diff options
| author | zeertzjq <zeertzjq@outlook.com> | 2025-07-16 09:08:57 +0800 |
|---|---|---|
| committer | GitHub <noreply@github.com> | 2025-07-16 01:08:57 +0000 |
| commit | 5cfdd4d8b9016de84c0aa9fff7f2073b99f90f47 (patch) | |
| tree | ed2d9490c042e4229ab41d5d0f3a5b4e300a2cbe /runtime/syntax/python.vim | |
| parent | 9789a3b854d7f670dd231bdffe1bce0098509539 (diff) | |
| download | rneovim-5cfdd4d8b9016de84c0aa9fff7f2073b99f90f47.tar.gz rneovim-5cfdd4d8b9016de84c0aa9fff7f2073b99f90f47.tar.bz2 rneovim-5cfdd4d8b9016de84c0aa9fff7f2073b99f90f47.zip | |
vim-patch:9.1.1551: [security]: path traversal issue in zip.vim (#34951)
Problem: [security]: path traversal issue in zip.vim (@ax)
Solution: drop leading ../ on write of zipfiles, don't forcefully
overwrite existing files
A zip plugin which contains filenames with leading '../' may cause
confusion as to where the content will be extracted. Let's drop such
things and make sure we use a relative filename instead and don't
forcefully overwrite temporary files. Also, warn the user of such
things.
related: vim/vim#17733
https://github.com/vim/vim/commit/586294a04179d855c3d1d4ee5ea83931963680b8
vim-patch:e1044fb: runtime(zip): raise minimum Vim version to v9.0
vim-patch:e2d9b0d: runtime(zip): zip plugin does not work with Vim 9.0
Co-authored-by: Christian Brabandt <cb@256bit.org>
Diffstat (limited to 'runtime/syntax/python.vim')
0 files changed, 0 insertions, 0 deletions