15735

PR helix-editor#15582
refactor(workspace_trust): minor changes

fix(workspace_trust): secure permissions on Unix

fix(workspace_trust): reject paths with \n

PR helix-editor#15590

refactor(helix-loader): split out duplicated code

In the workspace trust code, the code to search a path in a file was
copy-pasted three times. This splits it out into a helper function.

refactor(helix-loader): use BufReader to read trust files

When the workspace trust files become large, using a BufReader can
increase performance, as it won't block until the whole file is loaded
into RAM.

refactor(helix-loader): cache workspace trust, unify with PROMPTED_WORKSPACES

Since `quick_query_workspace()` and
`quick_query_workspace_with_explicit_untrust()` are currently called
seven times on startup, it makes sense to cache the result. With this
in place, the previous cache for prompted workspaces could be merged
into this.

Docs (helix-editor#15636)

Improve readability and grammar of workspace trust docs and popup

Rewrite of helix-editor#15592

Merge of helix-editor#15582 and rewritten helix-editor#15592

Change `PathBuf` to `Path`, as per suggestion from archseer

Use workspace trust in git subsystem

Replace default gitoxide's model of trust (directory
ownership) with our own one.

Closes helix-editor#15594

Merge of everything with helix-editor#15644

Expand docs; merge wirh everything else

Hardening of workspace-trust-related file modes and permissions

Do not query for trust if there are no langugage servers to start

Refactor: save state into `Editor`; get rid of statics

Add an option to disable trust selector pop-up

Add `:workspace-exclude` typable command

Update docs

Add 'Only once' selector option and `:workspace-trust-once` typable

Allow setting trust via globbed paths in config

Co-authored-by: Rudxain <76864299+Rudxain@users.noreply.github.com>
Co-authored-by: Marian Buschsieweke <marian.buschsieweke@posteo.net>
Co-authored-by: David <12832280+David-Else@users.noreply.github.com>

Author: 4 people

Cargo.lock

@@ -23,6 +23,7 @@
 - [`[editor.smart-tab]` Section](#editorsmart-tab-section)
 - [`[editor.inline-diagnostics]` Section](#editorinline-diagnostics-section)
 - [`[editor.word-completion]` Section](#editorword-completion-section)
+- [`[editor.workspace-trust]` Section](#editorworkspace-trust-section)
 
