Hacker News Reader

Comment by normie3000 | Hacker News Reader

I'd be interested to understand what modelines are for, and if this is a class of bug that can be disabled via vim settings. Also, are there editors which could not be affected by this class of bug?

View on HN

modelines allow you to put a special comment in your file (typically on the first or last line of the file, and [for vim] of the format `# vim: set ts=2:`) to configure a subset of editor settings automatically whenever that file is opened in a buffer. They're very common, especially in codebases where there are lots of different styles in different files. Many editors (e.g., Zed (as of https://github.com/zed-industries/zed/pull/49267)) support vim and/or emacs's syntaxes for modelines.

Modelines were disabled by default for security reasons for a long time. It's kind of wild to me that they're enabled in some distributions, but there still isn't much restriction on what settings can be configured; I've never seen a modeline in the wild that did anything other than set `filetype`, `fileencoding`, `tabwidth`, `expandtab` (hard tabs vs spaces), and maybe `tabstop` / `softtabstop`.

> I've never seen a modeline in the wild that did anything other than

Hence the securemodelines plugin

https://www.vim.org/scripts/script.php?script_id=1876

> if this is a class of bug that can be disabled via vim settings.

    set nomodeline

That is, as parent mentioned, if it's not done already by your distro or OS.

They no doubt predate .editorconfig, but the problem as described is now better solved by .editorconfig, which can be used to configure directory and file specific configuration and works cross-editor too.

Struggling to find a source, but apparently modelines are disabled by default in debian and perhaps other common distros.

modelines are special lines you can put into files that sets vim options when the file is read by vim. Probably most commonly used to set tab space and tab width.

Reply on news.ycombinator.com