aboutsummaryrefslogtreecommitdiff
path: root/runtime/autoload/tar.vim
Commit message (Collapse)AuthorAge
* vim-patch:b0ce576: runtime(tar): fix lz4 extraction on non-Linux systemszeertzjq2026-06-19
| | | | | | | | | | | | | | | | | | | | Patch 9.2.0306 fixed malformed lz4 extraction commands by using "tar -I lz4" on Linux and leaving non-Linux tar implementations to auto-detect lz4 input. That still fails on systems where tar does not support either -I lz4 or automatic lz4 decompression, such as Solaris /usr/bin/tar. Keep the existing Linux path using GNU tar's "-I lz4" support. For non-Linux systems, use lz4 explicitly to decompress the archive to stdout and feed the resulting tar stream to the configured tar extraction command. This is the same style tar.vim already used for lz4 archives before patch 9.2.0306. Follow-up for vim/vim#19925 closes: vim/vim#20555 https://github.com/vim/vim/commit/b0ce576fbc7af4a33226a8d076a01aadd024a23e Co-authored-by: Vladimír Marek <vlmarek13@gmail.com>
* vim-patch:9.2.0479: [security]: runtime(tar): command injection in tar pluginzeertzjq2026-06-19
| | | | | | | | | | | | | Problem: [security]: runtime(tar): command injection in tar plugin (Christopher Lusk) Solution: Use the correct shellescape(args, 1) form for a :! command Github Advisory: https://github.com/vim/vim/security/advisories/GHSA-2fpv-9ff7-xg5w https://github.com/vim/vim/commit/3fb5e58fbc63d86a3e65f1a141b0d67af2aa38a1 Co-authored-by: Christian Brabandt <cb@256bit.org>
* vim-patch:e6a84bb: runtime(tar): missing g:tar_secure in tar#Extract() (#39123)zeertzjq2026-04-16
| | | | | https://github.com/vim/vim/commit/e6a84bb6b0e45ddb106f689054b0d96aba161f67 Co-authored-by: Christian Brabandt <cb@256bit.org>
* vim-patch:9.2.0355: runtime(tar): missing path traversal checks in ↵zeertzjq2026-04-16
| | | | | | | | | | | | | | | | | | tar#Extract() (#39095) Problem: runtime(tar): missing path traversal checks in tar#Extract() Solution: Add check for leading slash, however gnu tar should already detect this (q1uf3ng) tar#Extract() did not check for ../ sequences or absolute paths, unlike zip#Extract() which was patched in recent commits. Add the same checks: ../ (relative traversal), leading slash (Unix), drive letter and UNC/leading slash (Windows). closes: vim/vim#19981 https://github.com/vim/vim/commit/490b737f3e172c3c66744c7531ee85f19618419d Co-authored-by: q1uf3ng <q1uf3ng@protone.me>
* vim-patch:9.2.0326: runtime(tar): but with dotted pathzeertzjq2026-04-10
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Problem: runtime(tar): but with dotted path Solution: Do not strip everything after the first dot (Aaron Burrow) tar#Extract was getting the extensionless basename by stripping away everything starting with the leftmost dot. So if a directory had a dot or the file had an 'extra' dot then the code did the wrong thing. For example, if it was given: /tmp/foo.bar/baz.tar.gz Then it would treat /tmp/foo as the extensionless basename, but it actually should have grabbed: /tmp/foo.bar/baz This patch fixes the issue by instead looking at the rightmost dot(s). This bug was discovered by ChatGPT 5.4. I wrote the patch and tested vim. closes: vim/vim#19930 https://github.com/vim/vim/commit/4a1bcc67b4b6fc2dfe564ab4faca490f8afac857 Co-authored-by: Aaron Burrow <burrows@fastmail.com>
* vim-patch:9.2.0325: runtime(tar): bug in zstd handlingzeertzjq2026-04-10
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Problem: patch 9.2.0325: runtime(tar): bug in zstd handling Solution: use correct --zstd argument, separated from other arguments, rework testing framework (Aaron Burrow). The tar.vim plugin allows vim to read and manipulate zstd archives, but it had a bug that caused extraction attempts to fail. Specifically, if the archive has a .tar.zst or .tzst extension, then the code was generating invalid extraction commands that looked like this: tar --zstdpxf foo.tar.zst foo When they should be like this: tar --zstd -pxf foo.tar.zst foo This patch changes the flag manipulation logic so that --zstd isn't glued to pxf. The labor for this change was divided between ChatGPT 5.4 and me. ChatGPT 5.4 identified the issue (from a code scan?), and I wrote the patch and tested vim. related: vim/vim#19930 https://github.com/vim/vim/commit/00285c035aa7d92971bc50b7b124e1408dda53ad Note: tests need the next patch to pass in Nvim. Co-authored-by: Aaron Burrow <burrows@fastmail.com>
