You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
yes, executable code in .aprc can possibly allow code injection attacks (one reason why I never kept awesome_print enabled in production. Another reason being that it was was triggering severe performance issues in some situations, by simply having gem loaded into process; don't know if amazing_print has inherited those performance issues).
The current fixed .aprc location in the home folder - as opposed to project folder etc. - also complicates deployment and configuration sharing between devs. For example, building a Docker image with files outside the project folder is not possible/inconvenient.
I was about to open an issue for supporting an XDG base directory aware config path ($XDG_CONFIG_HOME/aprc -- I like a clean $HOME 😄), when I came across this issue here, which potentially already includes that feature.
@paddor OTOH if work on this issue is not likely any time soon, let me know if a PR for just adding XDG base dir support would have a chance of getting accepted.
To avoid conflicts like #54 I think we should stop using
.aprc
and use a new file in YAML format like Rubocop does.We could support loading files from multiple places. See https://github.com/rubocop-hq/rubocop/blob/master/lib/rubocop/config_loader.rb
This is also more safe since today any Ruby code in
.aprc
is executed.The text was updated successfully, but these errors were encountered: