Problem:
`:edit <dir>` and `nvim <dir>` currently rely on netrw to show local directory
contents.
Solution:
- Provide `filetype=directory`.
- Introduce dir.lua, a small plugin that provides directory listing, opening
items, parent navigation, and refresh.
- `netrw` remains available for `:Explore`, remote paths, archives, and file
operations. To continue
Co-authored-by: Justin M. Keyes <justinkz@gmail.com>
Problem: [security]: s:NetrwLocalRmFile() escapes only the backslash in
the file name before passing it to :execute, so a name
containing "|" injects arbitrary Ex commands when the file is
deleted (cipher-creator)
Solution: Use fnameescape() to correctly escape the file name
(Yasuhiro Matsumoto).
Github Security Advisory:
https://github.com/vim/vim/security/advisories/GHSA-vhh8-v6wx-hjjh
Supported by AI
55bc757a5d
Co-authored-by: Yasuhiro Matsumoto <mattn.jp@gmail.com>
Problem: unmarking a regular file when there are directories in the markings
list also removes the 2match highlight from those directories.
Solution: correctly rebuild the match pattern from the remaining markings,
using the right regex trailer for each entry in the list.
closes: vim/vim#20461affd4b5964
Co-authored-by: J. Paulo Seibt <jpseibt@gmail.com>
Problem: To goto or delete a bookmark, one needs to prefix a count
for the bookmark number (e.g., "2gb" to open bookmark#2).
As the bookmark list gets or deletes entries, the numbers
keep changing, requiring listing the bookmarks with qb to
discover the desired bookmark number. Typing gb or mB
without a count targets g:netrw_bookmarklist[-1].
Solution: If no count is given to gb or mB, list all bookmarks and
prompt for a number using inputlist(), similar to tag jump
with g].
closes: vim/vim#2021135b767a090
Co-authored-by: J. Paulo Seibt <jpseibt@gmail.com>
Problem: runtime(netrw): command injection possible via crafted
directory names in NetrwMaps() (Christopher Lusk)
Solution: Temporarily remove B flag in NetrwMaps() to prevent command
injection
8e41c34aba
Co-authored-by: Christian Brabandt <cb@256bit.org>
Problem: the bookmarks list can have duplicate entries, more often
in win32 (due to mixed slashes and capitalization) and when
g:netrw_keepdir=0 (which could introduce relative paths).
Duplicate entries could be: C:\foo\BAR\baz.file
c:\foo\bar\baz.file
c:/foo\BAR/baz.file
BAR/baz.file
Solution: Normalize the paths and make sure they are always absolute
(J. Paulo Seibt).
closes: vim/vim#2019474019bea8c
Co-authored-by: J. Paulo Seibt <jpseibt@gmail.com>
Problem: runtime(netrw): bookmarking directory uses current dir
Solution: Correctly handle netrw actual directory (J. Paulo Seibt)
fixes: vim/vim#10481closes: vim/vim#20169ec76ac620b
Co-authored-by: J. Paulo Seibt <jpseibt@gmail.com>
Problem: off-by-one bug in s:NetrwUnMarkFile()
Solution: Correctly loop through all buffers to unlet all variables
(J. Paulo Seibt)
When the function loops through buffers to clear s:netrwmarkfilelist_#
and s:netrwmarkfilemtch_#, it skips the last one at bufnr('$'), messing
up mark highlights and causing other functions that operate on those
arrays (like delete or rename) to target stale marked files.
The bufnr() help page says that bufnr("$") returns the highest buffer
number of existing buffers, so while ibuf < bufnr("$") does not clear
the last buffer-local arrays.
To reproduce:
Just opening a fresh Vim and running :Ex opens a netrw buffer at the
highest number. Then, typing mu after marking some files triggers the
mark highlight bug, and finally typing D would act like calling the
delete function against the previous marked files, as the buffer-local
arrays where not touched by s:NetrwUnMarkFile.
closes: vim/vim#201297ccc273a4c
Co-authored-by: J. Paulo Seibt <jpseibt@gmail.com>
Problem: runtime(netrw): ~ note expanded on MS Windows
(Tom Vamvanij)
Solution: Expand ~ on MS Windows (Yasuhiro Matsumoto)
On Windows, ":Explore ~" did nothing because the tilde expansion was
gated to Unix/Cygwin only. Additionally, substitute() interprets
backslashes in the replacement string specially (e.g. \U as a case
modifier), which would corrupt $HOME values like C:\Users\name even
if the branch were taken.
Include has("win32") in the guard, anchor the pattern to the start of
the string, and escape backslashes, ampersands and tildes in $HOME
before substituting.
fixes: vim/vim#20003closes: vim/vim#20014723c0acf25
Co-authored-by: Yasuhiro Matsumoto <mattn.jp@gmail.com>
Problem: runtime(netrw): RFC2396 decoding double escaping spaces
(lilydjwg, after 3e60f03d942d6bb0f7eac)
Solution: Remove escape() call, since we are using fnameescape() anyhow
fixes: vim/vim#19913ab4ebb62ee
Co-authored-by: Christian Brabandt <cb@256bit.org>
Problem: netrw: does not take port into account in hostname validation
(after v9.2.0073)
Solution: Update hostname validation check and test for an optional port
number (Miguel Barro)
closes: vim/vim#19533a6198523fb
Co-authored-by: Miguel Barro <miguel.barro@live.com>
Problem: [security]: Insufficient validation of hostname and port in
netrw URIs allows command injection via shell metacharacters
(ehdgks0627, un3xploitable).
