micro-editor / micro-editor/micro
Option to disable plugins
Nobody has claimed this yet.
- Dominant language
- Go
- Stars
- 29.6k
- Forks
- 1.4k
- Avg merge
- 2d 18h
- Merged PRs (30d)
- 10
Description
Description
Currently, there doesn't appear to be any way to completely disable the loading of plugins. Individual plugins can be disabled, but there is no way to force micro to only run its own self-contained code.
Since plugins are loaded from the user-writeable ~/.config/micro folder, any process which can write into that folder could inject a plugin. This could be a concern in security sensitive contexts. Preventing this would be a significant attack surface reduction.
I am aware this would likely mean disabling the builtin extensions as well. I am fine with this.
Edit: Of course, this would need to be configurable somewhere that's not user-writeable, for obvious reasons... perhaps a separate config file in /etc/micro would be best. Would be good for other security related options like autosu, and would allow global configuration in multi-user setups as well.
Contributor guide
No contributing guide indexed for this repository
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start by tracing how plugins are loaded from ~/.config/micro and how configuration is currently handled. Evaluate a non-user-writable configuration location such as /etc/micro, including the stated impact on builtin extensions and multi-user setups. Done means a documented, enforceable way to run micro without loading plugins.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- go
- Domain
- cli, security
- Issue type
- Feature
- Difficulty
- 5/5
- Estimated time
- Over a week
- Activity status
- Quiet
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100