 ### `[editor]` Section
 
@@ -665,3 +666,27 @@ enable = true
 # Set the trigger length lower so that words are completed more often
 trigger-length = 4
 ```
+
+### `[editor.workspace-trust]` Section
+
+Options for workspace trust.
+
+| Key        | Description                                                                 | Default  |
+| ---        | ---                                                                         | ---      |
+| `level`    | Level of implicit trust. Allowed values are: `"none"`, `"lsp"` and `"all"`. | `"none"` |
+| `selector` | Whether to show trust selector pop-up.                                      | `true`   |
+| `globs`    | Globbed paths indicating trust or exclusion. See ["Workspace trust" section](./workspace-trust.md#glob-syntax). | [  ]     |
+
+Example:
+
+```toml
+[editor.workspace-trust]
+# Always start LSP
+level = "lsp"
+
+# Disable pop-up selector, leaving status bar reminder instead.
+selector = false
+
+# Trust all workspaces in ~/work non-recursively
+globs = [ "~/work/*" ]
+```

book/src/editor.md

@@ -97,6 +97,8 @@
 | `:read`, `:r` | Load a file into buffer |
 | `:echo` | Prints the given arguments to the statusline. |
 | `:noop` | Does nothing. |
-| `:workspace-trust` | Add current workspace to the list of trusted workspaces. |
-| `:workspace-untrust` | Remove current workspace from the list of trusted workspaces. |
+| `:workspace-trust` | Trust current workspace permanently. |
+| `:workspace-untrust` | Untrust current workspace without excluding it. |
+| `:workspace-exclude` | Untrust current workspace and exclude it. |
+| `:workspace-trust-once` | Trust current workspace only until restart. |
 | `:set-max-width` | Set the maximum width of the editor, or swap between 2 widths. If set to 0 it will take up the entire width. |

book/src/generated/typable-cmd.md

@@ -1,23 +1,73 @@
 # Workspace trust
 
-Helix has a number of potentially dangerous features, namely LSP and ability to use local to workspace configurations. Those features can lead to unexpected code execution. To protect against code execution in dangerous contexts, Helix has a workspace trust protection, which will prevent these potentially dangerous features from running automatically.
+Helix includes two potentially dangerous features, both of which can execute arbitrary code:
 
-Helix will not trust any workspace by default.
+- Language servers (LSP)
+- Local workspace configurations (`.helix/config.toml` and `.helix/languages.toml`)
 
-By default, it will prompt about trust when you open new file in a workspace where you didn't make a decision about trust yet.
+To protect against this, Helix includes workspace trust protection, which prevents these features from running automatically unless the workspace is explicitly trusted.
 
-If you decide not to trust a workspace and don't want to be prompted about trust every time you start a new session in it, you can exclude the workspace by choosing `Never` option in trust selection window.
+## Default trust behavior
 
-You can always make current workspace trusted by running `:workspace-trust` command, and untrust it with `:workspace-untrust`.
+Helix does not trust any workspace by default and will prompt you to choose the trust level when you open a file in a workspace where trust has not yet been set.
 
-Lists of trusted and excluded workspaces, delimited by newline characters, are stored in `~/.local/share/helix/trusted_workspaces` and `~/.local/share/helix/excluded_workspaces` correspondingly.
-<!-- TODO: Windows paths -->
+## Changing workspace trust status
 
-# Configuration
+You can always make the current workspace trusted by running the `:workspace-trust` command, and untrust it using `:workspace-untrust` or `:workspace-exclude`, with latter disabling all further prompts in it. If you wish to trust workspace only once, use `:workspace-trust-once`.
 
-You can return to the old behaviour of loading every local `.helix/config.toml` and `.helix/languages.toml` and starting LSP's without an explicit permission by setting following option:
+Lists of trusted and excluded workspaces, delimited by newline characters, are stored in:
+
+- Linux and macOS: `~/.local/share/helix/trusted_workspaces` and `~/.local/share/helix/excluded_workspaces`
+- Windows: `%AppData%\Roaming\helix\trusted_workspaces` and `%AppData%\Roaming\helix\excluded_workspaces`
+
+
+## Configuration
 
