Re: How is default-directory a safe variable?

Antonio Romano <[email protected]> writes:

> From the documentation of `default-directory' variable:
>
>   This variable is safe as a file local variable if its value
>   satisfies the predicate ‘stringp’.
>
> But how can this be safe? `default-directory' could point to a TRAMP
> malicious host without the user even knowing, as the value in
> .dir-locals would be read without any warning. What's the rationale
> behind this? Asking out of curiosity.

Good question.  Here is some history (I just searched in the
repository):

| 87c60260974 "(default-directory): Mark safe. (basic-save-buffer-2): Put
| proper dir name in error message." (Richard M. Stallman <[email protected]>
| 2007-03-19)
| 
| 0c8e847f895 "Don't mark default-directory as a safe local var." (Chong
| Yidong <[email protected]> 2007-03-25)
| 
| 4b025f47582 "Revert 2007-03-25 change." (Chong Yidong
| <[email protected]> 2007-04-13)

It looks like there were doubts but it was necessary to keep it declared
as safe.  And it looks like that was for `compilation-start' to be able
to do its job.

Hmm...


Michael.