Re: How is default-directory a safe variable?

Il 10 luglio 2026 15:33:00 CEST, packrat386 <[email protected]> ha scritto:
>"Antonio Romano" <[email protected]> writes:
>
>> From the documentation of `default-directory' variable:
>>
>>   This variable is safe as a file local variable if its value
>>   satisfies the predicate ‘stringp’.
>>
>> But how can this be safe? `default-directory' could point to a TRAMP
>> malicious host without the user even knowing, as the value in
>> .dir-locals would be read without any warning. What's the rationale
>> behind this? Asking out of curiosity.
>
>I don't think "safe" is meant here in the security sense of the word. If
>it satisfies stringp then it is set and is a directory of some sort, so
>you can safely treat it like a directory name. But just checking that it
>is a string is not sufficient to know whether it's a good idea to write
>there.
>

Fact is, it shouldn't be considered safe at all. The safety predicate is used for variables set in .dir-locals or in the buffer header/footer. A bad actor could set a TRAMP path as default directory and make the user interact in a foreign environment without him knowing in a timely manner