Risky variables in Gnus (was: Warning: `mapcar' called for effect; use `mapc' or `dolist')

[Reiner Steib]

On Tue, Oct 23 2007, Richard Stallman wrote:

>     >   > (defun gnus-group-highlight-line ()
>     >   >   "Highlight the current line according to `gnus-group-highlight'."
>     [...]
>     > It seems that `mailp' is not used in that function. 
>
>     `mailp' is used implicitly through the variable `gnus-group-highlight'
>     which is let-bound to `list'.  `list' is used in the body of the
>     let-form.
[...]
> I added a `risky-local-variable' property to `gnus-group-highlight'.

Fine with me.  But I can't imagine a way to exploit this.  Setting
`gnus-group-highlight' buffer-locally (using local variables in a
file) won't effect Gnus *Group* buffer where the variable is
evaluated.

> Are there any other such variables in Gnus which contain forms to
> evaluate?

Yes, a quick «grep -inH -e ':tag "Form"' *.el» [1] showed some hits
(there are more probably).  However, I neither can see a way to
maliciously manipulate these variables through file local variables.
I someone can think of a way, please let me know.  I think the vast
majority of Gnus functions are _not_ evaluated in file-visiting
buffers.  But it's fine with me to mark all these variables as risky.

Here's a list of such variable I found so far: `gnus-button-alist',
`gnus-header-button-alist', `gnus-group-charter-alist',
`gnus-group-highlight', `gnus-group-icon-list',
`gnus-summary-highlight', `mm-charset-eval-alist'.

Bye, Reiner.

--8<---------------cut here---------------start------------->8---
-*- mode: grep; default-directory: "~/src/links/plain_No/lisp/" -*-
Grep started at Sat Oct 27 12:29:54

grep -inH -e ':tag "Form"' *.el
gnus-art.el:7181:                      (sexp :tag "Form")
gnus-art.el:7220:                      (sexp :tag "Form")
gnus.el:1482:  :type '(repeat (cons (string :tag "Hierarchy") (sexp :tag 
"Form"))))
gnus-group.el:384:  :type '(repeat (cons (sexp :tag "Form") face)))
gnus-group.el:422:  :type '(repeat (cons (sexp :tag "Form") file)))
gnus-sum.el:1081:  :type '(repeat (cons (sexp :tag "Form" nil)
mm-util.el:431:                      (symbol :tag "form"))))

Grep finished (matches found) at Sat Oct 27 12:29:55
--8<---------------cut here---------------end--------------->8---
-- 
       ,,,
      (o o)
---ooO-(_)-Ooo---  |  PGP key available  |  http://rsteib.home.pages.de/