diff options
| author | zeertzjq <zeertzjq@outlook.com> | 2026-07-25 06:20:48 +0800 |
|---|---|---|
| committer | zeertzjq <zeertzjq@outlook.com> | 2026-07-25 06:23:13 +0800 |
| commit | 72b2c713ea79ee4abcd6b3d32f735f39f46d0fdf (patch) | |
| tree | 52154741153888559ed29d4cb43b36d3bd498e3a /runtime/syntax/python.vim | |
| parent | a99d0c681008a2c1c694780a8685cceda35662eb (diff) | |
| download | rneovim-72b2c713ea79ee4abcd6b3d32f735f39f46d0fdf.tar.gz rneovim-72b2c713ea79ee4abcd6b3d32f735f39f46d0fdf.tar.bz2 rneovim-72b2c713ea79ee4abcd6b3d32f735f39f46d0fdf.zip | |
vim-patch:9.2.0845: [security]: arbitrary Ex command execution during C omni-completion
Problem: [security]: arbitrary Ex command execution during C
omni-completion (Threonine)
Solution: Match tags typeref literally to block Ex command injection
(Yasuhiro Matsumoto).
Escaping only "/" and "\" left the typeref able to break out of the
:vimgrep pattern without a "/": an unclosed "[" makes vimgrep's pattern
skipping fail, and the parser then treats a following "|" as a command
separator, so the tag value runs as Ex commands during C omni-completion.
Match the field literally with \V so no regex metacharacter can affect
pattern parsing.
Github Security Advisory:
https://github.com/vim/vim/security/advisories/GHSA-cx73-phcg-3j5g
https://github.com/vim/vim/commit/2f628d8104958fa7421664f792ca6d4f7a39a10f
Co-authored-by: Yasuhiro Matsumoto <mattn.jp@gmail.com>
Diffstat (limited to 'runtime/syntax/python.vim')
0 files changed, 0 insertions, 0 deletions