From 578cdd1cd87dcf24959b2031f046932fdfcbe8ab Mon Sep 17 00:00:00 2001
From: Christian Brabandt <cb@256bit.org>
Date: Sun, 21 Jun 2026 19:50:56 +0000
Subject: [PATCH] patch 9.2.0699: [security]: possible code execution with
 python complete

Problem:  [security]: possible code execution with python complete
          (morningbread)
Solution: Use repr() to quote the doc strings correctly

Github Security Advisory:
https://github.com/vim/vim/security/advisories/GHSA-ppj8-wqjf-6fp3

Supported by AI

Signed-off-by: Christian Brabandt <cb@256bit.org>
---
 runtime/autoload/python3complete.vim        |  6 ++--
 runtime/autoload/pythoncomplete.vim         |  6 ++--
 src/testdir/Make_all.mak                    |  1 +
 src/testdir/test_plugin_python3complete.vim | 40 +++++++++++++++++++++
 4 files changed, 47 insertions(+), 6 deletions(-)
 create mode 100644 src/testdir/test_plugin_python3complete.vim

diff --git a/runtime/autoload/python3complete.vim b/runtime/autoload/python3complete.vim
index cd8786d..86fd678 100644
--- a/runtime/autoload/python3complete.vim
+++ b/runtime/autoload/python3complete.vim
@@ -307,7 +307,7 @@ class Scope(object):
 
     def get_code(self):
         str = ""
-        if len(self.docstr) > 0: str += '"""'+self.docstr+'"""\n'
+        if len(self.docstr) > 0: str += repr(self.docstr)+'\n'
         str += 'class _PyCmplNoType:\n    def __getattr__(self,name):\n        return None\n'
         for sub in self.subscopes:
             str += sub.get_code()
@@ -344,7 +344,7 @@ class Class(Scope):
         str = '%sclass %s' % (self.currentindent(),self.name)
         if len(self.supers) > 0: str += '(%s)' % ','.join(self.supers)
         str += ':\n'
-        if len(self.docstr) > 0: str += self.childindent()+'"""'+self.docstr+'"""\n'
+        if len(self.docstr) > 0: str += self.childindent()+repr(self.docstr)+'\n'
         if len(self.subscopes) > 0:
             for s in self.subscopes: str += s.get_code()
         else:
@@ -361,7 +361,7 @@ class Function(Scope):
     def get_code(self):
         str = "%sdef %s(%s):\n" % \
             (self.currentindent(),self.name,','.join(self.params))
-        if len(self.docstr) > 0: str += self.childindent()+'"""'+self.docstr+'"""\n'
+        if len(self.docstr) > 0: str += self.childindent()+repr(self.docstr)+'\n'
         str += "%spass\n" % self.childindent()
         return str
 
diff --git a/runtime/autoload/pythoncomplete.vim b/runtime/autoload/pythoncomplete.vim
index a4dc18c..ea0499b 100644
--- a/runtime/autoload/pythoncomplete.vim
+++ b/runtime/autoload/pythoncomplete.vim
@@ -325,7 +325,7 @@ class Scope(object):
 
     def get_code(self):
         str = ""
-        if len(self.docstr) > 0: str += '"""'+self.docstr+'"""\n'
+        if len(self.docstr) > 0: str += repr(self.docstr)+'\n'
         str += 'class _PyCmplNoType:\n    def __getattr__(self,name):\n        return None\n'
         for sub in self.subscopes:
             str += sub.get_code()
@@ -362,7 +362,7 @@ class Class(Scope):
         str = '%sclass %s' % (self.currentindent(),self.name)
         if len(self.supers) > 0: str += '(%s)' % ','.join(self.supers)
         str += ':\n'
-        if len(self.docstr) > 0: str += self.childindent()+'"""'+self.docstr+'"""\n'
+        if len(self.docstr) > 0: str += self.childindent()+repr(self.docstr)+'\n'
         if len(self.subscopes) > 0:
             for s in self.subscopes: str += s.get_code()
         else:
@@ -379,7 +379,7 @@ class Function(Scope):
     def get_code(self):
         str = "%sdef %s(%s):\n" % \
             (self.currentindent(),self.name,','.join(self.params))
-        if len(self.docstr) > 0: str += self.childindent()+'"""'+self.docstr+'"""\n'
+        if len(self.docstr) > 0: str += self.childindent()+repr(self.docstr)+'\n'
         str += "%spass\n" % self.childindent()
         return str
 
diff --git a/src/testdir/Make_all.mak b/src/testdir/Make_all.mak
index 4b34928..ed348a4 100644
--- a/src/testdir/Make_all.mak
+++ b/src/testdir/Make_all.mak
@@ -146,6 +146,7 @@ NEW_TESTS = test_arabic.res \
 	    test_paste.res \
 	    test_perl.res \
 	    test_plugin_netrw.res \
+	    test_plugin_python3complete.res \
 	    test_plus_arg_edit.res \
 	    test_preview.res \
 	    test_profile.res \
diff --git a/src/testdir/test_plugin_python3complete.vim b/src/testdir/test_plugin_python3complete.vim
new file mode 100644
index 0000000..639d9ce
--- /dev/null
+++ b/src/testdir/test_plugin_python3complete.vim
@@ -0,0 +1,40 @@
+" Tests for the Python omni-completion plugin (runtime/autoload/python3complete.vim).
+
+if !has('python3')
+  finish
+endif
+
+func s:CompleteAndExpectNoMarker(buffer_lines, marker_path, msg)
+  call delete(a:marker_path)
+  let g:pythoncomplete_allow_import = 0
+  new
+  setfiletype python
+  call setline(1, a:buffer_lines)
+  call cursor(line('$'), col([line('$'), '$']))
+
+  silent! call python3complete#Complete(0, '')
+
+  call assert_false(filereadable(a:marker_path),
+        \ a:msg . ' (marker ' . a:marker_path . ' was created)')
+
+  bwipe!
+  call delete(a:marker_path)
+  unlet! g:pythoncomplete_allow_import
+endfunc
+
+func Test_python3complete_no_exec_via_class_docstring()
+  " A class-body docstring is emitted verbatim between triple quotes by
+  " get_code() and runs at class-definition time during exec().  A single-
+  " quoted source docstring lets an embedded """ survive doc()'s leading/
+  " trailing quote strip and break out of the generated literal.
+  let marker = tempname()
+  call s:CompleteAndExpectNoMarker([
+        \ 'class Foo:',
+        \ '    ''x"""+open("' . marker . '", "w").close()+"""y''',
+        \ '    pass',
+        \ 'Foo.',
+        \ ], marker,
+        \ 'class docstring expression was evaluated during omni-completion')
+endfunc
+
+" vim: shiftwidth=2 sts=2 expandtab