GNU bug report logs - #27066
25.1; dired unsafe variables

Previous Next

Full log

View this message in rfc822 format

From: Francesco Potortì <pot <at> gnu.org>
To: Eli Zaretskii <eliz <at> gnu.org>
Cc: 27066 <at> debbugs.gnu.org
Subject: bug#27066: 25.1; dired unsafe variables
Date: Thu, 25 May 2017 18:58:11 +0200

>> Date: Thu, 25 May 2017 17:54:50 +0200
>> From: Francesco Potortì <pot <at> gnu.org>
>> Cc: 27066 <at> debbugs.gnu.org
>> 
>> >I'm not sure why this is deemed a bug: you have a .dir-locals.el file
>> >in that directory, which specifies directory-local variables.  What
>> >exactly is the problem with the prompt?
>> 
>> I have not created that file myself (downloaded the source code from
>> Github), and before reading your answer I did not know about the
>> existence of .dir-locals.el files which get loaded automatically. I
>> can't find the "dir-local" string anywhere either in the Emacs or Elisp
>> manuals.
>
>How did you search?  Typing "i directory-local RET" lands me on the
>right place, as does "C-s dir-local" followed by C-s enough times.

Hm.  It turns out that Debian, for some reason, did not update my dir
info file after installing emacs25 side-by-side with emacs22, so I was
reading emacs22 docs.  Sorry for the inaccurate info.

>> Moreover the warning message does not mention .dir-locals.el
>> anywhere. 
>> 
>> So first, there is a documentation problem about the .dir-locals.el
>> files.
>
>Please suggest how to improve the existing docs.

The warning message should not say that risky variables are present in the
directory: that makes sense only if you know where to look.  When
reading that message, I thought about some bug somewhere.

The warning message should name the file where the offending variables
were found, instead.

>> Second, probably dired should prompt *before* ever loading that file and
>> parse it only if the user agrees.  Am I too conservative?
>
>I think you are too conservative.  We treat directory-local variables
>like we treat file-local variables: as soon as you visit the
>file/directory, the variables are interpreted.
>
>Perhaps we should offer an option to ask the question you mentioned,
>but I think in general it will annoy too much.

I don't know.  It's a relatively recent innovation, and I bet very few
users have ever stumbled into it.  In my opinion, dired should warn the
user and ask for permission to go on whenever it wants to read a
.dir-locals.el file.  Probably a customisation variable could avoid this
prompt.  And maybe in the future the current behaviour could become the
default, but not now.

Previous Next

GNU bug tracking system
Copyright (C) 1999 Darren O. Benham, 1997,2003 nCipher Corporation Ltd, 1994-97 Ian Jackson.