From 45bb1757bf7a3c47aef4d6898e9a28218bc80e6c Mon Sep 17 00:00:00 2001 From: James McCoy Date: Sat, 22 Jun 2019 21:13:01 -0400 Subject: vim-patch:8.1.1365: source command doesn't check for the sandbox Problem: Source command doesn't check for the sandbox. (Armin Razmjou) Solution: Check for the sandbox when sourcing a file. https://github.com/vim/vim/commit/53575521406739cf20bbe4e384d88e7dca11f040 --- src/nvim/getchar.c | 7 +++++++ src/nvim/testdir/test_source.vim | 10 ++++++++++ 2 files changed, 17 insertions(+) create mode 100644 src/nvim/testdir/test_source.vim (limited to 'src') diff --git a/src/nvim/getchar.c b/src/nvim/getchar.c index 44e4e09486..d4154a3748 100644 --- a/src/nvim/getchar.c +++ b/src/nvim/getchar.c @@ -1253,6 +1253,13 @@ openscript ( EMSG(_(e_nesting)); return; } + + // Disallow sourcing a file in the sandbox, the commands would be executed + // later, possibly outside of the sandbox. + if (check_secure()) { + return; + } + if (ignore_script) /* Not reading from script, also don't open one. Warning message? */ return; diff --git a/src/nvim/testdir/test_source.vim b/src/nvim/testdir/test_source.vim new file mode 100644 index 0000000000..42ac0c4d0f --- /dev/null +++ b/src/nvim/testdir/test_source.vim @@ -0,0 +1,10 @@ +" Tests for the :source command. + +func Test_source_sandbox() + new + call writefile(["Ohello\"], 'Xsourcehello') + source! Xsourcehello | echo + call assert_equal('hello', getline(1)) + call assert_fails('sandbox source! Xsourcehello', 'E48:') + bwipe! +endfunc -- cgit