{"action":"created","issue":{"url":"https://api.github.com/repos/alecthomas/gometalinter/issues/461","repository_url":"https://api.github.com/repos/alecthomas/gometalinter","labels_url":"https://api.github.com/repos/alecthomas/gometalinter/issues/461/labels{/name}","comments_url":"https://api.github.com/repos/alecthomas/gometalinter/issues/461/comments","events_url":"https://api.github.com/repos/alecthomas/gometalinter/issues/461/events","html_url":"https://github.com/alecthomas/gometalinter/issues/461","id":313344428,"number":461,"title":"reconsider whether a project's .gometalinter.json can override default linter commands","user":{"login":"marienz","id":516706,"avatar_url":"https://avatars1.githubusercontent.com/u/516706?v=4","gravatar_id":"","url":"https://api.github.com/users/marienz","html_url":"https://github.com/marienz","followers_url":"https://api.github.com/users/marienz/followers","following_url":"https://api.github.com/users/marienz/following{/other_user}","gists_url":"https://api.github.com/users/marienz/gists{/gist_id}","starred_url":"https://api.github.com/users/marienz/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/marienz/subscriptions","organizations_url":"https://api.github.com/users/marienz/orgs","repos_url":"https://api.github.com/users/marienz/repos","events_url":"https://api.github.com/users/marienz/events{/privacy}","received_events_url":"https://api.github.com/users/marienz/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":0,"created_at":"2018-04-11T14:17:08Z","updated_at":"2018-04-11T19:38:31Z","closed_at":null,"author_association":"NONE","body":"Support for overriding or adding linters through a configuration file, and for looking for the configuration file in the project tree of the files being linted, are both great. But combining the two might be a little too much of a good thing: it means running gometalinter on a freshly checked-out project can run arbitrary commands specified in that project's .gometalinter.json. This is especially surprising for someone with [editor integration](https://github.com/alecthomas/gometalinter#editor-integration) set up: merely looking at freshly checked-out code will then silently run commands from its .gometalinter.json.\r\n\r\nContrast this to \"go get\", which goes to some lengths to check out (see https://github.com/golang/go/issues/22125) and build (see https://github.com/golang/go/issues/23672) code without allowing arbitrary code execution. Viewing the built source should be equally safe.\r\n\r\nI'd expect configuration files bundled with source to only control which checks are run on which code (including enabling/disabling named linters) and what the parameters for those checks are, while specifying a new linter or overriding the command of an existing linter needs to be done explicitly (through a commandline flag or a configuration file under the user's control). I think that means: don't support the \"Linters\" configuration key unless the configuration file was loaded from the user's home directory."},"comment":{"url":"https://api.github.com/repos/alecthomas/gometalinter/issues/comments/380571421","html_url":"https://github.com/alecthomas/gometalinter/issues/461#issuecomment-380571421","issue_url":"https://api.github.com/repos/alecthomas/gometalinter/issues/461","id":380571421,"user":{"login":"dnephin","id":442180,"avatar_url":"https://avatars1.githubusercontent.com/u/442180?v=4","gravatar_id":"","url":"https://api.github.com/users/dnephin","html_url":"https://github.com/dnephin","followers_url":"https://api.github.com/users/dnephin/followers","following_url":"https://api.github.com/users/dnephin/following{/other_user}","gists_url":"https://api.github.com/users/dnephin/gists{/gist_id}","starred_url":"https://api.github.com/users/dnephin/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/dnephin/subscriptions","organizations_url":"https://api.github.com/users/dnephin/orgs","repos_url":"https://api.github.com/users/dnephin/repos","events_url":"https://api.github.com/users/dnephin/events{/privacy}","received_events_url":"https://api.github.com/users/dnephin/received_events","type":"User","site_admin":false},"created_at":"2018-04-11T19:38:31Z","updated_at":"2018-04-11T19:38:31Z","author_association":"COLLABORATOR","body":"> merely looking at freshly checked-out code will then silently run commands\r\n\r\nDo editors typically run linters when you open a file? I thought they ran when you saved a file. You shouldn't need to save a file to view it. \r\n\r\n> don't support the \"Linters\" configuration key unless the configuration file was loaded from the user's home directory\r\n\r\nThat sounds very strange to me. Is there any tool out there that has such a restriction? Also, isn't most code checked out under the users home directory? Are you suggesting that the config could only be in the home directory itself? That is quite strange.\r\n\r\n>  it means running gometalinter on a freshly checked-out project can run arbitrary commands specified in that project's .gometalinter.json\r\n\r\nYes it does. But you can also execute arbitrary commands with `go test` and `go generate`. I see running lint as a very similar thing, and it's much easier to check what linters will be run than reading every line of test code.\r\n\r\nPersonally I think it's good the way it is now."}}
{"actor":{"display_login":"dnephin"}}