🚀 go-pugleaf

In article <3188@charon.cwi.nl> guido@cwi.nl (Guido van Rossum) writes:

   There is a feature of GNU Emacs, enabled by default, which makes a
   very convenient vehicle for Trojan horses.  The facility is described
   in the 'file variables' section of the info tree, and lets you execute
   any Emacs Lisp code when a file is loaded into a buffer.  As a benign
   example, the following code, which I found the end of file written by
   a Scheme application, will format the file, destroy itself, and save
   the file, all when you first open the file:

   [code deleted]

   Given Emacs' capability to start processes, write files, etc., a
   Trojan horse using this feature can obviously be used to do great
   damage to people who have the habit of using Emacs as a file browser.

   Shouldn't this feature be protected in some way, e.g., by asking the
   user permission to execute such code (if it is more than just setting
   a major mode)?

here's something i picked up off of one of the emacs lists a while
back.  it does exactly what you suggest. be sure to set the variable
inhibit-local-variables to 't to enable this feature.

--cut here---
; Modified by cwitty@csli.Stanford.EDU (Carl Witty) on 12/4/88
; to show "Local Variables" section of file on screen before
; asking whether to use them (when inhibit-local-variables set).
;
(defun hack-local-variables (&optional force)
  "Parse, and bind or evaluate as appropriate, any local variables
for current buffer."
  ;; Look for "Local Variables:" line in last page.
  (save-excursion
    (goto-char (point-max))
    (search-backward "\n\^L" (max (- (point-max) 3000) (point-min)) 'move)
    (if (let ((case-fold-search t))
	  (and (search-forward "Local Variables:" nil t)
	       (or (not inhibit-local-variables)
		   force
		   ;; modified by cwitty to show local variables before asking
		   ;; 12/4/88
		   (save-window-excursion
		     (switch-to-buffer (current-buffer) t)
		     (recenter 0)
		     (y-or-n-p (format"Set local variables as specified at end of %s? "
				      (file-name-nondirectory buffer-file-name)))))))
	(let ((continue t)
	      prefix prefixlen suffix beg)
	  ;; The prefix is what comes before "local variables:" in its line.
	  ;; The suffix is what comes after "local variables:" in its line.
	  (skip-chars-forward " \t")
	  (or (eolp)
	      (setq suffix (buffer-substring (point)
					     (progn (end-of-line) (point)))))
	  (goto-char (match-beginning 0))
	  (or (bolp)
	      (setq prefix
		    (buffer-substring (point)
				      (progn (beginning-of-line) (point)))))
	  (if prefix (setq prefixlen (length prefix)
			   prefix (regexp-quote prefix)))
	  (if suffix (setq suffix (regexp-quote suffix)))
	  (while continue
	    ;; Look at next local variable spec.
	    (if selective-display (re-search-forward "[\n\C-m]")
	      (forward-line 1))
	    ;; Skip the prefix, if any.
	    (if prefix
		(if (looking-at prefix)
		    (forward-char prefixlen)
		  (error "Local variables entry is missing the prefix")))
	    ;; Find the variable name; strip whitespace.
	    (skip-chars-forward " \t")
	    (setq beg (point))
	    (skip-chars-forward "^:\n")
	    (if (eolp) (error "Missing colon in local variables entry"))
	    (skip-chars-backward " \t")
	    (let* ((str (buffer-substring beg (point)))
		   (var (read str))
		  val)
	      ;; Setting variable named "end" means end of list.
	      (if (string-equal (downcase str) "end")
		  (setq continue nil)
		;; Otherwise read the variable value.
		(skip-chars-forward "^:")
		(forward-char 1)
		(setq val (read (current-buffer)))
		(skip-chars-backward "\n")
		(skip-chars-forward " \t")
		(or (if suffix (looking-at suffix) (eolp))
		    (error "Local variables entry is terminated incorrectly"))
		;; Set the variable.  "Variables" mode and eval are funny.
		(cond ((eq var 'mode)
		       (funcall (intern (concat (downcase (symbol-name val))
						"-mode"))))
		      ((eq var 'eval)
		       (if (string= (user-login-name) "root")
			   (message "Ignoring `eval:' in file's local variables")
			 (eval val)))
		      (t (make-local-variable var)
			 (set var val))))))))))
--cut here---
--
=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=
Vick Khera, Gradual Student/Systems Guy   Department of Computer Science
ARPA:   khera@cs.duke.edu                 Duke University
UUCP:   ...!mcnc!duke!khera               Durham, NC 27706     (919) 660-6528