From 39cb4bd48b110b1b7545a1b2f34bab1d6e883bf9 Mon Sep 17 00:00:00 2001
From: Tom Fitzhenry <tom@tom-fitzhenry.me.uk>
Date: Wed, 15 May 2024 21:49:40 +1000
Subject: [PATCH] less: introduce withSecure flag

`--with-secure` is a hardening compile flag to disable potentially
dangerous commands within less(1).

References:

* https://man7.org/linux/man-pages/man1/less.1.html#SECURITY
* https://seclists.org/fulldisclosure/2014/Nov/74
---
 pkgs/by-name/le/less/package.nix | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/pkgs/by-name/le/less/package.nix b/pkgs/by-name/le/less/package.nix
index f7791a2636eb..326e4e2df017 100644
--- a/pkgs/by-name/le/less/package.nix
+++ b/pkgs/by-name/le/less/package.nix
@@ -4,6 +4,7 @@
 , fetchpatch
 , ncurses
 , pcre2
+, withSecure ? false
 }:
 
 stdenv.mkDerivation (finalAttrs: {
@@ -37,7 +38,7 @@ stdenv.mkDerivation (finalAttrs: {
     # Look for 'sysless' in /etc.
     "--sysconfdir=/etc"
     "--with-regex=pcre2"
-  ];
+  ] ++ lib.optional withSecure "--with-secure";
 
   meta = {
     homepage = "https://www.greenwoodsoftware.com/less/";