Re: [PATCH] Add project-wide .vimrc configuration

From: brian m. carlson <sandals@crustytoothpaste.net>
Date: Dec 9, 2020, 02:23 UTC
Message-ID: <X9A1On3v35nEjL7i@camp.crustytoothpaste.net>
In-Reply-To: <20201209002619.25468-1-felipe.contreras@gmail.com>

On 2020-12-09 at 00:26:19, Felipe Contreras wrote:

Show 8 quoted lines

> It's not efficient that everyone must set specific configurations in all
> their ~/.vimrc files; we can have a project-wide .vimrc that everyone
> can use.
> 
> By default it's ignored, you need the following in your ~/.vimrc
> 
>   set exrc
>   set secure

I would strongly recommend against advising users to use this configuration. Vim has been known to have repeated security problems with what options are allowed in restricted environments, and even with the secure option, it's still easy to do something like this:

  func Foo()
    !echo >/tmp/foo
  endfunction

  nmap i :call Foo()<CR>

When the user hits "i" to enter insert mode, they'll execute the attacker's arbitrary code.

> We could add the vim modelines at the bottom of every file, like other
> projects do, but this seems more sensible.

We have an .editorconfig file[0], which is a cross-editor file that can be used to specify these settings. It is supported by many editors out of the box, although Vim requires a plugin. Since we don't want to support configuration for every editor under the sun, it makes sense to use a single file for multiple editors and let people configure their editor accordingly.

Since Vim would require configuration either way and .editorconfig files don't have any known security issues, the .editorconfig file seems like a better option.

[0] https://editorconfig.org/

-- 
brian m. carlson (he/him or they/them)
Houston, Texas, US