reduce/eliminate unsafe local variables

VladimirAlexiev commented 7 months ago

Loading elot-template causes a big ugly warning about unsafe local variables:

The local variables list in elot-template.org
contains values that may not be safe (*).

Do you want to apply it?  You can type
y  -- to apply the local variables list.
n  -- to ignore the local variables list.
!  -- to apply the local variables list, and permanently mark these
      values (*) as safe (in the future, they will be set automatically.)
i  -- to ignore the local variables list, and permanently mark these
      values (*) as ignored

    mode : org
  * org-confirm-babel-evaluate : nil
    org-babel-default-inline-header-args : ((:exports . "code"))
    org-latex-src-block-backend : listings
  * org-latex-classes : (("book" "\\documentclass[11pt]{scrbook}" ontology-resource-section))
  * org-latex-prefer-user-labels : t
  * eval : (progn (org-babel-lob-ingest "elot-lob.org") (org-sbe defun-desc-lists) (org-sbe defun-puri) (org-sbe defun-resource-headings) (org-sbe defun-resource-declaration) (org-sbe defun-class-patterns) (org-sbe defun-resource-taxonomy) (org-sbe defun-latex-export) (org-sbe defun-get-heading-nocookie) (org-sbe defun-get-description-entry) (org-sbe defun-ELOT-latex-derived-backend) (defun ask-user-about-supersession-threat (fn) "nothing"))
  * eval : (setq-local org-latex-image-default-scale 0.8)
  * eval : (setq-local org-babel-default-header-args:sparql '((:results . "table replace") (:exports . "code") (:format . "text/tab-separated-values") (:noweb . "yes") (:url . "http://localhost:3030/NOTINUSE")))
    time-stamp-line-limit : 1000
    time-stamp-format : "%Y-%m-%d %H:%M"
  * time-stamp-active : t
    time-stamp-start : "(version of "
    time-stamp-end : ")"
  * eval : (add-hook 'before-save-hook #'time-stamp)

Some of these are truly unsafe: org-confirm-babel-evaluate nil means that a malicious org file can execute any code
setting ask-user-about-supersession-threat to "nothing" means that the user will be allowed (misled) to edit any obsolete file/buffer.
The need for eval with all of org-sbe defun-* can be eliminated by #2
I think (org-babel-lob-ingest "elot-lob.org") can be replaced by #+SETUP: ...

johanwk commented 7 months ago

Indeed! These should be eliminated as soon as possible.

VladimirAlexiev commented 7 months ago

Please comment on the last bullet (added)

johanwk / elot

reduce/eliminate unsafe local variables #3