* vim-patch:9.2.0306: runtime(tar): some issues with lz4 support (#38826)zeertzjq2026-04-06
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Problem: runtime(tar): some issues with lz4 support Solution: Fix bugs (see below) (Aaron Burrow) The tar plugin allows users to extract files from tar archives that are compressed with lz4. But, tar#Extract() builds malformed extraction commands for lz4-compressed tar archives. This commit fixes three issues in that code. The first affects archives with a .tlz4 extension and the other two affect archives with .tar.lz4 extension (but one of these is symmetric to the issue that .tlz4 archives had). (1) When trying to extract .tlz4 archives the command created by tar#Extract looked like this: tar -I lz4pxf foo.tlz4 foo This isn't right. It should be something like this: tar -I lz4 -pxf foo.tlz4 foo This was happening because tar.plugin is just substituting on the first - in "tar -pxf". This works fine if we just add a simple flag for extraction (eg, z for .tgz), but for lz4 we need to add "-I lz4". I don't believe that there is an obvious good way to fix this without reworking the way the command is generated. Probably we should collect the command and flags separately and the flags should be stored in a set. Then put everything together into a string just before issuing it as an extraction command. Unfortunately, this might break things for users because they have access to tar_extractcmd. This patch just makes the substitution a little bit more clever so that it does the right thing when substituting on a string like "tar -pxf". (2) .tar.lz4 extractions had the same issue, which my patch fixes in the same way. (3) .tar.lz4 extractions had another issue. There was a space missing in the command generated by tar#Extract. This meant that commands looked like this (notice the lack of space between the archive and output file names): tar -I lz4pxf foo.tar.lz4foo This patch just puts a space where it should be. Finally, I should note that ChatGPT 5.4 initially identified this issue in the code and generated the test cases. I reviewed the test cases, wrote the patch, and actually ran vim against the tests (both with and without the patch). closes: vim/vim#19925 https://github.com/vim/vim/commit/78954f86c2027c766d9e2b5f7904b5fb4041d250 Co-authored-by: Aaron Burrow <burrows@fastmail.com>
* vim-patch:7ccb81b: runtime(tar): Make the path traversal detection more ↵zeertzjq2026-02-07
| | | | | | | | | robust (#37764) closes: vim/vim#19341 https://github.com/vim/vim/commit/7ccb81bdb6c5454ff801be11082775ec82a96efc Co-authored-by: Christian Brabandt <cb@256bit.org>
* vim-patch:9.1.2135: tests: tar plugin does not consider 'nowrapscan' (#37752)zeertzjq2026-02-06
| | | | | | | | | | | | | | | | | | Problem: search() is used to check for the message from tar that indicates leading slashes found in the tar archive, or to check for the leading slashes themselves. However, if 'nowrapscan' is in effect these searches are limited to the last line and don't find any results. This causes the warning message from tar to be seen in the buffer, the "Path Traversal Attack Detected" message to be omitted, and editing actions can fail. This can be seen, for example, when editing src/testdir/samples/evil.tar. Solution: Use the 'w' flag for search() (Kevin Goodsell) closes: vim/vim#19333 https://github.com/vim/vim/commit/18d844e365c21043d187f142bc88e75e9966822f Co-authored-by: Kevin Goodsell <kevin-opensource@omegacrash.net>
* vim-patch:9.1.1552: [security]: path traversal issue in tar.vimzeertzjq2025-07-18
| | | | | | | | | | | | | | | | | | | | | | | | Problem: [security]: path traversal issue in tar.vim (@ax) Solution: warn the user for such things, drop leading /, don't forcefully overwrite files when writing temporary files, refactor autoload/tar.vim tar.vim: drop leading / in path names A tar archive containing files with leading `/` may cause confusions as to where the content is extracted. Let's make sure we drop the leading `/` and use a relative path instead. Also while at it, had to refactor it quite a bit and increase the minimum supported Vim version to v9. Also add a test for some basic tar functionality closes: vim/vim#17733 https://github.com/vim/vim/commit/87757c6b0a4b2c1f71c72ea8e1438b8fb116b239 Co-authored-by: Christian Brabandt <cb@256bit.org>
* vim-patch:470317f: runtime(tar): remove dependency on netrw#WinPath, include ↵zeertzjq2025-07-18
