From 8787b8b9b6a3c745905cd11ba93205e8da9697ed Mon Sep 17 00:00:00 2001 From: Barrett Ruth Date: Fri, 31 Jul 2026 23:52:00 -0500 Subject: [PATCH] fix(zip): do not run unzip from the current directory Problem: Windows searches the current directory before $PATH, so opening an archive in a directory that also contains an `unzip` executable runs that one. The legacy plugin refused this; the port dropped the check. Solution: Refuse to run `unzip` when it resolves to the current directory. --- runtime/lua/nvim/zip.lua | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/runtime/lua/nvim/zip.lua b/runtime/lua/nvim/zip.lua index c1f12689d7..47f7da80ec 100644 --- a/runtime/lua/nvim/zip.lua +++ b/runtime/lua/nvim/zip.lua @@ -10,6 +10,11 @@ local function unzip() if command == '' then return nil, 'unzip executable not found' end + -- Windows searches the current directory before $PATH, so an archive could be opened with an + -- `unzip` shipped next to it. + if vim.fs.dirname(vim.fs.normalize(command)) == vim.fs.normalize(vim.fn.getcwd()) then + return nil, 'refusing to run unzip from the current directory' + end return command end