On 2020-12-09 at 00:26:19, Felipe Contreras wrote:
> It's not efficient that everyone must set specific configurations in all
> their ~/.vimrc files; we can have a project-wide .vimrc that everyone
> can use.
>
> By default it's ignored, you need the following in your ~/.vimrc
>
> set exrc
> set secure
I would strongly recommend against advising users to use this
configuration. Vim has been known to have repeated security problems
with what options are allowed in restricted environments, and even with
the secure option, it's still easy to do something like this:
func Foo()
!echo >/tmp/foo
endfunction
nmap i :call Foo()<CR>
When the user hits "i" to enter insert mode, they'll execute the
attacker's arbitrary code.
> We could add the vim modelines at the bottom of every file, like other
> projects do, but this seems more sensible.
We have an .editorconfig file[0], which is a cross-editor file that can be
used to specify these settings. It is supported by many editors out of
the box, although Vim requires a plugin. Since we don't want to support
configuration for every editor under the sun, it makes sense to use a
single file for multiple editors and let people configure their editor
accordingly.
Since Vim would require configuration either way and .editorconfig files
don't have any known security issues, the .editorconfig file seems like
a better option.
[0] https://editorconfig.org/
--
brian m. carlson (he/him or they/them)
Houston, Texas, US
Attachment:
signature.asc
Description: PGP signature
