Request: Sanitize INI files

[theypsilon]

There is a security concern with current INI files importing, because thay can run arbitrary code. If some inexperienced user ends up with an INI file from a hacker, it could lead to compromise the whole system.

There are ways to sanitize INI files. My preferred solution would be to use a proper config parser like the one provided by python. Here is an example of how that would work: https://gist.github.com/theypsilon/128b02a14c741149c204a3f937ad9057

There will be the problem that variable resolution wouldn't be possible in that context. Maybe a solution for that could be doing a replace first for the sake of backwards compatibility. But I would deprecate the use of variables in INI files as is not standard and not very useful either.

[theypsilon]

Maybe this answer could be even better: https://stackoverflow.com/a/28794976/1207998