/18951. But that is
beyond the point here.)

Best regards,
Gustavo Barros.





^ permalink raw reply	[flat|nested] 8+ messages in thread

* bug#33264: Whitelist vc-follow-symlinks as a safe file variable
  2019-07-15 16:23       ` Gustavo Barros
@ 2019-07-15 17:34         ` Lars Ingebrigtsen
  0 siblings, 0 replies; 8+ messages in thread
From: Lars Ingebrigtsen @ 2019-07-15 17:34 UTC (permalink / raw)
  To: Gustavo Barros; +Cc: Eugene J., 33264, Dmitry Gutov

Gustavo Barros <gusbrs.2016@gmail.com> writes:

> I’ve been following this thread and, if I may chime in, I think a good
> reference in this respect is to note that `find-file-visit-truename` is
> marked as a safe-local-variable in "files.el".

That's a good point.

-- 
(domestic pets only, the antidote for overdose, milk.)
   bloggy blog: http://lars.ingebrigtsen.no





^ permalink raw reply	[flat|nested] 8+ messages in thread

* bug#33264: Whitelist vc-follow-symlinks as a safe file variable
  2019-07-15 15:50     ` Lars Ingebrigtsen
  2019-07-15 16:23       ` Gustavo Barros
@ 2019-07-15 18:21       ` Dmitry Gutov
  1 sibling, 0 replies; 8+ messages in thread
From: Dmitry Gutov @ 2019-07-15 18:21 UTC (permalink / raw)
  To: Lars Ingebrigtsen; +Cc: Eugene J., 33264

On 15.07.2019 18:50, Lars Ingebrigtsen wrote:
> The doc string says that a nil is "dangerous", but doesn't say what the
> danger is

I don't understand the nature of the danger exactly as well, but I think 
the docstring means that the danger occurs when you edit _without_ 
following symlinks. Hence the default value (ask, then follow).





^ permalink raw reply	[flat|nested] 8+ messages in thread

* bug#33264: Whitelist vc-follow-symlinks as a safe file variable
  2018-11-05  2:54 bug#33264: Whitelist vc-follow-symlinks as a safe file variable Eugene J.
  2019-07-10 13:11 ` Lars Ingebrigtsen
@ 2022-01-22 15:44 ` Lars Ingebrigtsen
  1 sibling, 0 replies; 8+ messages in thread
From: Lars Ingebrigtsen @ 2022-01-22 15:44 UTC (permalink / raw)
  To: Eugene J.; +Cc: 33264

"Eugene J." <w3techplayground@gmail.com> writes:

> It is useful to have directory local `vc-follow-symlinks` with value `nil` when you
> have to use symlink paths in a particular case while having it `ask` or `t` as a
> default. 
> Marking the variable as  "safe file variable" will reduce the friction.

I've now marked the nil value as safe in Emacs 29.

-- 
(domestic pets only, the antidote for overdose, milk.)
   bloggy blog: http://lars.ingebrigtsen.no





^ permalink raw reply	[flat|nested] 8+ messages in thread

end of thread, other threads:[~2022-01-22 15:44 UTC | newest]

Thread overview: 8+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2018-11-05  2:54 bug#33264: Whitelist vc-follow-symlinks as a safe file variable Eugene J.
2019-07-10 13:11 ` Lars Ingebrigtsen
2019-07-15 15:29   ` Dmitry Gutov
2019-07-15 15:50     ` Lars Ingebrigtsen
2019-07-15 16:23       ` Gustavo Barros
2019-07-15 17:34         ` Lars Ingebrigtsen
2019-07-15 18:21       ` Dmitry Gutov
2022-01-22 15:44 ` Lars Ingebrigtsen

Code repositories for project(s) associated with this external index

	https://git.savannah.gnu.org/cgit/emacs.git
	https://git.savannah.gnu.org/cgit/emacs/org-mode.git

This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.