https://github.com/ypcrts/securemodelines

Secure alternative to Vim modelines. Maintained, active fork.
https://github.com/ypcrts/securemodelines

modeline security vim vim-modelines vim-plugin

Last synced: 4 months ago
JSON representation

Secure alternative to Vim modelines. Maintained, active fork.

• Host: GitHub
• URL: https://github.com/ypcrts/securemodelines
• Owner: ypcrts
• License: other
• Created: 2017-10-11T21:50:43.000Z (over 7 years ago)
• Default Branch: master
• Last Pushed: 2022-09-05T08:41:07.000Z (over 2 years ago)
• Last Synced: 2023-02-27T18:17:04.101Z (almost 2 years ago)
• Topics: modeline, security, vim, vim-modelines, vim-plugin
• Language: Vim script
• Homepage:
• Size: 22.5 KB
• Stars: 6
• Watchers: 3
• Forks: 4
• Open Issues: 1
• Metadata Files:
  • Readme: README.md
  • License: LICENSE.txt

Awesome Lists containing this project

README

        

# securemodelines

A secure alternative to Vim modelines

This is a maintained fork of the [original vimscript](https://github.com/ciaranm/securemodelines).

## Description

Vim's internal modeline support allows all sorts of annoying and potentially

insecure options to be set. This script implements a much more heavily

restricted modeline parser that permits only user-specified options to be set.

## Installation

No configuration required.

Using [vim-plug](https://github.com/junegunn/vim-plug)

```vim

Plug 'ypcrts/securemodelines'

```

##  Internals

The `g:secure_modelines_allowed_items` array contains allowed options.  See

`:help securemodelines_options` for default values.

The `g:secure_modelines_verbose` variable, if set to something true, will make

the script warn when a modeline attempts to set any other option.

The `g:secure_modelines_modelines` variable overrides the number of lines to

check. By default it is 5.

If `g:secure_modelines_leave_modeline` is defined, the script will not clobber

&modeline. Otherwise &modeline will be unset.

If `b:disable_secure_modelines` is defined, securemodelines will not run for

the current buffer. The intent being to turn off securemodelines in an

ftplugin.

## Contributors

See the [contributors

graph](https://github.com/ypcrts/securemodelines/graphs/contributors).