You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
This is rather trivial to implement, and would be very helpful for e.g. LaTeX files.
Security implications: Worst case scenario: echo '*: --on-save adduser -G wheel evil' >.local.wsconf, a world-writable directory could be exploited to gain root access if a sufficiently priviledged user trips over the config file. While this is no problem on single-user machines, I wouldn't want such a ticking time bomb running on my server. Going the ghci / openssl route of only loading config files if their permissions are narrow enough is overly restrictive, and only requiring it for files containing hooks is unfeasible because of the way config files are handled. Putting hooks in extra config files (like .on-save.wsedit) with tight security requirements doesn't allow for hooks to be specified as call parameters, which is orthogonal to how wsedit has been operating thus far and therefore unacceptable. Maybe this can be solved via compile flag?
(A)Synchronous?: Probably we need both approaches, one silent, asynchronous hook and a synchronous one where the output gets displayed somehow and the editor resumes after the hook terminates.
The text was updated successfully, but these errors were encountered:
This is rather trivial to implement, and would be very helpful for e.g. LaTeX files.
Security implications: Worst case scenario:
echo '*: --on-save adduser -G wheel evil' >.local.wsconf
, a world-writable directory could be exploited to gain root access if a sufficiently priviledged user trips over the config file. While this is no problem on single-user machines, I wouldn't want such a ticking time bomb running on my server. Going theghci
/openssl
route of only loading config files if their permissions are narrow enough is overly restrictive, and only requiring it for files containing hooks is unfeasible because of the way config files are handled. Putting hooks in extra config files (like.on-save.wsedit
) with tight security requirements doesn't allow for hooks to be specified as call parameters, which is orthogonal to howwsedit
has been operating thus far and therefore unacceptable. Maybe this can be solved via compile flag?(A)Synchronous?: Probably we need both approaches, one silent, asynchronous hook and a synchronous one where the output gets displayed somehow and the editor resumes after the hook terminates.
The text was updated successfully, but these errors were encountered: