vim-patch:9.2.0299: runtime(zip): may write using absolute paths (#38810)

Problem:  runtime(zip): may write using absolute paths
          (syndicate)
Solution: Detect this case and abort on Unix, warn in the documentation
          about possible issues

46f530e517

Co-authored-by: Christian Brabandt <cb@256bit.org>
(cherry picked from commit 4aa8969d29)
This commit is contained in:
zeertzjq
2026-04-06 10:15:19 +08:00
committed by github-actions[bot]
parent f92a68d4bc
commit bf084967d7
4 changed files with 31 additions and 0 deletions

Binary file not shown.

View File

@@ -297,3 +297,22 @@ func Test_zip_fname_evil_path2()
call assert_match('zipfile://.*::.*tmp/foobar', @%)
bw!
endfunc
func Test_zip_fname_evil_path3()
CheckNotMSWindows
" needed for writing the zip file
CheckExecutable zip
call s:CopyZipFile("evil.zip")
defer delete("X.zip")
e X.zip
:1
let fname = 'payload.txt'
call search('\V' .. fname)
exe "normal \<cr>"
:w!
let mess = execute(':mess')
call assert_match('Path Traversal Attack', mess)
bw!
endfunc