From owner-freebsd-hackers@FreeBSD.ORG  Sun Jul 25 22:22:20 2004
Return-Path: <owner-freebsd-hackers@FreeBSD.ORG>
Delivered-To: freebsd-hackers@freebsd.org
Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125])
	by hub.freebsd.org (Postfix) with ESMTP id 5123716A4CE
	for <freebsd-hackers@freebsd.org>;
	Sun, 25 Jul 2004 22:22:20 +0000 (GMT)
Received: from pc5.i.0x5.de (n.0x5.de [213.146.113.119])
	by mx1.FreeBSD.org (Postfix) with ESMTP id 7F18143D53
	for <freebsd-hackers@freebsd.org>;
	Sun, 25 Jul 2004 22:22:18 +0000 (GMT)
	(envelope-from nicolas@i.0x5.de)
Received: from pc5.i.0x5.de (nicolas@localhost [127.0.0.1])
	by pc5.i.0x5.de (8.12.11/8.12.11) with ESMTP id i6PMMFo0034610;
	Mon, 26 Jul 2004 00:22:15 +0200 (CEST)
	(envelope-from nicolas@pc5.i.0x5.de)
Received: (from nicolas@localhost)
	by pc5.i.0x5.de (8.12.11/8.12.11/Submit) id i6PMMFMp034609;
	Mon, 26 Jul 2004 00:22:15 +0200 (CEST)
	(envelope-from nicolas)
Date: Mon, 26 Jul 2004 00:22:15 +0200
From: Nicolas Rachinsky <list@rachinsky.de>
To: =?iso-8859-1?Q?Jos=E9?= de Paula <espinafre@gmail.com>
Message-ID: <20040725222215.GB33560@pc5.i.0x5.de>
Mail-Followup-To: =?iso-8859-1?Q?Jos=E9?= de Paula <espinafre@gmail.com>,
	freebsd-hackers@freebsd.org
References: <5ef8c2f004071419517bdc9f3e@mail.gmail.com>
	<20040718135541.GA28115@gothmog.gr>
	<5ef8c2f0040718144648b49ff6@mail.gmail.com> <20040719131503.GA12222@stack.nl>
	<5ef8c2f0040725140372d192bb@mail.gmail.com>
Mime-Version: 1.0
Content-Type: text/plain; charset=iso-8859-1
Content-Disposition: inline
Content-Transfer-Encoding: 8bit
In-Reply-To: <5ef8c2f0040725140372d192bb@mail.gmail.com>
X-Powered-by: FreeBSD
X-Homepage: http://www.rachinsky.de
X-PGP-Keyid: C11ABC0E
X-PGP-Fingerprint: 19DB 8392 8FE0 814A 7362  EEBD A53B 526A C11A BC0E
X-PGP-Key: http://www.rachinsky.de/nicolas/nicolas_rachinsky.asc
User-Agent: Mutt/1.5.6i
cc: freebsd-hackers@freebsd.org
Subject: Re: [PATCH] basic modelines for contrib/nvi
X-BeenThere: freebsd-hackers@freebsd.org
X-Mailman-Version: 2.1.1
Precedence: list
List-Id: Technical Discussions relating to FreeBSD
	<freebsd-hackers.freebsd.org>
List-Unsubscribe: <http://lists.freebsd.org/mailman/listinfo/freebsd-hackers>,
	<mailto:freebsd-hackers-request@freebsd.org?subject=unsubscribe>
List-Archive: <http://lists.freebsd.org/pipermail/freebsd-hackers>
List-Post: <mailto:freebsd-hackers@freebsd.org>
List-Help: <mailto:freebsd-hackers-request@freebsd.org?subject=help>
List-Subscribe: <http://lists.freebsd.org/mailman/listinfo/freebsd-hackers>,
	<mailto:freebsd-hackers-request@freebsd.org?subject=subscribe>
X-List-Received-Date: Sun, 25 Jul 2004 22:22:20 -0000

* José de Paula <espinafre@gmail.com> [2004-07-25 18:03 -0300]:
> On Mon, 19 Jul 2004 15:15:04 +0200, Jilles Tjoelker <jilles@stack.nl> wrote:
> <snip>
> > 
> > There are some options which can pose a security risk, including but not
> > limited to cdpath, tempdir, path and shell. You should make a list of
> > "safe" options and only allow those in modelines.
> 
> Thanks for the feedback, stay tuned for nvi modelines improvement! As
> soon as I have enough time, I'm going to take some forbidden options
> (for now, they are cdpath, directory, shell, backup and path. Please
> tell me what other options would be unsafe) and quietly strip them
> from the modeline.

Please follow the above suggestion and make a list of safe options and
disallow everything else. 

Nicolas