Subject: bug#41619: [PATCH] Mark python-shell-virtualenv-root as safe local variable

From: Eli Zaretskii <[email-masked]>
Date: Tue, 16 Jun 2020 20:54:06 +0300

> From: "Philip K." <[email-masked]>
> Cc: [email-masked], [email-masked]
> Date: Tue, 16 Jun 2020 19:32:52 +0200
> 
> > So all we need is to remove the :safe attribute from the variable?  Or
> > something else?
> 
> That would make it harder for projects to hide malicious values of
> python-shell-virtualenv-root, but it's still an attack vector in
> principle.

Then I don't think I understand how you suggest to fix this.