bug#41619: [PATCH] Mark python-shell-virtualenv-root as safe local variable

[Philip K.]

Eli Zaretskii <eliz@gnu.org> writes:

>> That would make it harder for projects to hide malicious values of
>> python-shell-virtualenv-root, but it's still an attack vector in
>> principle.
>
> Then I don't think I understand how you suggest to fix this.

I don't know either, any directory with a properly configured
dir-locals.el file and a bin/python executable can be exploited if the
user doesn't pay attention in python-mode. 

As mentioned above, I agree that the best thing would be to unmark the
variable as safe. I'll try to find out more on how to avoid abitrary
code execution in python, and if there's some way, I would try to
implement it so that the variable can be marked as safe again.

-- 
        Philip K.