Fix CVE-2026-59856: potential command execution in PHP omni-completion
Backport upstream commit 43afc581a37a to fix CVE-2026-59856,
a potential arbitrary command execution vulnerability in the
PHP omni-completion plugin. The fix uses string() for safe
quoting of the class name before inserting it into the
search() pattern run via win_execute() in phpcomplete.vim,
preventing command injection via crafted PHP files. A new
test file (test_plugin_phpcomplete.vim) verifies the fix.
CVE: CVE-2026-59856
Upstream patches:
- 43afc581a3.patch
Resolves: RHEL-201124
This commit was backported by Ymir, a Red Hat Enterprise Linux software maintenance AI agent.
Assisted-by: Ymir
This commit is contained in:
RHEL Packaging Agent
parent
f938f4060d
commit
5fbbd1ab81
@ -0,0 +1,96 @@
|
||||
From 3175a11065e839a9b30839aff25eaa23d29ce530 Mon Sep 17 00:00:00 2001
|
||||
From: Hirohito Higashi <h.east.727@gmail.com>
|
||||
Date: Fri, 26 Jun 2026 20:07:01 +0900
|
||||
Subject: [PATCH] patch 9.2.0736: potential command execution in PHP
|
||||
omni-completion
|
||||
|
||||
Problem: With PHP omni-completion, a crafted file can potentially
|
||||
execute arbitrary commands when completing a class member.
|
||||
Solution: Quote the class name before inserting it into the search()
|
||||
pattern run via win_execute().
|
||||
|
||||
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
|
||||
Signed-off-by: Hirohito Higashi <h.east.727@gmail.com>
|
||||
Signed-off-by: Christian Brabandt <cb@256bit.org>
|
||||
---
|
||||
runtime/autoload/phpcomplete.vim | 3 ++-
|
||||
src/testdir/Make_all.mak | 2 ++
|
||||
src/testdir/test_plugin_phpcomplete.vim | 35 +++++++++++++++++++++++++
|
||||
3 files changed, 39 insertions(+), 1 deletion(-)
|
||||
create mode 100644 src/testdir/test_plugin_phpcomplete.vim
|
||||
|
||||
diff --git a/runtime/autoload/phpcomplete.vim b/runtime/autoload/phpcomplete.vim
|
||||
index 5b4263ae4..93f7d8b45 100644
|
||||
--- a/runtime/autoload/phpcomplete.vim
|
||||
+++ b/runtime/autoload/phpcomplete.vim
|
||||
@@ -2082,7 +2082,8 @@ function! phpcomplete#GetClassContentsStructure(file_path, file_lines, class_nam
|
||||
let result = []
|
||||
let popup_id = popup_create(a:file_lines, {'hidden': v:true})
|
||||
|
||||
- call win_execute(popup_id, 'call search(''\c\(class\|interface\|trait\)\_s\+'.a:class_name.'\(\>\|$\)'')')
|
||||
+ call win_execute(popup_id, 'call search('
|
||||
+ \ . string('\c\(class\|interface\|trait\)\_s\+' . a:class_name . '\(\>\|$\)') . ')')
|
||||
call win_execute(popup_id, "let cfline = line('.')")
|
||||
call win_execute(popup_id, "call search('{')")
|
||||
call win_execute(popup_id, "let endline = line('.')")
|
||||
diff --git a/src/testdir/Make_all.mak b/src/testdir/Make_all.mak
|
||||
index 2b3d16d78..c4df6ec27 100644
|
||||
--- a/src/testdir/Make_all.mak
|
||||
+++ b/src/testdir/Make_all.mak
|
||||
@@ -227,6 +227,7 @@ NEW_TESTS = \
|
||||
test_partial \
|
||||
test_paste \
|
||||
test_perl \
|
||||
+ test_plugin_phpcomplete \
|
||||
test_plugin_tar \
|
||||
test_plus_arg_edit \
|
||||
test_popup \
|
||||
@@ -477,6 +478,7 @@ NEW_TESTS_RES = \
|
||||
test_partial.res \
|
||||
test_paste.res \
|
||||
test_perl.res \
|
||||
+ test_plugin_phpcomplete.res \
|
||||
test_plugin_tar.res \
|
||||
test_plus_arg_edit.res \
|
||||
test_popup.res \
|
||||
diff --git a/src/testdir/test_plugin_phpcomplete.vim b/src/testdir/test_plugin_phpcomplete.vim
|
||||
new file mode 100644
|
||||
index 000000000..7f66be47b
|
||||
--- /dev/null
|
||||
+++ b/src/testdir/test_plugin_phpcomplete.vim
|
||||
@@ -0,0 +1,35 @@
|
||||
+" Tests for the PHP omni-completion plugin (runtime/autoload/phpcomplete.vim).
|
||||
+
|
||||
+" A buffer class name is interpolated into a search() pattern run via
|
||||
+" win_execute(). Without escaping, "'" closes the string and "|" starts a new
|
||||
+" Ex command, so the name runs as an Ex command during completion.
|
||||
+func Test_phpcomplete_no_exec_via_class_name()
|
||||
+ unlet! g:phpcomplete_injected
|
||||
+ let lines = ['<?php', 'class x {}', '']
|
||||
+ let payload = "x')|let g:phpcomplete_injected = 1|call search('"
|
||||
+
|
||||
+ try
|
||||
+ call phpcomplete#GetClassContentsStructure('x.php', lines, payload)
|
||||
+ catch
|
||||
+ endtry
|
||||
+
|
||||
+ call assert_false(exists('g:phpcomplete_injected'),
|
||||
+ \ 'class name was executed as an Ex command during completion')
|
||||
+
|
||||
+ unlet! g:phpcomplete_injected
|
||||
+endfunc
|
||||
+
|
||||
+func Test_phpcomplete_class_lookup_still_works()
|
||||
+ let lines = ['<?php', 'class Foo {', ' public $bar;', '}', '']
|
||||
+ let result = phpcomplete#GetClassContentsStructure('Foo.php', lines, 'Foo')
|
||||
+
|
||||
+ call assert_equal(type([]), type(result),
|
||||
+ \ 'GetClassContentsStructure did not return a list')
|
||||
+ call assert_true(len(result) > 0, 'no class structure returned')
|
||||
+ call assert_match('class Foo', result[0].content,
|
||||
+ \ 'class body missing from returned content')
|
||||
+ call assert_match('bar', result[0].content,
|
||||
+ \ 'class member missing from returned content')
|
||||
+endfunc
|
||||
+
|
||||
+" vim: shiftwidth=2 sts=2 expandtab
|
||||
11
vim.spec
11
vim.spec
@ -51,7 +51,7 @@ Summary: The VIM editor
|
||||
URL: http://www.vim.org/
|
||||
Name: vim
|
||||
Version: %{baseversion}.%{patchlevel}
|
||||
Release: 15%{?dist}
|
||||
Release: 16%{?dist}
|
||||
Epoch: 2
|
||||
# swift.vim contains Apache 2.0 with runtime library exception:
|
||||
# which is taken as Apache-2.0 WITH Swift-exception - reported to legal as https://gitlab.com/fedora/legal/fedora-license-data/-/issues/188
|
||||
@ -159,6 +159,10 @@ Patch3023: 0001-patch-9.2.0479-security-runtime-tar-command-injectio.patch
|
||||
# https://redhat.atlassian.net/browse/RHEL-185864
|
||||
# https://github.com/vim/vim/commit/a65a52d684bc58535ad28a4ae824d22e76399934
|
||||
Patch3024: 0001-patch-9.2.0496-security-Code-Injection-in-cucumber-f.patch
|
||||
# RHEL-201124 CVE-2026-59856 vim: potential command execution in PHP omni-completion
|
||||
# https://redhat.atlassian.net/browse/RHEL-201124
|
||||
# https://github.com/vim/vim/commit/43afc581a37a35762dd0ef292f038b9dc5680a24
|
||||
Patch3025: 0001-patch-9.2.0736-potential-command-execution-in-PHP-om.patch
|
||||
|
||||
|
||||
# uses autoconf in spec file
|
||||
@ -501,6 +505,7 @@ perl -pi -e "s,bin/nawk,bin/awk,g" runtime/tools/mve.awk
|
||||
%patch -P 3022 -p1 -b .modeline-tests
|
||||
%patch -P 3023 -p1 -b .tar-cmd-inject
|
||||
%patch -P 3024 -p1 -b .cucumber-code-inject
|
||||
%patch -P 3025 -p1 -b .php-omni-cmd-exec
|
||||
|
||||
%build
|
||||
cd src
|
||||
@ -1131,6 +1136,10 @@ touch %{buildroot}/%{_datadir}/%{name}/vimfiles/doc/tags
|
||||
|
||||
|
||||
%changelog
|
||||
* Wed Jul 29 2026 RHEL Packaging Agent <redhat-ymir-agent@redhat.com> - 2:9.1.083-16
|
||||
- RHEL-201124 CVE-2026-59856 vim: potential command execution in PHP
|
||||
omni-completion
|
||||
|
||||
* Thu Jul 16 2026 Zdenek Dohnal <zdohnal@redhat.com> - 2:9.1.083-15
|
||||
- RHEL-185864 CVE-2026-47167 vim: Code Injection in cucumber filetype plugin
|
||||
|
||||
|
||||
Loading…
Reference in New Issue
Block a user