mirrors/neovim
1
0
Fork 0
mirror of https://github.com/neovim/neovim.git synced 2026-07-31 04:39:07 +00:00
Code Issues Packages Projects Releases Wiki Activity

vim-patch:9.2.0840: [security]: code injection in netrw via bookmarks

Browse Source 
Problem:  [security]: code injection in netrw via bookmarks and history
          (David Carliez)
Solution: Escape the '|' explicitly (Yasuhiro Matsumoto)

The bookmark and history menu builders interpolate paths into :execute'd
:menu commands using g:netrw_menu_escape, which did not escape the Ex
command separator '|'. A crafted path could break out of the :menu command
and run arbitrary Ex/shell commands when the menu was built or triggered.

Add '|' to g:netrw_menu_escape for the menu names, escape the :e right-hand
side with fnameescape(), and quote the netrw#MakeTgt() argument with
string() instead of raw single-quote interpolation.

Github Security Advisory:
https://github.com/vim/vim/security/advisories/GHSA-rcr7-f3wr-22r2

29c6fd090d

Co-authored-by: Yasuhiro Matsumoto <mattn.jp@gmail.com>
This commit is contained in:
zeertzjq
2026-07-24 08:14:10 +08:00
parent 0a8d881537
commit 8d1f8d8dc3
1 changed files with 10 additions and 8 deletions
Download Patch File Download Diff File Expand all files Collapse all files

18
runtime/pack/dist/opt/netrw/autoload/netrw.vim vendored
View File

@@ -1,7 +1,7 @@
" Creator: Charles E Campbell
" Previous Maintainer: Luca Saccarola <github.e41mv@aleeas.com>
" Maintainer: This runtime file is looking for a new maintainer.
" Last Change: 2026 Jul 22
" Last Change: 2026 Jul 23
" Copyright: Copyright (C) 2016 Charles E. Campbell {{{1
" Permission is hereby granted to use and distribute this code,
" with or without modifications, provided that this copyright
@@ -375,7 +375,7 @@ if has("win32")
else
call s:NetrwInit("g:netrw_glob_escape",'*[]?`{~$\')
endif
call s:NetrwInit("g:netrw_menu_escape",'.&? \')
call s:NetrwInit("g:netrw_menu_escape",'.&? \|')
call s:NetrwInit("s:netrw_map_escape","<|\n\r\\\<C-V>\"")
if has("gui_running") && (&enc == 'utf-8' || &enc == 'utf-16' || &enc == 'ucs-4')
let s:treedepthstring= "│ "
@@ -3777,13 +3777,14 @@ function s:NetrwBookmarkMenu()
if exists("g:netrw_bookmarklist") && g:netrw_bookmarklist != [] && g:netrw_dirhistmax > 0
let cnt= 1
for bmd in g:netrw_bookmarklist
let bmd= escape(bmd,g:netrw_menu_escape)
let ebmd= escape(bmd,g:netrw_menu_escape)
let fbmd= escape(fnameescape(bmd),'|')
" show bookmarks for goto menu
exe 'sil! menu '.g:NetrwMenuPriority.".2.".cnt." ".g:NetrwTopLvlMenu.'Bookmarks.'.bmd.' :e '.bmd."\<cr>"
exe 'sil! menu '.g:NetrwMenuPriority.".2.".cnt." ".g:NetrwTopLvlMenu.'Bookmarks.'.ebmd.' :e '.fbmd."\<cr>"
" show bookmarks for deletion menu
exe 'sil! menu '.g:NetrwMenuPriority.".8.2.".cnt." ".g:NetrwTopLvlMenu.'Bookmarks\ and\ History.Bookmark\ Delete.'.bmd.' '.cnt."mB"
exe 'sil! menu '.g:NetrwMenuPriority.".8.2.".cnt." ".g:NetrwTopLvlMenu.'Bookmarks\ and\ History.Bookmark\ Delete.'.ebmd.' '.cnt."mB"
let cnt= cnt + 1
endfor
@@ -3799,7 +3800,8 @@ function s:NetrwBookmarkMenu()
let priority = g:netrw_dirhistcnt + histcnt
if exists("g:netrw_dirhist_{cnt}")
let histdir= escape(g:netrw_dirhist_{cnt},g:netrw_menu_escape)
exe 'sil! menu '.g:NetrwMenuPriority.".3.".priority." ".g:NetrwTopLvlMenu.'History.'.histdir.' :e '.histdir."\<cr>"
let ehistdir= escape(fnameescape(g:netrw_dirhist_{cnt}),'|')
exe 'sil! menu '.g:NetrwMenuPriority.".3.".priority." ".g:NetrwTopLvlMenu.'History.'.histdir.' :e '.ehistdir."\<cr>"
endif
let first = 0
let cnt = ( cnt - 1 ) % g:netrw_dirhistmax
@@ -7156,7 +7158,7 @@ function s:NetrwTgtMenu()
let tgtdict[bmd]= cnt
let ebmd= escape(bmd,g:netrw_menu_escape)
" show bookmarks for goto menu
exe 'sil! menu <silent> '.g:NetrwMenuPriority.".19.1.".cnt." ".g:NetrwTopLvlMenu.'Targets.'.ebmd." :call netrw#MakeTgt('".bmd."')\<cr>"
exe 'sil! menu <silent> '.g:NetrwMenuPriority.".19.1.".cnt." ".g:NetrwTopLvlMenu.'Targets.'.ebmd." :call netrw#MakeTgt(".escape(string(bmd),'|').")\<cr>"
let cnt= cnt + 1
endfor
endif
@@ -7174,7 +7176,7 @@ function s:NetrwTgtMenu()
endif
let tgtdict[histentry] = histcnt
let ehistentry = escape(histentry,g:netrw_menu_escape)
exe 'sil! menu <silent> '.g:NetrwMenuPriority.".19.2.".priority." ".g:NetrwTopLvlMenu.'Targets.'.ehistentry." :call netrw#MakeTgt('".histentry."')\<cr>"
exe 'sil! menu <silent> '.g:NetrwMenuPriority.".19.2.".priority." ".g:NetrwTopLvlMenu.'Targets.'.ehistentry." :call netrw#MakeTgt(".escape(string(histentry),'|').")\<cr>"
endif
let histcnt = histcnt + 1
endwhile