Re: (forw) Re: [GoLugTech] Fw: [PLUG] vim and neovim bug

Rick Moen writes:
> Quoting Steve Litt ([email protected]):
> 
> > Yes. I use them quite a bit, especially to set folding=1. I spoze I can
> > live without them.
> 
> Or make a vim macro that can be run efficiently by the user to set
> folding=1.  Modelines are hardly the only way to do frequently needed
> operations in vi.  They're inherently a security target because of their
> nature as an implicit autorun macro.

I use them too, mostly for things like indentation levels and
styles/modes. As far as I know they're the only way to set
indentation levels and styles automatically for a file, so you
don't have to type a bunch of customization every time you edit
a given file. Why they also allow shell expressions is anybody's
guess; that's certainly not something I'd ever need or want.
And it's been a known attack surface for years, this just being the
latest version. For an earlier iteration, the solution was "set secure"
and I had the impression that was disabling ! in modelines, but
apparently not.

I just updated Debian testing and got vim 8.1.1365, which has the
fix. But really, I'd like to disable ! entirely in modelines.
I gather that in 8.1.1366 I'll be able to set nomodelineexpr, but
Debian doesn't have that version yet and vim whines about an unknown
variable, so I've added this, which I hope will do the trick:

if v:version >= 8.1.1366
  set nomodelineexpr
endif

        ...Akkana