diff options
| author | zeertzjq <zeertzjq@outlook.com> | 2026-07-24 08:14:10 +0800 |
|---|---|---|
| committer | zeertzjq <zeertzjq@outlook.com> | 2026-07-24 08:14:20 +0800 |
| commit | 8d1f8d8dc3d65d2b8b6cf2925b6f13706d29b95e (patch) | |
| tree | 0e771b8cffe1e9798d19391c0d5dadf2a68ee0fd /runtime/syntax/python.vim | |
| parent | 0a8d88153752543cfd3afc3eff6e7aee49730b53 (diff) | |
| download | rneovim-8d1f8d8dc3d65d2b8b6cf2925b6f13706d29b95e.tar.gz rneovim-8d1f8d8dc3d65d2b8b6cf2925b6f13706d29b95e.tar.bz2 rneovim-8d1f8d8dc3d65d2b8b6cf2925b6f13706d29b95e.zip | |
vim-patch:9.2.0840: [security]: code injection in netrw via bookmarks
Problem: [security]: code injection in netrw via bookmarks and history
(David Carliez)
Solution: Escape the '|' explicitly (Yasuhiro Matsumoto)
The bookmark and history menu builders interpolate paths into :execute'd
:menu commands using g:netrw_menu_escape, which did not escape the Ex
command separator '|'. A crafted path could break out of the :menu command
and run arbitrary Ex/shell commands when the menu was built or triggered.
Add '|' to g:netrw_menu_escape for the menu names, escape the :e right-hand
side with fnameescape(), and quote the netrw#MakeTgt() argument with
string() instead of raw single-quote interpolation.
Github Security Advisory:
https://github.com/vim/vim/security/advisories/GHSA-rcr7-f3wr-22r2
https://github.com/vim/vim/commit/29c6fd090d4520592f8be7d9ec81190edf25ef69
Co-authored-by: Yasuhiro Matsumoto <mattn.jp@gmail.com>
Diffstat (limited to 'runtime/syntax/python.vim')
0 files changed, 0 insertions, 0 deletions