| Commit message (Collapse) | Author | Age |
|---|
| |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
| |
(#40363)
Problem: [security]: possible code execution with python complete
(morningbread)
Solution: Use repr() to quote the doc strings correctly
Github Security Advisory:
https://github.com/vim/vim/security/advisories/GHSA-ppj8-wqjf-6fp3
Supported by AI
https://github.com/vim/vim/commit/cce141c42740f122dd8486ae04e21c2a81016ba8
Co-authored-by: Christian Brabandt <cb@256bit.org>
|
| |
|
|
|
|
|
|
|
|
|
|
|
|
|
| |
(#40117)
Problem: [security]: another possible code execution with python complete
(David Carliez)
Solution: Strip default expressions and annotations from generated
source for pythoncomplete and python3complete.
Github Security Advisory:
https://github.com/vim/vim/security/advisories/GHSA-65p9-mwwx-7468
https://github.com/vim/vim/commit/c8c63673bc4253212820626aeeb75999d9a539d2
Co-authored-by: Christian Brabandt <cb@256bit.org>
|
| |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
| |
effect (#40067)
Problem: The security patch 9.2.0561 added a vim.eval() call inside
Completer.evalsource() to honor g:pythoncomplete_allow_import.
But the 'vim' module is only imported inside the outer
vimcomplete() / vimpy3complete() function, not at the script's
top level, so referring to it from a Completer method raises
NameError. The surrounding bare 'except' silently swallows
the error and leaves allow_imports at 0, meaning the opt-in
never takes effect -- 'import os' (and any other
buffer-level import) is always skipped, no candidates are
produced for 'os.<...>' and
Test_popup_and_preview_autocommand() fails on the Windows
CI matrix (Linux skips the test because Python 2 is absent).
Solution: Re-import 'vim' at the top of evalsource() in both
pythoncomplete.vim and python3complete.vim so the eval reads
the global, and set g:pythoncomplete_allow_import = 1 in the
test (it is the opt-in intended for callers that trust the
buffer contents) (thinca).
closes: vim/vim#20386
https://github.com/vim/vim/commit/868ad62cb8bf8038322eab2badd31bd98b02b9df
Co-authored-by: thinca <thinca@gmail.com>
|
| |
|
|
|
|
|
|
|
|
|
|
| |
Problem: [security]: possible code execution with python3complete
Solution: Disable execution of import/from statements
Github Security Advisory:
https://github.com/vim/vim/security/advisories/GHSA-52mc-rq6p-rc7c
https://github.com/vim/vim/commit/4b850457e12e1a678dd209f2868154f7553cbf8d
Co-authored-by: Christian Brabandt <cb@256bit.org>
|
| |
|
|
|
|
|
|
|
|
|
| |
Update runtime files
https://github.com/vim/vim/commit/6c391a74fe90190796ca0b0c010112948a6e75d7
omit autoload/getscript.vim
skip doc/eval.txt (needs 8.2.2468)
skip doc/various.txt (needs 8.2.3400)
(typofixes courtesy of @dundargoc)
|
| |
|
|
|
|
|
|
| |
Update runtime files.
https://github.com/vim/vim/commit/4f4d51a942cc2c6b3e936ee0f93f00c2d000065c
Omit "??" operator.
Patches v8.2.1794,v8.2.1798 are not ported yet.
|
| |
|
|
| |
- test/README.md: document luassert `TableFormatLevel`
- CONTRIBUTING.md: absorb parts of the old "Development tips" wiki page
|
| |
|
|
|
|
|
|
|
| |
Update runtime files.
https://github.com/vim/vim/commit/a0f849ee40cbea3c889345256786b640b0becca2
Missing files runtime/doc/tags and runtime/doc/todo.txt. Excluded
runtime/syntax/vim.vim, since we diverged quite a bit from vim in this file.
|
|
|
Vim runtime files based on 7.4.384 / hg changeset 7090d7f160f7
Excluding:
Amiga icons (*.info, icons/)
doc/hangulin.txt
tutor/
spell/
lang/ (only used for menu translations)
macros/maze/, macros/hanoi/, macros/life/, macros/urm/
These were used to test vi compatibility.
termcap
"Demonstration of a termcap file (for the Amiga and Archimedes)"
Helped-by: Rich Wareham <rjw57@cam.ac.uk>
Helped-by: John <john.schmidt.h@gmail.com>
Helped-by: Yann <yann@yann-salaun.com>
Helped-by: Christophe Badoit <c.badoit@lesiteimmo.com>
Helped-by: drasill <github@tof2k.com>
Helped-by: Tae Sandoval Murgan <taecilla@gmail.com>
Helped-by: Lowe Thiderman <lowe.thiderman@gmail.com>
|
