bug#53876: 27.2; "eval: (X-mode)" is always safe as file local variable

[Ignacio Casso]

Hello,

I've noticed something that I believe it might be a bug. With Emacs 27.2
and the default configuration (starting with emacs -Q), I get the
following behavior:

If I visit a file ending with the three lines below, I get the usual
prompt asking whether I want to apply the local variables since they
might not be safe. So far so good.

# Local Variables:
# eval: (message "file was visited")
# End:

If I visit a file with the following local variables instead, I don't
get that prompt and the form is evaluated immediately, so I get line
numbers in the buffer. This happens for any other mode.

# Local Variables:
# eval: (display-line-numbers-mode)
# End:

I'm not sure if that is still good, but the real problem comes now, when I
define a function with a name ending in "-mode", like the following:

(defun not-really-a-mode ()
  (message "This could be doing something nasty"))

If I visit a file with the following local variables, I don't get the
prompt either and the form is evaluated immediately.

# Local Variables:
# eval: (not-really-a-mode)
# End:

(Of course, activating an actual mode could be doing something equally
nasty, but somehow I find this worse)

I've investigated a little and found the function
hack-one-local-variable-eval-safep in files.el, which is responsible for
this. It has a comment that says "Allow (minor)-modes calls with no
arguments.", and just checks whether the function ends in "-mode".

I'm not sure if it's a bug or a feature, and it's not important at all
to me, since it's actually convenient. I'm just reporting it since I
noticed it and I'm trying to get in the habit of reporting (possible)
bugs when I find them.

Best regards,

Ignacio

In GNU Emacs 27.2 (build 1, x86_64-pc-linux-gnu, GTK+ Version 3.24.20)
 of 2022-01-16 built on ignacio-IdeaPad-3-15ADA05
Windowing system distributor 'The X.Org Foundation', version 11.0.12013000
System Description: Ubuntu 20.04.3 LTS