Subject: bug#79373: [PATCH] Mark EWW buffers as untrusted

From: Steven Allen <[email-masked]>
Date: Tue, 02 Sep 2025 14:02:37 -0700

Tags: patch

This patch marks EWW buffers as untrusted. This helps protect users if they:

1. Open a file via EWW.
2. Switch to a different major mode for better highlighting/rendering.

I often do this myself when viewing org, markdown, emacs lisp,
etc. files with EWW.

In GNU Emacs 31.0.50 (build 1, x86_64-pc-linux-gnu, cairo version
 1.18.4) of 2025-09-01 built on Laptop
Repository revision: 102dab0280dc14b5eb180ee13ee3b771bdce973c
Repository branch: makepkg
Windowing system distributor 'The X.Org Foundation', version 11.0.12101018
System Description: Arch Linux

Configured using:
 'configure
 'CPPFLAGS=-I/run/user/1000/build/emacs-git/src/mps-git/build/include '
 'LDFLAGS=-L/run/user/1000/build/emacs-git/src/mps-git/build/lib -Wl,-O1
 -Wl,--sort-common -Wl,--as-needed -Wl,-z,relro -Wl,-z,now
 -Wl,-z,pack-relative-relocs -flto=auto' --prefix=/usr --sysconfdir=/etc
 --libexecdir=/usr/lib --localstatedir=/var --mandir=/usr/share/man
 --with-gameuser=:games --with-modules --without-m17n-flt
 --without-selinux --without-pop --without-gconf --disable-gc-mark-trace
 --with-mps=yes --enable-autodepend --enable-link-time-optimization
 --with-native-compilation=yes --with-xinput2 --with-x-toolkit=no
 --without-toolkit-scroll-bars --without-xaw3d --without-gsettings
 --with-cairo-xcb --without-xft --with-sound=no --with-tree-sitter
 --without-gpm --without-compress-install
 '--program-transform-name=s/\([ec]tags\)/\1.emacs/'
 'CFLAGS=-march=native -mtune=native -O3 -pipe -fno-plt -fexceptions
 -Wp,-D_FORTIFY_SOURCE=3 -Wformat -Werror=format-security
 -fstack-clash-protection -fcf-protection -fomit-frame-pointer
 -fno-math-errno -fno-trapping-math -Os -fno-math-errno
 -fno-trapping-math -Os -flto=auto''

>From ef423545a94b5ba1651f7a477fa205c13905973c Mon Sep 17 00:00:00 2001
From: Steven Allen <[email-masked]>
Date: Tue, 2 Sep 2025 13:56:46 -0700
Subject: [PATCH] Mark EWW buffers as untrusted

EWW itself doesn't care about this flag but it protects users in case
they open a file via EWW then switch to a different
mode (`untrusted-content' is permanently local).

* lisp/net/eww.el (eww-mode): Mark EWW buffers as untrusted.
---
 lisp/net/eww.el | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/lisp/net/eww.el b/lisp/net/eww.el
index 6f06302cb3f..cc67db08460 100644
--- a/lisp/net/eww.el
+++ b/lisp/net/eww.el
@@ -1482,6 +1482,9 @@ eww-mode
               outline-level 'shr-outline-level)
   (add-hook 'post-command-hook #'eww-check-text-conversion nil t)
   (setq buffer-read-only t)
+  ;; Mark this buffer as untrusted in case the user switches to another
+  ;; mode (e.g., `emacs-lisp-mode') where this flag matters.
+  (setq untrusted-content t)
   ;; Insertion at the first character of a field should inherit the
   ;; field's face, form and field, not the previous character's.
   (setq text-property-default-nonsticky '((face . t) (eww-form . t)
-- 
2.51.0