-
Notifications
You must be signed in to change notification settings - Fork 3
Description
This is rather trivial to implement, and would be very helpful for e.g. LaTeX files.
Security implications: Worst case scenario: echo '*: --on-save adduser -G wheel evil' >.local.wsconf
, a world-writable directory could be exploited to gain root access if a sufficiently priviledged user trips over the config file. While this is no problem on single-user machines, I wouldn't want such a ticking time bomb running on my server. Going the ghci
/ openssl
route of only loading config files if their permissions are narrow enough is overly restrictive, and only requiring it for files containing hooks is unfeasible because of the way config files are handled. Putting hooks in extra config files (like .on-save.wsedit
) with tight security requirements doesn't allow for hooks to be specified as call parameters, which is orthogonal to how wsedit
has been operating thus far and therefore unacceptable. Maybe this can be solved via compile flag?
(A)Synchronous?: Probably we need both approaches, one silent, asynchronous hook and a synchronous one where the output gets displayed somehow and the editor resumes after the hook terminates.