Subject: bug#37656: 27.0.50; Arbitrary code execution with special `mode:'

From: Eli Zaretskii <[email-masked]>
Date: Wed, 16 Oct 2019 22:34:22 +0300

> Cc: Adam Plaice <[email-masked]>, [email-masked],
>  [email-masked]
> From: Phil Sainty <[email-masked]>
> Date: Thu, 17 Oct 2019 08:09:04 +1300
> 
> On 17/10/19 6:09 AM, Eli Zaretskii wrote:
> > I don't think that removing the feature will solve the more
> > general problem in this bug report.
> 
> 
> In particular it seems there is no point in removing the deprecated
> method of calling a minor mode using local variables because, after
> testing, the *approved* method of calling a minor mode via local
> variables causes the same behaviour.  i.e.:
> 
> -*- mode: emacs-lisp; eval:(flymake-mode 1); -*-
> 
> 
> So the deprecated approach isn't actually a factor here.

Right, thanks for confirming.

The question is: can we do something in core to prevent these
problems, or does the solution have to be in the individual minor
modes?