mirrors/neovim
1
0
Fork 0
mirror of https://github.com/neovim/neovim.git synced 2026-07-24 01:40:41 +00:00
Code Issues Packages Projects Releases Wiki Activity

vim-patch:9.2.0699: [security]: possible code execution with python complete (#40363)

Browse Source 
Problem:  [security]: possible code execution with python complete
          (morningbread)
Solution: Use repr() to quote the doc strings correctly

Github Security Advisory:
https://github.com/vim/vim/security/advisories/GHSA-ppj8-wqjf-6fp3

Supported by AI

cce141c427

Co-authored-by: Christian Brabandt <cb@256bit.org>
This commit is contained in:
zeertzjq
2026-06-22 10:26:37 +08:00
committed by GitHub
parent e59684318e
commit 7d0adc08f7
3 changed files with 25 additions and 8 deletions
Download Patch File Download Diff File Expand all files Collapse all files

9
runtime/autoload/pythoncomplete.vim
View File

@@ -2,7 +2,7 @@
" Maintainer: <vacancy>
" Previous Maintainer: Aaron Griffin <aaronmgriffin@gmail.com>
" Version: 0.10
" Last Updated: 2026 Jun 04
" Last Updated: 2026 Jun 21
"
" Changes
" TODO:
@@ -20,6 +20,7 @@
" previous code passed buffer-supplied expressions to exec() which
" Python evaluates at definition time, allowing arbitrary code
" execution via crafted def/class headers
" * use repr() on doc strings to prevent code execution
"
" v 0.9
" * Fixed docstring parsing for classes and functions
@@ -353,7 +354,7 @@ class Scope(object):
def get_code(self):
str = ""
if len(self.docstr) > 0: str += '"""'+self.docstr+'"""\n'
if len(self.docstr) > 0: str += repr(self.docstr)+'\n'
str += 'class _PyCmplNoType:\n def __getattr__(self,name):\n return None\n'
for sub in self.subscopes:
str += sub.get_code()
@@ -396,7 +397,7 @@ class Class(Scope):
if _DOTTED_NAME_RE.match(s.strip())]
if len(safe_supers) > 0: str += '(%s)' % ','.join(safe_supers)
str += ':\n'
if len(self.docstr) > 0: str += self.childindent()+'"""'+self.docstr+'"""\n'
if len(self.docstr) > 0: str += self.childindent()+repr(self.docstr)+'\n'
if len(self.subscopes) > 0:
for s in self.subscopes: str += s.get_code()
else:
@@ -419,7 +420,7 @@ class Function(Scope):
safe_params = [p for p in safe_params if p]
str = "%sdef %s(%s):\n" % \
(self.currentindent(),self.name,','.join(safe_params))
if len(self.docstr) > 0: str += self.childindent()+'"""'+self.docstr+'"""\n'
if len(self.docstr) > 0: str += self.childindent()+repr(self.docstr)+'\n'
str += "%spass\n" % self.childindent()
return str