]> git.eshelyaron.com Git - emacs.git/commit
elisp-mode.el: Disable Flymake byte-compile backend in untrusted files
authorStefan Monnier <monnier@iro.umontreal.ca>
Tue, 10 Dec 2024 21:26:31 +0000 (16:26 -0500)
committerEshel Yaron <me@eshelyaron.com>
Mon, 23 Dec 2024 14:57:24 +0000 (15:57 +0100)
commitbff0b37742b3a8250acd422fd2b768ee701e7329
treed4209e3a42a29c92c1f5a06b333b27ce178e139e
parent4fb30ea955b0ef9e84f628896e08e32154e33919
elisp-mode.el: Disable Flymake byte-compile backend in untrusted files

To address serious security issues (CVE-2024-53920), disable
`elisp-flymake-byte-compile` except in those files explicitly
specified as "trusted".

For that introduce a new custom var `trusted-files` and new
function `trusted-content-p`.

While at it, similarly skip the implicit macroexpansion done during
completion if the current file is not trusted.

* lisp/files.el (trusted-files): New variable.
(trusted-content-p): New function.

* lisp/progmodes/elisp-mode.el (elisp--safe-macroexpand-all):
New function, extracted from `elisp--local-variables`.
Use `trusted-content-p`.
(elisp--local-variables): Use it.
(elisp-flymake-byte-compile): Disable according to `trusted-content-p`.

(cherry picked from commit b5158bd191422e46273c4d9412f2bf097e2da2e0)
lisp/files.el
lisp/progmodes/elisp-mode.el