Re: Possible security hole? nnfolder evaluates local variables..

[vroonhof@math.ethz.ch]

> > The problem:
> >   XEmacs evals local variables for nnfolder files
> > 
> > The symptom:
> >   This appeared in the minibuffer
> > 
> > Fetching headers for nnfolder:xemacs-beta...done
> > File local-variables error: (void-function winmgr-mode)
>

> [refering to definition of nnheader-find-file-noselect]
> The `enable-local-variables' (under Emacs, at least) should ensure
> that no variables are evaled.  Is there some other variable under
> XEmacs that controls this?

XEmacs uses the same variable..

> nnfolder uses this to load the folder:> 
> (defun nnheader-find-file-noselect (&rest args)

Ahhh. That is the problem...

Under XEmacs it nnheader-find-file-noselect is shadowed by
nnheader-xemacs-find-file-noselect (from nnheaderxm.el). A large ugly
function that looks like a verbatim copy of find-file-noselect from
the XEmacs files.el. It proably does the enable-local-variables thing
wrong. I am not sure why it calls after-find-file functions at all.

The last reference I can find to it is in the Changelog of Gnus 5.2.39.
where there is a "simplify" entry. I cannot see why it was introduced.

Does anybody know?

-- 
Jan Vroonhof                    http://www.math.ethz.ch/~vroonhof/
Mathematik,                                  vroonhof@math.ethz.ch
HG E16, ETH-Zentrum,                      Tel: +41-1-6325456/25154
Raemistrasse 101, CH-8092 Zuerich.              Fax: +41-1-6321085