🚀 go-pugleaf

RetroBBS NetNews Server

Inspired by RockSolid Light RIP Retro Guy

Article View: gnu.emacs.bug
Article #99647

Re: Possible security problem -- File variables & `eval'

#99647
From: Carl Witty
Date: Fri, 22 Jun 1990 02:04
90 lines
4346 bytes
In article <1990Jun21.230710.8614@iwarp.intel.com> merlyn@iwarp.intel.com (Randal Schwartz) writes:
   You can start by
	   (setq inhibit-local-variables t)
   in your .emacs.  But, yes, I've wanted more of a "check this puppy
   out" intermediate solution, as you suggest.

Here's what I use.  This modification of hack-local-variables will put
the "Local Variables" section on the screen and ask you whether to
evaluate them.

;; Modified by cwitty@csli.Stanford.EDU (Carl Witty) on 12/4/88
;; to show "Local Variables" section of file on screen before
;; asking whether to use them (when inhibit-local-variables set).

(defun hack-local-variables (&optional force)
  "Parse, and bind or evaluate as appropriate, any local variables
for current buffer."
  ;; Look for "Local variables:" line in last page.
  (save-excursion
    (goto-char (point-max))
    (search-backward "\n\^L" (max (- (point-max) 3000) (point-min)) 'move)
    (if (let ((case-fold-search t))
	  (and (search-forward "Local Variables:" nil t)
	       (or (not inhibit-local-variables)
		   force
		   ;; modified by cwitty to show local variables before asking
		   ;; 12/4/88
		   (save-window-excursion
		     (switch-to-buffer (current-buffer) t)
		     (recenter 0)
		     (y-or-n-p (format"Set local variables as specified at end of %s? "
				      (file-name-nondirectory buffer-file-name)))))))
	(let ((continue t)
	      prefix prefixlen suffix beg)
	  ;; The prefix is what comes before "local variables:" in its line.
	  ;; The suffix is what comes after "local variables:" in its line.
	  (skip-chars-forward " \t")
	  (or (eolp)
	      (setq suffix (buffer-substring (point)
					     (progn (end-of-line) (point)))))
	  (goto-char (match-beginning 0))
	  (or (bolp)
	      (setq prefix
		    (buffer-substring (point)
				      (progn (beginning-of-line) (point)))))
	  (if prefix (setq prefixlen (length prefix)
			   prefix (regexp-quote prefix)))
	  (if suffix (setq suffix (regexp-quote suffix)))
	  (while continue
	    ;; Look at next local variable spec.
	    (if selective-display (re-search-forward "[\n\C-m]")
	      (forward-line 1))
	    ;; Skip the prefix, if any.
	    (if prefix
		(if (looking-at prefix)
		    (forward-char prefixlen)
		  (error "Local variables entry is missing the prefix")))
	    ;; Find the variable name; strip whitespace.
	    (skip-chars-forward " \t")
	    (setq beg (point))
	    (skip-chars-forward "^:\n")
	    (if (eolp) (error "Missing colon in local variables entry"))
	    (skip-chars-backward " \t")
	    (let* ((str (buffer-substring beg (point)))
		   (var (read str))
		  val)
	      ;; Setting variable named "end" means end of list.
	      (if (string-equal (downcase str) "end")
		  (setq continue nil)
		;; Otherwise read the variable value.
		(skip-chars-forward "^:")
		(forward-char 1)
		(setq val (read (current-buffer)))
		(skip-chars-backward "\n")
		(skip-chars-forward " \t")
		(or (if suffix (looking-at suffix) (eolp))
		    (error "Local variables entry is terminated incorrectly"))
		;; Set the variable.  "Variables" mode and eval are funny.
		(cond ((eq var 'mode)
		       (funcall (intern (concat (downcase (symbol-name val))
						"-mode"))))
		      ((eq var 'eval)
		       (if (string= (user-login-name) "root")
			   (message "Ignoring `eval:' in file's local variables")
			 (eval val)))
		      (t (make-local-variable var)
			 (set var val))))))))))

Carl Witty
cwitty@cs.stanford.edu
Technical Details
Message-ID: <14190@csli.Stanford.EDU>
Path: arc1-ca.pugleaf.net!gmdzi!unido!mcsun!uunet!aplcen!uakari.primate.wisc.edu!zaphod.mps.ohio-state.edu!rpi!bu.edu!shelby!csli!cwitty
References: <9006211721.AA04340@noname> <1990Jun21.230710.8614@iwarp.intel.com>

Show Full Headers
Complete Article Headers
X-Google-Language: ENGLISH,ASCII-7-bit
X-Google-Thread: fb2f1,3a0d70cd65e07cb9,start
X-Google-Attributes: gidfb2f1,public
X-Google-ArrivalTime: 1990-06-22 01:39:37 PST
Path: arc1-ca.pugleaf.net!gmdzi!unido!mcsun!uunet!aplcen!uakari.primate.wisc.edu!zaphod.mps.ohio-state.edu!rpi!bu.edu!shelby!csli!cwitty
From: cwitty@csli.Stanford.EDU (Carl Witty)
Newsgroups: gnu.emacs.bug
Subject: Re: Possible security problem -- File variables & `eval'
Message-ID: <14190@csli.Stanford.EDU>
Date: 22 Jun 90 02:04:45 GMT
References: <9006211721.AA04340@noname> <1990Jun21.230710.8614@iwarp.intel.com>
Sender: cwitty@csli.Stanford.EDU (Carl Witty)
Distribution: gnu
Organization: CSLI, Stanford University
Lines: 90
Posted: Fri Jun 22 03:04:45 1990
In-reply-to: merlyn@iwarp.intel.com's message of 21 Jun 90 23:07:10 GMT