mirror of
https://github.com/neovim/neovim.git
synced 2026-07-20 16:11:58 +00:00
vim-patch:9.2.0299: runtime(zip): may write using absolute paths (#38810)
Problem: runtime(zip): may write using absolute paths
(syndicate)
Solution: Detect this case and abort on Unix, warn in the documentation
about possible issues
46f530e517
Co-authored-by: Christian Brabandt <cb@256bit.org>
(cherry picked from commit 4aa8969d29)
This commit is contained in:
committed by
github-actions[bot]
parent
f92a68d4bc
commit
bf084967d7
Binary file not shown.
@@ -297,3 +297,22 @@ func Test_zip_fname_evil_path2()
|
||||
call assert_match('zipfile://.*::.*tmp/foobar', @%)
|
||||
bw!
|
||||
endfunc
|
||||
|
||||
func Test_zip_fname_evil_path3()
|
||||
CheckNotMSWindows
|
||||
" needed for writing the zip file
|
||||
CheckExecutable zip
|
||||
|
||||
call s:CopyZipFile("evil.zip")
|
||||
defer delete("X.zip")
|
||||
e X.zip
|
||||
|
||||
:1
|
||||
let fname = 'payload.txt'
|
||||
call search('\V' .. fname)
|
||||
exe "normal \<cr>"
|
||||
:w!
|
||||
let mess = execute(':mess')
|
||||
call assert_match('Path Traversal Attack', mess)
|
||||
bw!
|
||||
endfunc
|
||||
|
||||
Reference in New Issue
Block a user