약 18 년 전에 친구로부터 .emacs 파일을 물려 받았습니다. 이 enable-local-variables기능 의 보안에 대한 다음과 같은 불길한 코멘트 경고가 중간에 묻혀 있습니다.
;; Date: Wed, 7 Dec 1994 11:57:50 -0600
;; From: blob@syl.dl.nec.com (David Blob)
;; Subject: Self-extracting emacs elisp code
;;
;; With all this talk about self extracting mail "viruses", a friend
;; showed me that in emacs (which I use to read mail, along with vm)
;; has the ability to self-extract elisp code. This feature seems to
;; be turned on by default, and it not only applies to mail read with
;; emacs, but rather every file visited (when the feature is on, of
;; course).
;;
;; The way it works is by having a line which reads "Local Variables:"
;; followed by the lisp variables you would like to set...well, it may
;; seem petty, but you can execute programs, make connections and much
;; more through cleverly written elisp code contained within.
;;
;; It's simple to turn off, at any rate...
;;
;; (setq enable-local-variables f) ;; turns off feature (in emacs 19)
;; (setq enable-local-variables 1) ;; makes it ask first (in emacs 19)
;; (setq inhibit-local-variables t) ;; turns off feature (in emacs 18)
;;
;; Anyhow, I think the risks here speak for themselves...
;;
(setq enable-local-variables '())
따라서 실제로 local-variables유용한 기능인 것처럼 보이지만 실제로는이 기능을 사용한 적이 없습니다 . enable-local-variables임의의 코드 주입 공격에 노출시키지 않고 유용한 방법이 있습니까?