GNU bug report logs - #64281
[Feature Request] Recognize “#” syntax when reading local-variables

Previous Next

Full log

View this message in rfc822 format

From: Drew Adams <drew.adams <at> oracle.com>
To: Stefan Monnier <monnier <at> iro.umontreal.ca>, Eli Zaretskii <eliz <at> gnu.org>
Cc: Shynur Xie <one.last.kiss <at> outlook.com>, "64281 <at> debbugs.gnu.org" <64281 <at> debbugs.gnu.org>
Subject: bug#64281: [Feature Request] Recognize “#” syntax
Date: Sun, 25 Jun 2023 16:16:47 +0000

> >> It seems that this is a intentional behavior:
> >> .../File-Local-Variables.html:
> >>
> >> > For additional safety, read-circle is temporarily bound
> >> > to nil when Emacs reads file-local variables.
> >>
> >> No further question; can be closed now.
> >>
> >> (I wonder if we can treat ~/.emacs.d/.dir-locals.el specially, or tell
> >>  Emacs which files can be treated specially -- enable read-circle.)
> >
> > Stefan, any comments before we close this?
> 
> file/dir-local variables are dangerous enough as it is, I think.  If you
> want to do better, you can use an actual ELisp file.

1. That Elisp manual node (`File Local Variables')
doesn't say what danger is avoided by disabling
`read-circle', but it seems to suggest that that
danger is pointed out in node `Read Syntax for
Circular Objects':

  For additional safety, read-circle is temporarily
  bound to nil when Emacs reads file-local variables
  (see Input Functions). This prevents the Lisp reader
  from recognizing circular and shared Lisp structures
  (see Read Syntax for Circular Objects).

Yes, that's what it does, but why?  What's the
"additional safety" about?  What danger's involved?

Node `Read Syntax for Circular Objects' says nothing
about any possible danger (security/safety problem)
circular objects can introduce.  Can we please say
something about the danger in that node?

2. Wouldn't it make sense (be useful) to let users
and code decide whether to allow this for particular
file-local variables?

A question from ignorance - see #1, above.  Is it
helpful to talk about danger and avoiding it,
without giving readers some idea of what's involved?

Previous Next

GNU bug tracking system
Copyright (C) 1999 Darren O. Benham, 1997,2003 nCipher Corporation Ltd, 1994-97 Ian Jackson.