created by

Ciaran McCreesh

script type

utility

description

Secure, user-configurable modeline support for Vim 7. Vim's internal modeline support allows all sorts of annoying and potentially insecure options to be set. This script implements a much more heavily restricted modeline parser that permits only user-specified options to be set. The g:secure_modelines_allowed_items array contains allowable options. By default it is set as follows:     let g:secure_modelines_allowed_items = [                 \ "textwidth",   "tw",                 \ "softtabstop", "sts",                 \ "tabstop",     "ts",                 \ "shiftwidth",  "sw",                 \ "expandtab",   "et",   "noexpandtab", "noet",                 \ "filetype",    "ft",                 \ "foldmethod",  "fdm",                 \ "readonly",    "ro",   "noreadonly", "noro",                 \ "rightleft",   "rl",   "norightleft", "norl"                 \ ] The g:secure_modelines_verbose option, if set to something true, will make the script warn when a modeline attempts to set any other option. The g:secure_modelines_modelines option overrides the number of lines to check. By default it is 5. If g:secure_modelines_leave_modeline is defined, the script will not clobber &modeline. Otherwise &modeline will be unset.

install details

Install into your plugin directory of choice.

Click on the package to download.

package	script version	date	Vim version	user	release notes
securemodelines.vim	20080424	2008-04-24	7.0	Ciaran McCreesh	Two tweaks, thanks to Christian J. Robinson: Make the messages it echoes end up in the :messages history. Modelines of the format "vim: set ...:" can also be be "vim:set ...:".
securemodelines.vim	20070518	2007-05-18	7.0	Ciaran McCreesh	The number of lines to search is now controllable via let g:secure_modelines_modelines=5. If g:secure_modelines_leave_modeline is defined, the internal &modeline variable will be left alone. Previously only one line at the end of the document would be searched for modelines. This is now fixed, thanks to Thomas de Grenier de Latour. The <SID>DoModelines function can now be accessed externally via SecureModelines_DoModelines.
securemodelines.vim	20070513	2007-05-13	7.0	Ciaran McCreesh	Modelines with no set: are now parsed correctly. rightleft is now included in the default allowed options, for help files. Builtin modelines are now forcibly disabled.
securemodelines.vim	20070409	2007-04-29	7.0	Ciaran McCreesh	Initial upload