From e94a0546625590b0f8f738246e4393f350e093dd Mon Sep 17 00:00:00 2001 From: Christian Brabandt Date: Sun, 21 Jun 2026 19:50:56 +0000 Subject: [PATCH] patch 9.2.0699: [security]: possible code execution with python complete Problem: [security]: possible code execution with python complete (morningbread) Solution: Use repr() to quote the doc strings correctly Github Security Advisory: https://github.com/vim/vim/security/advisories/GHSA-ppj8-wqjf-6fp3 Supported by AI Signed-off-by: Christian Brabandt --- runtime/autoload/python3complete.vim | 7 ++-- runtime/autoload/pythoncomplete.vim | 7 ++-- src/testdir/Make_all.mak | 2 + src/testdir/test_plugin_python3complete.vim | 45 +++++++++++++++++++++ 4 files changed, 55 insertions(+), 6 deletions(-) create mode 100644 src/testdir/test_plugin_python3complete.vim diff --git a/runtime/autoload/python3complete.vim b/runtime/autoload/python3complete.vim index ea0a33136..cb3d04548 100644 --- a/runtime/autoload/python3complete.vim +++ b/runtime/autoload/python3complete.vim @@ -14,6 +14,7 @@ " i.e. "import url" " Continue parsing on invalid line?? " + " v 0.10 by Vim project " * disables importing local modules, unless the global Vim variable " g:pythoncomplete_allow_import is set to non-zero @@ -315,7 +316,7 @@ class Scope(object): def get_code(self): str = "" - if len(self.docstr) > 0: str += '"""'+self.docstr+'"""\n' + if len(self.docstr) > 0: str += repr(self.docstr)+'\n' str += 'class _PyCmplNoType:\n def __getattr__(self,name):\n return None\n' for sub in self.subscopes: str += sub.get_code() @@ -352,7 +353,7 @@ class Class(Scope): str = '%sclass %s' % (self.currentindent(),self.name) if len(self.supers) > 0: str += '(%s)' % ','.join(self.supers) str += ':\n' - if len(self.docstr) > 0: str += self.childindent()+'"""'+self.docstr+'"""\n' + if len(self.docstr) > 0: str += self.childindent()+repr(self.docstr)+'\n' if len(self.subscopes) > 0: for s in self.subscopes: str += s.get_code() else: @@ -369,7 +370,7 @@ class Function(Scope): def get_code(self): str = "%sdef %s(%s):\n" % \ (self.currentindent(),self.name,','.join(self.params)) - if len(self.docstr) > 0: str += self.childindent()+'"""'+self.docstr+'"""\n' + if len(self.docstr) > 0: str += self.childindent()+repr(self.docstr)+'\n' str += "%spass\n" % self.childindent() return str diff --git a/runtime/autoload/pythoncomplete.vim b/runtime/autoload/pythoncomplete.vim index aa28bb721..4ba8337b5 100644 --- a/runtime/autoload/pythoncomplete.vim +++ b/runtime/autoload/pythoncomplete.vim @@ -12,6 +12,7 @@ " i.e. "import url" " Continue parsing on invalid line?? " + " v 0.10 by Vim project " * disables importing local modules, unless the global Vim variable " g:pythoncomplete_allow_import is set to non-zero @@ -330,7 +331,7 @@ class Scope(object): def get_code(self): str = "" - if len(self.docstr) > 0: str += '"""'+self.docstr+'"""\n' + if len(self.docstr) > 0: str += repr(self.docstr)+'\n' str += 'class _PyCmplNoType:\n def __getattr__(self,name):\n return None\n' for sub in self.subscopes: str += sub.get_code() @@ -367,7 +368,7 @@ class Class(Scope): str = '%sclass %s' % (self.currentindent(),self.name) if len(self.supers) > 0: str += '(%s)' % ','.join(self.supers) str += ':\n' - if len(self.docstr) > 0: str += self.childindent()+'"""'+self.docstr+'"""\n' + if len(self.docstr) > 0: str += self.childindent()+repr(self.docstr)+'\n' if len(self.subscopes) > 0: for s in self.subscopes: str += s.get_code() else: @@ -384,7 +385,7 @@ class Function(Scope): def get_code(self): str = "%sdef %s(%s):\n" % \ (self.currentindent(),self.name,','.join(self.params)) - if len(self.docstr) > 0: str += self.childindent()+'"""'+self.docstr+'"""\n' + if len(self.docstr) > 0: str += self.childindent()+repr(self.docstr)+'\n' str += "%spass\n" % self.childindent() return str diff --git a/src/testdir/Make_all.mak b/src/testdir/Make_all.mak index 2b3d16d78..23360ce45 100644 --- a/src/testdir/Make_all.mak +++ b/src/testdir/Make_all.mak @@ -230,6 +230,7 @@ NEW_TESTS = \ test_plugin_ccomplete \ test_plugin_netrw \ test_plugin_phpcomplete \ + test_plugin_python3complete \ test_plugin_tar \ test_plus_arg_edit \ test_popup \ @@ -483,6 +484,7 @@ NEW_TESTS_RES = \ test_plugin_ccomplete.res \ test_plugin_netrw.res \ test_plugin_phpcomplete.res \ + test_plugin_python3complete.res \ test_plugin_tar.res \ test_plus_arg_edit.res \ test_popup.res \ diff --git a/src/testdir/test_plugin_python3complete.vim b/src/testdir/test_plugin_python3complete.vim new file mode 100644 index 000000000..d83f65f3b --- /dev/null +++ b/src/testdir/test_plugin_python3complete.vim @@ -0,0 +1,45 @@ +" Tests for the Python omni-completion plugin (runtime/autoload/python3complete.vim). +" +source check.vim +CheckFeature python3 + +" Run omni-completion against the given buffer contents and assert that the +" marker file was not created. Pre-patch behaviour exec()s reconstructed +" def/class headers, which evaluates the buffer-supplied expression and +" creates the marker file. Post-patch, the expressions are stripped. +func s:CompleteAndExpectNoMarker(buffer_lines, marker_path, msg) + call delete(a:marker_path) + defer delete(a:marker_path) + let g:pythoncomplete_allow_import = 0 + new + setfiletype python + call setline(1, a:buffer_lines) + call cursor(line('$'), col([line('$'), '$'])) + + " The PoC trigger -- direct invocation of the omnifunc with an empty base. + " This is the same path Vim takes for CTRL-X CTRL-O. + silent! call python3complete#Complete(0, '') + + call assert_false(filereadable(a:marker_path), + \ a:msg . ' (marker ' . a:marker_path . ' was created)') + + bwipe! + unlet! g:pythoncomplete_allow_import +endfunc + +func Test_python3complete_no_exec_via_class_docstring() + " A class-body docstring is emitted verbatim between triple quotes by + " get_code() and runs at class-definition time during exec(). A single- + " quoted source docstring lets an embedded """ survive doc()'s leading/ + " trailing quote strip and break out of the generated literal. + let marker = tempname() + call s:CompleteAndExpectNoMarker([ + \ 'class Foo:', + \ ' ''x"""+open("' . marker . '", "w").close()+"""y''', + \ ' pass', + \ 'Foo.', + \ ], marker, + \ 'class docstring expression was evaluated during omni-completion') +endfunc + +" vim: shiftwidth=2 sts=2 expandtab