diff options
| author | zeertzjq <zeertzjq@outlook.com> | 2026-06-22 10:26:37 +0800 |
|---|---|---|
| committer | GitHub <noreply@github.com> | 2026-06-22 02:26:37 +0000 |
| commit | 7d0adc08f76743f991c769f25b98980ade498a64 (patch) | |
| tree | a96701f5c4f54e47d72e251f51e69c5475b72fce /runtime/autoload/pythoncomplete.vim | |
| parent | e59684318e766600e39ba217fdfa67392a6eab09 (diff) | |
| download | rneovim-7d0adc08f76743f991c769f25b98980ade498a64.tar.gz rneovim-7d0adc08f76743f991c769f25b98980ade498a64.tar.bz2 rneovim-7d0adc08f76743f991c769f25b98980ade498a64.zip | |
vim-patch:9.2.0699: [security]: possible code execution with python complete (#40363)
Problem: [security]: possible code execution with python complete
(morningbread)
Solution: Use repr() to quote the doc strings correctly
Github Security Advisory:
https://github.com/vim/vim/security/advisories/GHSA-ppj8-wqjf-6fp3
Supported by AI
https://github.com/vim/vim/commit/cce141c42740f122dd8486ae04e21c2a81016ba8
Co-authored-by: Christian Brabandt <cb@256bit.org>
Diffstat (limited to 'runtime/autoload/pythoncomplete.vim')
| -rw-r--r-- | runtime/autoload/pythoncomplete.vim | 9 |
1 files changed, 5 insertions, 4 deletions
diff --git a/runtime/autoload/pythoncomplete.vim b/runtime/autoload/pythoncomplete.vim index 8428d53cee..fa5816fdba 100644 --- a/runtime/autoload/pythoncomplete.vim +++ b/runtime/autoload/pythoncomplete.vim @@ -2,7 +2,7 @@ " Maintainer: <vacancy> " Previous Maintainer: Aaron Griffin <aaronmgriffin@gmail.com> " Version: 0.10 -" Last Updated: 2026 Jun 04 +" Last Updated: 2026 Jun 21 " " Changes " TODO: @@ -20,6 +20,7 @@ " previous code passed buffer-supplied expressions to exec() which " Python evaluates at definition time, allowing arbitrary code " execution via crafted def/class headers +" * use repr() on doc strings to prevent code execution " " v 0.9 " * Fixed docstring parsing for classes and functions @@ -353,7 +354,7 @@ class Scope(object): def get_code(self): str = "" - if len(self.docstr) > 0: str += '"""'+self.docstr+'"""\n' + if len(self.docstr) > 0: str += repr(self.docstr)+'\n' str += 'class _PyCmplNoType:\n def __getattr__(self,name):\n return None\n' for sub in self.subscopes: str += sub.get_code() @@ -396,7 +397,7 @@ class Class(Scope): if _DOTTED_NAME_RE.match(s.strip())] if len(safe_supers) > 0: str += '(%s)' % ','.join(safe_supers) str += ':\n' - if len(self.docstr) > 0: str += self.childindent()+'"""'+self.docstr+'"""\n' + if len(self.docstr) > 0: str += self.childindent()+repr(self.docstr)+'\n' if len(self.subscopes) > 0: for s in self.subscopes: str += s.get_code() else: @@ -419,7 +420,7 @@ class Function(Scope): safe_params = [p for p in safe_params if p] str = "%sdef %s(%s):\n" % \ (self.currentindent(),self.name,','.join(safe_params)) - if len(self.docstr) > 0: str += self.childindent()+'"""'+self.docstr+'"""\n' + if len(self.docstr) > 0: str += self.childindent()+repr(self.docstr)+'\n' str += "%spass\n" % self.childindent() return str |