diff options
| author | zeertzjq <zeertzjq@outlook.com> | 2025-03-13 08:47:02 +0800 |
|---|---|---|
| committer | GitHub <noreply@github.com> | 2025-03-13 08:47:02 +0800 |
| commit | b25527d20d9a5ae25f4a5e2d2d487e2eac731b2c (patch) | |
| tree | 8c2ec01ac3ecdd5e840fac67767794865debb21c /runtime/autoload | |
| parent | 90d1260cb84c917653987c0dfdfa150b617f5a0f (diff) | |
| download | rneovim-b25527d20d9a5ae25f4a5e2d2d487e2eac731b2c.tar.gz rneovim-b25527d20d9a5ae25f4a5e2d2d487e2eac731b2c.tar.bz2 rneovim-b25527d20d9a5ae25f4a5e2d2d487e2eac731b2c.zip | |
vim-patch:9.1.1198: [security]: potential data loss with zip.vim (#32867)
Problem: [security]: potential data loss with zip.vim and special
crafted zip files (RyotaK)
Solution: use glob '[-]' to protect filenames starting with '-'
Github Advisory:
https://github.com/vim/vim/security/advisories/GHSA-693p-m996-3rmf
https://github.com/vim/vim/commit/f209dcd3defb95bae21b2740910e6aa7bb940531
Co-authored-by: Christian Brabandt <cb@256bit.org>
Diffstat (limited to 'runtime/autoload')
| -rw-r--r-- | runtime/autoload/zip.vim | 6 |
1 files changed, 6 insertions, 0 deletions
diff --git a/runtime/autoload/zip.vim b/runtime/autoload/zip.vim index a8ea6a3fab..305b823e7b 100644 --- a/runtime/autoload/zip.vim +++ b/runtime/autoload/zip.vim @@ -14,6 +14,7 @@ " 2024 Aug 05 by Vim Project: clean-up and make it work with shellslash on Windows " 2024 Aug 18 by Vim Project: correctly handle special globbing chars " 2024 Aug 21 by Vim Project: simplify condition to detect MS-Windows +" 2025 Mar 11 by Vim Project: handle filenames with leading '-' correctly " License: Vim License (see vim's :help license) " Copyright: Copyright (C) 2005-2019 Charles E. Campbell {{{1 " Permission is hereby granted to use and distribute this code, @@ -342,6 +343,11 @@ fun! zip#Extract() return endif let target = fname->substitute('\[', '[[]', 'g') + " unzip 6.0 does not support -- to denote end-of-arguments + " unzip 6.1 (2010) apparently supports, it, but hasn't been released + " so the workaround is to use glob '[-]' so that it won't be considered an argument + " else, it would be possible to use 'unzip -o <file.zip> '-d/tmp' to extract the whole archive + let target = target->substitute('^-', '[&]', '') if &shell =~ 'cmd' && has("win32") let target = target \ ->substitute('[?*]', '[&]', 'g') |