| | | | | | | | | | mapping doc related: vim/vim#17124 https://github.com/vim/vim/commit/470317f78b110b4559cecb26039b5f93447c1bf0 Co-authored-by: Christian Brabandt <cb@256bit.org>
* vim-patch:a250738: runtime(tar): use readblob() instead of shelling out to ↵zeertzjq2025-07-18
| | | | | | | | | | | | file(1) fixes: #vim/vim#16761 closes: vim/vim#16769 https://github.com/vim/vim/commit/a250738303f85132335d69fd1936501b189eebce Co-authored-by: Christian Brabandt <cb@256bit.org> Co-authored-by: Jim Zhou <jimzhouzzy@gmail.com>
* vim-patch:719ec0f: runtime(tar): preserve pwd when reading and writing tar filesChristian Clason2025-05-20
| | | | | | | | | | | | While at it, use `:lcd` to temporarily set the window local directory instead of `:cd` for the global working directory. fixes: vim/vim#17334 closes: vim/vim#17339 https://github.com/vim/vim/commit/719ec0fe154e321bf7cf2cb2f93e8aa30036b87e Co-authored-by: Michele Sorcinelli <michelesr@autistici.org>
* vim-patch:9.1.1164: [security]: code execution with tar.vim and special ↵zeertzjq2025-03-02
| | | | | | | | | | | | | | crafted tar files (#32701) Problem: editing a special crafted tar file allows code execution (RyotaK, after 129a8446d23cd9cb4445fcfea259cba5e0487d29) Solution: escape the filename before feeding it to the `:read` command Github Advisory: https://github.com/vim/vim/security/advisories/GHSA-wfmf-8626-q3r3 https://github.com/vim/vim/commit/334a13bff78aa0ad206bc436885f63e3a0bab399 Co-authored-by: Christian Brabandt <cb@256bit.org>
* vim-patch:8ac975d: runtime(tar): fix syntax error in tar.vimChristian Clason2025-03-01
| | | | | | https://github.com/vim/vim/commit/8ac975d97e153205a82ef0177013260f59cc6a2e Co-authored-by: Christian Brabandt <cb@256bit.org>
* vim-patch:56957ed: runtime(misc): add support for bzip3 to tar, vimball and ↵Christian Clason2025-03-01
| | | | | | | | | | | gzip plugins fixes: vim/vim#16751 closes: vim/vim#16755 https://github.com/vim/vim/commit/56957ed4109fb0c37922c6c37d5926cfe0a3313b Co-authored-by: Jim Zhou <jimzhouzzy@gmail.com>
* vim-patch:b69cd52: runtime(misc): Add support for lz4 to tar & gzip plugin ↵zeertzjq2025-02-07
| | | | | | | | | | | | | | | | (#32360) while at it, clean up the tar plugin a bit and sort the patterns for the tar and gzip plugin References: - https://github.com/lz4/lz4 - https://lz4.org/ closes: vim/vim#16591 https://github.com/vim/vim/commit/b69cd52447584cedadc1513aa3acd5b4cd9f4340 Co-authored-by: Corpulent Robin <177767857+corpulentrobin@users.noreply.github.com>
* vim-patch:129a844: runtime(tar): Update tar.vim to support permissionsChristian Clason2024-11-12
| | | | | | | | | | | | | | | | | | These changes enable tar.vim to keep permissions of files that were edited intact instead of replacing them with the default permissions. The major change for this is switching from "tar -OPxf", which reads out the contents of the selected file from an tar archive to stdout to "tar -pPxf" which extracts the selected file to the current directory with permissions intact This requirs the temporary directory to be created earlier. closes: vim/vim#7379 https://github.com/vim/vim/commit/129a8446d23cd9cb4445fcfea259cba5e0487d29 Co-authored-by: Lennart00 <73488709+Lennart00@users.noreply.github.com>
* vim-patch:f9ca139e3aa1 (#27554)zeertzjq2024-02-21
| | | | | | | runtime(misc): announce adoption of various runtime files https://github.com/vim/vim/commit/f9ca139e3aa12dd03177ebba5eedcee4f0836f27 Co-authored-by: Christian Brabandt <cb@256bit.org>
* vim-patch:3a5b3df7764d (#26956)dundargoc2024-01-10
| | | | | | | | | | | | | | | | | | | | | | | | | runtime(tar): fix a few problems with the tar plugin From: vim/vim#138331: - Updating .tar.zst files was broken. Fixes vim/vim#12639. - Extracting files from .tar.zst / .tzs files was also broken and works now. From: vim/vim#12637: - Fixes variable assignment and typo From: vim/vim#8109: - Rename .tzs to the more standard .tzst fixes: vim/vim#12639 fixes: vim/vim#8105 closes: vim/vim#8109 closes: vim/vim#12637 closes: vim/vim#13831 https://github.com/vim/vim/commit/3a5b3df7764daa058a3e779183e8f38a8418b164 Co-authored-by: Christian Brabandt <cb@256bit.org> Co-authored-by: Martin Rys <martin@rys.pw> Co-authored-by: Eisuke Kawashima <e-kwsm@users.noreply.github.com> Co-authored-by: Carlo Teubner <carlo@cteubner.net>
* vim-patch:67abf1592c83Christian Clason2023-11-14
