micro-editor / micro-editor/micro
Feature request: Plugin permission system
Nobody has claimed this yet.
- Dominant language
- Go
- Stars
- 29.6k
- Forks
- 1.4k
- Avg merge
- 2d 18h
- Merged PRs (30d)
- 10
Description
Plugin permission system
Problem:
All of the plugins you install have access to the entire file system available to the current user through io.open().
Suggested solution:
Remove some lua APIs for all plugins by default, and make them opt-in for an extra layer of security. This could enhance security for possible third party plug-in repos.
Contributor guide
No contributing guide indexed for this repository
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start by tracing how plugins expose Lua APIs, especially io.open(), and identify where the default API surface is defined. The issue does not name files or tests; done would require a decided permission model in which sensitive APIs are restricted by default and explicitly opt-in for plugins.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- go, lua
- Domain
- security
- Issue type
- Feature
- Difficulty
- 5/5
- Estimated time
- Over a week
- Activity status
- Stale
- Clarity
- Needs clarification
- Newbie friendliness
- 25/100