[vim/vim] syntax highlighter: gpg.conf: Drop dangerous use-embedded-filename (PR #13961)
dkg
The syntax highlighter is likely to encourage people to use the listed commands.
but use-embedded-filename is a dangerous option that can cause GnuPG to write arbitrary data to arbitrary files whenever GnuPG encounters malicious data.
GnuPG upstream explicitly warns against using this option:
I recommend that vim not encourage users to place this option in their gpg.conf by highlighting it as a valid option.
I've also asked GnuPG upstream to explicitly deprecate the option due to its hazardous nature:
You can view, comment on, or merge this pull request online at:
https://github.com/vim/vim/pull/13961
Commit Summary
- d7f5fb4 syntax highlighter: gpg.conf: Drop dangerous use-embedded-filename
File Changes
(1 file)
- M runtime/syntax/gpg.vim (4)
Patch Links:
—
Reply to this email directly, view it on GitHub.
You are receiving this because you are subscribed to this thread.
dkearns
Would it be better to highlight it as an error?
—
Reply to this email directly, view it on GitHub.
You are receiving this because you are subscribed to this thread.
Christian Brabandt
But error is clearly wrong, as it is still supported. Not sure if we use Warning highlighting in syntax scripts.
—
Reply to this email directly, view it on GitHub.
You are receiving this because you are subscribed to this thread.
dkearns
For better or worse, Error is the commonly used group for deprecated features but there's some use of WarningMsg in more recent additions. javascript.vim uses Exception, which seems like quite the stretch.
@dpkg, this syntax file needs a maintainer if you're willing and able.
—
Reply to this email directly, view it on GitHub.
You are receiving this because you are subscribed to this thread.
Ajit-Thakkar
Fortran.vim uses Todo highlighting for obsolescent features.
—
Reply to this email directly, view it on GitHub.
You are receiving this because you are subscribed to this thread.
Christian Brabandt
—
Reply to this email directly, view it on GitHub.
You are receiving this because you are subscribed to this thread.
Christian Brabandt
I marked it with WarningMsg for now, since it looks like this option isn't going away from gpg according to the referenced tickets.
—
Reply to this email directly, view it on GitHub.
You are receiving this because you are subscribed to this thread.
dkg
@dkg, this syntax file needs a maintainer if you're willing and able.
I'm not a vim user, let alone comfortable enough with vim to be a maintainer, but thanks for the offer. I'm just trying to clean up dangerous corners of the ecosystem.
—
Reply to this email directly, view it on GitHub.
You are receiving this because you are subscribed to this thread.
dkearns
I see, well thank you for your thankless efforts.
—
Reply to this email directly, view it on GitHub.
You are receiving this because you are subscribed to this thread.