mirrors/neovim
1
0
Fork 0
mirror of https://github.com/neovim/neovim.git synced 2025-10-03 08:28:34 +00:00
Code Issues Packages Projects Releases Wiki Activity

vim-patch:9.1.1802: 'nowrap' in a modeline may hide malicious code (#35946)

Browse Source 
Problem:  'nowrap' in a modeline may hide malicious code.
Solution: Forcibly use '>' as 'listchars' "extends" if 'nowrap' was set
          from a modeline (zeertzjq).

Manual `:setlocal nowrap` disables this behavior.  There is a separate
problem with `:set nowrap` that also applies to some other options.

related: vim/vim#18214
related: vim/vim#18399
closes: vim/vim#18425

9d5208a931

Cherry-pick some test_modeline.vim changes from patches 9.0.{0363,0626}.
This commit is contained in:
zeertzjq
2025-09-29 07:48:46 +08:00
committed by GitHub
parent fcf752476a
commit 0fa0717d4e
7 changed files with 89 additions and 12 deletions
Download Patch File Download Diff File Expand all files Collapse all files

5
runtime/doc/options.txt
View File

@@ -7639,6 +7639,11 @@ A jump table for the options with a short description can be found at |Q_op|.
< See 'sidescroll', 'listchars' and |wrap-off|.
This option can't be set from a |modeline| when the 'diff' option is
on.
If 'nowrap' was set from a |modeline| or in the |sandbox|, '>' is used
as the |lcs-extends| character regardless of the value of the 'list'
and 'listchars' options. This is to prevent malicious code outside
the viewport from going unnoticed. Use `:setlocal nowrap` manually
afterwards to disable this behavior.
*'wrapmargin'* *'wm'*
'wrapmargin' 'wm' number (default 0)

5
runtime/lua/vim/_meta/options.lua generated
View File

@@ -8408,6 +8408,11 @@ vim.go.wiw = vim.go.winwidth
--- See 'sidescroll', 'listchars' and `wrap-off`.
--- This option can't be set from a `modeline` when the 'diff' option is
--- on.
--- If 'nowrap' was set from a `modeline` or in the `sandbox`, '>' is used
--- as the `lcs-extends` character regardless of the value of the 'list'
--- and 'listchars' options. This is to prevent malicious code outside
--- the viewport from going unnoticed. Use `:setlocal nowrap` manually
--- afterwards to disable this behavior.
---
--- @type boolean
vim.o.wrap = true