diff --git a/etc/NEWS b/etc/NEWS index c5f1123ebc1..8e92cef2bcb 100644 --- a/etc/NEWS +++ b/etc/NEWS @@ -199,7 +199,7 @@ see the variable 'url-request-extra-headers'. * Changes in Emacs 30.1 -** New user option 'trusted-files' to allow potentially dangerous features. +** New user option 'trusted-content' to allow potentially dangerous features. This variable lists those files and directories whose content Emacs should consider as sufficiently trusted to run any part of the code contained therein even without any explicit user request. @@ -1869,7 +1869,7 @@ In the past they included a terminating newline in most cases but not all. *** 'elisp-flymake-byte-compile' is disabled for untrusted files. For security reasons, this backend can be used only in those files -specified as trusted according to 'trusted-files' and emits an +specified as trusted according to 'trusted-content' and emits an "untrusted content" warning otherwise. This fixes CVE-2024-53920. diff --git a/lisp/files.el b/lisp/files.el index 5d9e6440f5b..e7399ba7cda 100644 --- a/lisp/files.el +++ b/lisp/files.el @@ -714,7 +714,7 @@ buffer contents as untrusted. This variable might be subject to change without notice.") (put 'untrusted-content 'permanent-local t) -(defcustom trusted-files nil +(defcustom trusted-content nil "List of files and directories whose content we trust. Be extra careful here since trusting means that Emacs might execute the code contained within those files and directories without an explicit @@ -732,12 +732,12 @@ all files, which opens a gaping security hole." :type '(choice (repeat :tag "List" file) (const :tag "Trust everything (DANGEROUS!)" :all)) :version "30.1") -(put 'trusted-files 'risky-local-variable t) +(put 'trusted-content 'risky-local-variable t) (defun trusted-content-p () "Return non-nil if we trust the contents of the current buffer. Here, \"trust\" means that we are willing to run code found inside of it. -See also `trusted-files'." +See also `trusted-content'." ;; We compare with `buffer-file-truename' i.s.o `buffer-file-name' ;; to try and avoid marking as trusted a file that's merely accessed ;; via a symlink that happens to be inside a trusted dir. @@ -746,14 +746,14 @@ See also `trusted-files'." (with-demoted-errors "trusted-content-p: %S" (let ((exists (file-exists-p buffer-file-truename))) (or - (eq trusted-files :all) + (eq trusted-content :all) ;; We can't avoid trusting the user's init file. (if (and exists user-init-file) (file-equal-p buffer-file-truename user-init-file) (equal buffer-file-truename user-init-file)) (let ((file (abbreviate-file-name buffer-file-truename)) (trusted nil)) - (dolist (tf trusted-files) + (dolist (tf trusted-content) (when (or (if exists (file-equal-p tf file) (equal tf file)) ;; We don't use `file-in-directory-p' here, because ;; we want to err on the conservative side: "guilty diff --git a/lisp/ielm.el b/lisp/ielm.el index e583e0fe32c..7511d4b02ae 100644 --- a/lisp/ielm.el +++ b/lisp/ielm.el @@ -580,6 +580,7 @@ Customized bindings may be defined in `ielm-map', which currently contains: ielm-fontify-input-enable (comint-fontify-input-mode)) + (setq-local trusted-content :all) (setq comint-prompt-regexp (concat "^" (regexp-quote ielm-prompt))) (setq-local paragraph-separate "\\'") (setq-local paragraph-start comint-prompt-regexp) diff --git a/lisp/progmodes/elisp-mode.el b/lisp/progmodes/elisp-mode.el index ab79082d1b2..17606352c4a 100644 --- a/lisp/progmodes/elisp-mode.el +++ b/lisp/progmodes/elisp-mode.el @@ -457,8 +457,9 @@ use of `macroexpand-all' as a way to find the \"underlying raw code\".") (progn (when elisp--macroexpand-untrusted-warning (setq-local elisp--macroexpand-untrusted-warning nil) ;Don't spam! - (message "Completion of local vars is disabled in %s (untrusted content)" - (buffer-name))) + (let ((inhibit-message t)) ;Only log. + (message "Completion of local vars is disabled in %s (untrusted content)" + (buffer-name)))) sexp) (let ((macroexpand-advice (lambda (expander form &rest args) @@ -1336,7 +1337,8 @@ Semicolons start comments. \\{lisp-interaction-mode-map}" :abbrev-table nil - (setq-local lexical-binding t)) + (setq-local lexical-binding t) + (setq-local trusted-content :all)) ;;; Emacs Lisp Byte-Code mode diff --git a/lisp/simple.el b/lisp/simple.el index 3054c8ab6a7..088678ba857 100644 --- a/lisp/simple.el +++ b/lisp/simple.el @@ -2033,6 +2033,7 @@ function `read-from-minibuffer'." (set-syntax-table emacs-lisp-mode-syntax-table) (add-hook 'completion-at-point-functions #'elisp-completion-at-point nil t) + (setq-local trusted-content :all) (run-hooks 'eval-expression-minibuffer-setup-hook)) (read-from-minibuffer prompt initial-contents read--expression-map t