Option to disable plugins

未关闭
#4,147 2 条评论 0 个 reaction 已指派 0 人 在 GitHub 查看

维护者通常 3 天内回复

还没有人认领这个 Issue。

评估

难度
5/5
预计耗时
一周以上
新手友好度
35/100
Issue 类型
功能
描述清晰度
基本清楚
活跃度
冷清
技术栈
go
领域
cli, security

调研方向

首先追踪插件如何从 ~/.config/micro 加载,以及当前如何处理配置。评估一个用户不可写的配置位置(例如 /etc/micro),包括所述的对内置扩展和多用户设置的影响。完成的标准是提供一种有文档记录且可强制执行的方式,在不加载插件的情况下运行 micro。

由索引模型根据 Issue 内容生成。

描述

feature
Description

Currently, there doesn't appear to be any way to completely disable the loading of plugins. Individual plugins can be disabled, but there is no way to force micro to only run its own self-contained code.

Since plugins are loaded from the user-writeable ~/.config/micro folder, any process which can write into that folder could inject a plugin. This could be a concern in security sensitive contexts. Preventing this would be a significant attack surface reduction.

I am aware this would likely mean disabling the builtin extensions as well. I am fine with this.

Edit: Of course, this would need to be configurable somewhere that's not user-writeable, for obvious reasons... perhaps a separate config file in /etc/micro would be best. Would be good for other security related options like autosu, and would allow global configuration in multi-user setups as well.

主要语言
Go
星标
29.8k
派生
1.4k
平均合并
1 天 12 小时
30 天内合并 PR
2

环境准备

这个项目没有提供开发容器、Dockerfile 或贡献指南,环境需要你自己搭建:先看它的 README,通用步骤见我们的新手贡献指南。

从这里开始

  1. 先读完整个 Issue,再读项目的贡献指南。
  2. 在 Issue 下留言说明你要接手 —— 这能避免两个人做同样的事。
  3. Fork 仓库,在一个分支上完成修改。
  4. 提交 Pull Request,并在描述里引用这个 Issue 编号。

micro-editor/micro 的其他 Issue

查看 micro-editor/micro 的全部 Issue

相似的 Issue

更多 Go Issue

把新 issue 发到你的邮箱

精选适合新手参与的 GitHub issue 摘要。