 ```toml
-[editor]
-insecure = true
+[editor.workspace-trust]
+# This option will disable workspace trust feature altogether.
+level = "all"
+
+
+# This will make Helix prompt only when there is local configuration
+# present in the workspace.
+# LSP will start automatically without an explicit confirmation.
+level = "lsp"
+
+
+# This is the default option.
+level = "none"
+
+
+# Disable pop-up selector, leaving status bar reminder instead.
+selector = false
+
+
+# Trust recursively every workspace in `~/work` and exclude every workspace
+# that contains "contrib" in its name.
+globs = [ "~/work/**", "!*contrib*" ]
 ```
+
+### Glob syntax
+
+For more info about syntax see [globset docs](https://docs.rs/globset/latest/globset/#syntax)
+(`literal_separator` option is enabled).
+
+Additional syntax:
+
+  - all `~/` will be expanded to `$HOME`;
+  - globs prefixed with `!` will be excluded instead of trusted.
+
+For example, this is valid:
+
+````toml
+[editor]
+# Exclude `$HOME/coding/helix/contrib` and all subdirectories.
+workspace-trust.globs = [ "!{~/coding/helix/contrib/**,~/coding/helix/contrib}" ]
+
+# Same thing, but with a smaller nesting.
+workspace-trust.globs = [ "!~/coding/helix/{contrib/**,contrib}" ]
+
+# Same, but without nesting.
+workspace-trust.globs = [ "!~/coding/helix/contrib/**", "!~/coding/helix/contrib" ]
+````

book/src/workspace-trust.md

@@ -1,3 +1,5 @@
+use helix_loader::workspace_trust::WorkspaceTrust;
+
 use crate::{
     auto_pairs::{AutoPairsRegistry, AutoPairsRegistryError},
     syntax::{
@@ -47,8 +49,8 @@ impl std::fmt::Display for LanguageLoaderError {
 impl std::error::Error for LanguageLoaderError {}
 
 /// Language configuration based on user configured languages.toml.
-pub fn user_lang_config(insecure: bool) -> Result<Configuration, toml::de::Error> {
-    helix_loader::config::user_lang_config(insecure)?.try_into()
+pub fn user_lang_config(wst: &WorkspaceTrust) -> Result<Configuration, toml::de::Error> {
+    helix_loader::config::user_lang_config(wst)?.try_into()
 }
 
 /// Load the auto-pairs registry from auto-pairs.toml.
@@ -59,8 +61,8 @@ pub fn auto_pairs_registry() -> Result<AutoPairsRegistry, LanguageLoaderError> {
 }
 
 /// Language configuration loader based on user configured languages.toml.
-pub fn user_lang_loader(insecure: bool) -> Result<Loader, LanguageLoaderError> {
-    let config_val = helix_loader::config::user_lang_config(insecure)
+pub fn user_lang_loader(wst: &WorkspaceTrust) -> Result<Loader, LanguageLoaderError> {
+    let config_val = helix_loader::config::user_lang_config(wst)
         .map_err(LanguageLoaderError::DeserializeError)?;
     let config = config_val.clone().try_into().map_err(|e| {
         if let Some(languages) = config_val.get("language").and_then(|v| v.as_array()) {

helix-core/src/config.rs

@@ -23,6 +23,8 @@ toml.workspace = true
 etcetera.workspace = true
 once_cell = "1.21"
 log = "0.4"
+parking_lot.workspace = true
+globset.workspace = true
 
 # TODO: these two should be on !wasm32 only
 

helix-loader/Cargo.toml

@@ -1,6 +1,6 @@
 use std::str::from_utf8;
 
-use crate::workspace_trust::{quick_query_workspace, TrustStatus};
+use crate::workspace_trust::{TrustStatus, WorkspaceTrust};
 
 /// Default built-in languages.toml.
 pub fn default_lang_config() -> toml::Value {
@@ -10,11 +10,12 @@ pub fn default_lang_config() -> toml::Value {
 }
 
 /// User configured languages.toml file, merged with the default config.
-pub fn user_lang_config(insecure: bool) -> Result<toml::Value, toml::de::Error> {
+pub fn user_lang_config(ws: &WorkspaceTrust) -> Result<toml::Value, toml::de::Error> {
     let global_config = crate::lang_config_file();
     let workspace_config = crate::workspace_lang_config_file();
 
-    let files = if let TrustStatus::Trusted = quick_query_workspace(insecure) {
+    let files = if TrustStatus::Trusted == ws.query_status(crate::workspace_trust::TrustType::Other)
+    {
         vec![global_config, workspace_config]
     } else {
         vec![global_config]

helix-loader/src/config.rs

@@ -11,6 +11,8 @@ use std::{
 use tempfile::TempPath;
 use tree_house::tree_sitter::Grammar;
 
+use crate::workspace_trust::WorkspaceTrust;
+
 #[cfg(target_os = "macos")]
 const DYLIB_EXTENSION: &str = "dylib";
 
@@ -195,7 +197,8 @@ pub fn build_grammars(target: Option<String>) -> Result<()> {
 // merged. The `grammar_selection` key of the config is then used to filter
 // down all grammars into a subset of the user's choosing.
 fn get_grammar_configs() -> Result<Vec<GrammarConfiguration>> {
-    let config: Configuration = crate::config::user_lang_config(false)
+    let wst = WorkspaceTrust::new_bogus();
+    let config: Configuration = crate::config::user_lang_config(&wst)
         .context("Could not parse languages.toml")?
         .try_into()?;
 
@@ -216,8 +219,8 @@ fn get_grammar_configs() -> Result<Vec<GrammarConfiguration>> {
     Ok(grammars)
 }
 
-pub fn get_grammar_names() -> Result<Option<HashSet<String>>> {
-    let config: Configuration = crate::config::user_lang_config(false)
+pub fn get_grammar_names(wst: &WorkspaceTrust) -> Result<Option<HashSet<String>>> {
+    let config: Configuration = crate::config::user_lang_config(wst)
         .context("Could not parse languages.toml")?
         .try_into()?;
 

helix-loader/src/grammar.rs

@@ -140,6 +140,11 @@ pub fn data_dir() -> PathBuf {
     path
 }
 
+pub fn home_dir() -> PathBuf {
+    let strategy = choose_base_strategy().expect("Unable to find home directory!");
+    strategy.home_dir().to_path_buf()
+}
+
 pub fn config_file() -> PathBuf {
     CONFIG_FILE.get().map(|path| path.to_path_buf()).unwrap()
 }