Solution: Implement stricter RFC1123 hostname and IP validation.
Use shellescape() for the provided hostname and port.
Github Advisory:
https://github.com/vim/vim/security/advisories/GHSA-m3xh-9434-g33679348dbbc0
Co-authored-by: Christian Brabandt <cb@256bit.org>
Problem: netrw: need better tests for absolute paths
Solution: Use absolutepath(), instead of regex test (Miguel Barro).
closes: vim/vim#19477bd1dc5b1a6
Cherry-pick a typo fix from latest Vim.
Co-authored-by: Miguel Barro <miguel.barro@live.com>
Problem:
Non-trivial to write output of vim.net.request to buffer. Requires extra
code in plugin/net.lua which can't be reused by other plugin authors.
```
vim.net.request('https://neovim.io', {}, function(err, res)
if not err then
local buf = vim.api.nvim_create_buf(true, false)
if res then
local lines = vim.split(res.body, '\n', { plain = true })
vim.api.nvim_buf_set_lines(buf, 0, -1, true, lines)
end
end
end)
```
Solution:
Accept an optional `outbuf` argument to indicate the buffer to write output
to, similar to `outpath`.
vim.net.request('https://neovim.io', { outbuf = buf })
Other fixes / followups:
- Make plugin/net.lua smaller
- Return objection with close() method
- vim.net.request.Opts class
- vim.validate single calls
- Use (''):format(...) instead of `..`
Problem: When using netrw to navigate directories, vim immediately
creates, then deletes a swap file in the entered directory,
causing the lastModifiedTime of that directory to change.
Solution: Use the :noswapfile command modifier in s:NetrwEditFile()
fixes: vim/vim#188544e2aafddbb
Co-authored-by: Christian Brabandt <cb@256bit.org>
Problem: When Vim is launched with a UNC directory, netrw treats it as a
relative path and compose it again.
Solution: This is due to `exists("g:netrw_cygwin")` always being true.
We can directly use `g:netrw_cygwin`.
closes: vim/vim#19015538da34ad3
Co-authored-by: tao <2471314@gmail.com>
Problem: runtime(netrw): LocalBrowseCheck() wipes unnamed buffers when
g:netrw_fastbrowse=0 (Carlos Falgueras García)
Solution: Check that bufname() is not empty
fixes: vim/vim#18740closes: vim/vim#18741384685fade
Co-authored-by: Christian Brabandt <cb@256bit.org>
Problem: Changing permissions fail when using `gp` if the file under
the cursor is not in the current working directory.
Solution: Use the already available `a:curdir` argument and prepend it
to the `<cfile>`, so that the path of the file is correct.
This commit also refactors some leftover `netrw#ErrorMsg` to
`netrw#msg#Notify` (the main refactoring was done in
f5e3b5c04f85b0f69cd2aae81e4938cfb191a790).
closes: vim/vim#18674fe71c56d8f
Co-authored-by: Mohammad Reza Karimi <m.r.karimi.j@gmail.com>
Problem: username parsing bug in netrw plugin when using remote adding
feature
Solution: Allow any characters except for "@" (Václav Kobera), add a
test for the netrw plugin
closes: vim/vim#18611f17f78c557
Co-authored-by: Václav Kobera <vasekobera@gmail.com>
There are really two issues solved here:
- The directory listing was not populating the new buffer when using
the :Explore command. This was because the directory to open is
determined by using expand("%:p") which includes '!/running/command' at
the end of the string in terminal buffers.
- The :Explore command should replace the buffer, not split it. This
because the Explore command will automatically split if the current
buffer has been modified. According to the docs, all terminal buffers
will have the modified flag set when a job is running.
fixes: vim/vim#9862closes: vim/vim#1806953466887f7
Co-authored-by: Jason Long <jasonlongball@gmail.com>
This change includes the following upstream commits:
- fix: remove black lines in directory listing
- fix: correctly create new file when using Lexplore
- refactor: remove print functionality
The main highlight is removing print functionality that was broken both
in neovim and vim.
closes: vim/vim#178470bda7830ac
Co-authored-by: Luca Saccarola <github.e41mv@aleeas.com>
relevant commits:
- refactor: cleanup netrw#BrowseX
- fix: correctly handle symlinks in treeview
- chore: add minimalrc for reproducing issues
- refactor: simplify s:NetrwInit with the 'newer' assignment syntax
- refactor: remove balloon functionality
- Tune local file listing especially for Windows network drives
- interim fix for browse open with multiple windows
closes: vim/vim#17616ef925556cb
Co-authored-by: Luca Saccarola <github.e41mv@aleeas.com>
