Subject: Re: bug#41619: [PATCH] Mark python-shell-virtualenv-root as safe local variable

From: "Philip K." <[email-masked]>
Date: Tue, 16 Jun 2020 19:32:52 +0200

Eli Zaretskii <[email-masked]> writes:

>> From: "Philip K." <[email-masked]>
>> Cc: [email-masked], [email-masked]
>> Date: Tue, 16 Jun 2020 18:52:07 +0200
>> 
>> Ultimatly, my estimation was wrong, and the variable shouldn't be marked
>> as safe, at least not with any heuristics that could warn the user if
>> the path is suspicious.
>
> So all we need is to remove the :safe attribute from the variable?  Or
> something else?

That would make it harder for projects to hide malicious values of
python-shell-virtualenv-root, but it's still an attack vector in
principle.

-- 
	Philip K.