Subject: bug#50946: closed (Re: bug#50946: Emacs-28: Inadequate coding in hack-elisp-shorthands)

From: [email-masked] (GNU bug Tracking System)
Date: Sat, 02 Oct 2021 11:14:02 +0000

Your bug report

#50946: Emacs-28: Inadequate coding in hack-elisp-shorthands

which was filed against the emacs package, has been closed.

The explanation is attached below, along with your original report.
If you require more details, please reply to [email-masked].

-- 
50946: http://debbugs.gnu.org/cgi/bugreport.cgi?bug=50946
GNU Bug Tracking System
Contact [email-masked] with problems

Subject: Re: bug#50946: Emacs-28: Inadequate coding in hack-elisp-shorthands
From: João Távora <[email-masked]>
To: Alan Mackenzie <[email-masked]>
Cc: Eli Zaretskii <[email-masked]>, [email-masked]
Date: Sat, 02 Oct 2021 12:13:14 +0100
List-Id: <debbugs-submit.debbugs.gnu.org>

Alan Mackenzie <[email-masked]> writes:

> Why aren't you just using that function on the buffer anyway, instead of all this
> clumsy messing around with temporary buffers, file-attributes, and
> successive 100 bytes, and so on?

I used it to quickly and efficiently discover the value of
elisp-shorthands as soon as possible, before the 'read' takes place in
load-code-with-conversion.

Doing other wise is possible but it is an intrusive change into the
longstanding load-with-code-conversion, which I avoided during the early
days of this feature.  If you can do it and it doens't break anything,
go ahead.  Stefan is investigating this as well.

> ... even if this scenario is highly unusual.

You think?

João

Subject: Emacs-28: Inadequate coding in hack-elisp-shorthands
From: Alan Mackenzie <[email-masked]>
To: [email-masked]
Date: Fri, 1 Oct 2021 17:10:57 +0000
List-Id: <debbugs-submit.debbugs.gnu.org>

Hello, Emacs.

In emacs -Q in the emacs-28 branch, create the following two line file,
foobar.el, and try to load it:

;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
(defvar foo-baz "foobar-baz")
FOOBARELISP-SHORTHANDS: (("foo" . "foobar")))
;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;

This will throw an error, but that isn't important.

What is important is that the symbol foobar-baz is created by the
elisp-shorthands facility.

This shouldn't happen since:
1/- There is no Local Variables section.
2/- There is no variable elisp-shorthands in that non-existent section.

The following errors are evident in hack-elisp-shorthands:
1/- The code doesn't check for a correctly formatted Local Variables
  section.
2/- The code, even if it did check, would only check the last 3000 bytes
  in the file.  The section can occur anywhere in the last 3000
  CHARACTERS.
3/- The code doesn't do a case-sensitive search for "elisp-shorthands".
4/- The code doesn't check for "elisp-shorthands" being a complete
  symbol.
5/- The code doesn't even check that "elisp-shorthands" is in a comment.

I would suggest that these errors be corrected.  I would also suggest
that the entire code and documentation for this new facility be
carefully reviewed by somebody who isn't the original author.

-- 
Alan Mackenzie (Nuremberg, Germany).