| | | | | | | | runtime(tar): comment out strange error condition check https://github.com/vim/vim/commit/67abf1592c83c910c7815478f67e0a8989d51417 Co-authored-by: Christian Brabandt <cb@256bit.org>
* vim-patch:3d37231437fcChristian Clason2023-11-05
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | runtime(tar): improve the error detection Do not rely on the fact, that the last line matches warning, error, inappropriate or unrecognized to determine if an error occurred. It could also be a file, contains such a keyword. So make the error detection slightly more strict and only assume an error occured, if in addition to those 4 keywords, also a space matches (this assumes the error message contains a space), which luckily on Unix not many files match by default. The whole if condition seems however slightly dubious. In case an error happened, this would probably already be caught in the previous if statement, since this checks for the return code of the tar program. There may however be tar implementations, that do not set the exit code for some kind of error (but print an error message)? But let's keep this check for now, not many people have noticed this behaviour until now, so it seems to work reasonably well anyhow. related: vim/vim#6425 fixes: vim/vim#13489 https://github.com/vim/vim/commit/3d37231437fc0f761664a7cabc8f7b927b468767 Co-authored-by: Christian Brabandt <cb@256bit.org>
* feat!: remove vimballs (#22402)dundargoc2023-04-11
| | | | | | | | Vimball is an outdated feature that is rarely used these days. It is not a maintenance burden on its own, but it is nonetheless dead weight and something we'd need to tell users to ignore when they inevitably ask what it is. See: https://github.com/neovim/neovim/pull/21369#issuecomment-1347615173
* vim-patch:6c391a74fe90 (#15654)Christian Clason2021-09-13
| | | | | | | | | | | Update runtime files https://github.com/vim/vim/commit/6c391a74fe90190796ca0b0c010112948a6e75d7 omit autoload/getscript.vim skip doc/eval.txt (needs 8.2.2468) skip doc/various.txt (needs 8.2.3400) (typofixes courtesy of @dundargoc)
* runtime/tar: 23515b4ef7580af8b9d3b964a558ab2007cacda5Jan Edmund Lazo2021-02-17
| | | | | | Port tar files only in order to support '*.tar.zst' files. Close https://github.com/neovim/neovim/pull/13337
* runtime/tar: 8024f936368336241406137a2fa78ed5ee9000a6Jan Edmund Lazo2021-02-17
| | | | Port tar runtime files only.
* runtime/tar: 2963456ff2b740244b3a064785fe681b1998d75eJan Edmund Lazo2021-02-17
| | | | Port tar files for release v31 only.
* vim-patch:8.1.0352: browsing compressed tar files does not always workJan Edmund Lazo2018-11-13
| | | | | | Problem: Browsing compressed tar files does not always work. Solution: Use the "file" command to get the compression type. https://github.com/vim/vim/commit/d4a1aabe372ccb95aec968f4d54503231b1f956c
* vim-patch:20aac6c11269Justin M. Keyes2018-10-29
| | | | | Update runtime files. https://github.com/vim/vim/commit/20aac6c1126988339611576d425965a25a777658
* vim-patch:fc65cabb15d0Justin M. Keyes2018-10-29
| | | | | | | | | | | | Update runtime files. https://github.com/vim/vim/commit/fc65cabb15d0236bce001ad78e12a40511caf941 --- vim-patch:8.0.1279: initializing menus can be slow Problem: Initializing menus can be slow, especially when there are many keymaps, color schemes, etc. Solution: Do the globbing for runtime files lazlily. (Ken Takata)
* vim-patch:3e496b0ea319Justin M. Keyes2017-04-28
| | | | | | | | | | | Updated runtime files. https://github.com/vim/vim/commit/3e496b0ea31996b665824f45664dee1fdd73c4d0 NA patches: vim-patch:8.0.0015 vim-patch:8.0.0016 vim-patch:177778575148
* re-integrate runtime/ vim-patch:0 #938Justin M. Keyes2014-07-29
Vim runtime files based on 7.4.384 / hg changeset 7090d7f160f7 Excluding: Amiga icons (*.info, icons/) doc/hangulin.txt tutor/ spell/ lang/ (only used for menu translations) macros/maze/, macros/hanoi/, macros/life/, macros/urm/ These were used to test vi compatibility. termcap "Demonstration of a termcap file (for the Amiga and Archimedes)" Helped-by: Rich Wareham <rjw57@cam.ac.uk> Helped-by: John <john.schmidt.h@gmail.com> Helped-by: Yann <yann@yann-salaun.com> Helped-by: Christophe Badoit <c.badoit@lesiteimmo.com> Helped-by: drasill <github@tof2k.com> Helped-by: Tae Sandoval Murgan <taecilla@gmail.com> Helped-by: Lowe Thiderman <lowe.thiderman@gmail.com>
generated by cgit (git 2.34.1) at 2026-10-19 21:25:55 +0000