-
Notifications
You must be signed in to change notification settings - Fork 48
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
make 'magit-todos-exclude-globs' a safe local variable #94
Comments
I can make this variable as safe local variable in my init.el. |
That seems like a good idea. Are there any other variables that should also be marked as safe? |
No other variables needed for me. |
Why did you close this issue? |
Since this option is passed to other programs, it should be considered carefully, so deferring until v1.7. |
I'd like to do this, but I'm still not sure if it's a good idea. Since we call commands with lists of arguments (rather than as a shell command string), it seems like it ought to be safe, but to be sure we'd need to carefully look at each command that is called, how the arguments are built using the values in this variable, and consider whether there's any way that the arguments could be manipulated into something nefarious. As an analogy, see this discussion about marking a similar variable as safe in Emacs; Eli is being very cautious about it, and we should be as cautious, IMO. So I'm targeting this at a later version. In the meantime, users can press |
otherwise, it will always ask whether to apply this local variable
The text was updated successfully, but these errors were encountered: