82 lines
4.6 KiB
Diff
82 lines
4.6 KiB
Diff
From be7f4cb62fe4ef35e5f4f107a11356385d0c7d1f Mon Sep 17 00:00:00 2001
|
|
From: Yasuhiro Matsumoto <mattn.jp@gmail.com>
|
|
Date: Thu, 23 Jul 2026 19:13:15 +0000
|
|
Subject: [PATCH] patch 9.2.0839: [security]: arbitrary code execution via
|
|
keyword lookup
|
|
|
|
Problem: [security]: arbitrary code execution via keyword lookup in
|
|
sh.vim, zsh.vim and ps1.vim filetype plugin
|
|
(manus-use)
|
|
Solution: For powershell, quote the commands using single quotes, for
|
|
sh/zsh pass the argument as a separate list item to term_start()/system()
|
|
(Yasuhiro Matsumoto).
|
|
|
|
Github Security Advisory:
|
|
https://github.com/vim/vim/security/advisories/GHSA-r5v6-q6j8-8qw2
|
|
|
|
Signed-off-by: Yasuhiro Matsumoto <mattn.jp@gmail.com>
|
|
Signed-off-by: Christian Brabandt <cb@256bit.org>
|
|
---
|
|
runtime/ftplugin/ps1.vim | 5 +++--
|
|
runtime/ftplugin/sh.vim | 4 ++--
|
|
runtime/ftplugin/zsh.vim | 6 +++---
|
|
3 files changed, 8 insertions(+), 7 deletions(-)
|
|
|
|
diff --git a/runtime/ftplugin/ps1.vim b/runtime/ftplugin/ps1.vim
|
|
index d6ab01016..79e545eb5 100644
|
|
--- a/runtime/ftplugin/ps1.vim
|
|
+++ b/runtime/ftplugin/ps1.vim
|
|
@@ -4,6 +4,7 @@
|
|
" Last Change: 2021 Apr 02
|
|
" 2024 Jan 14 by Vim Project (browsefilter)
|
|
|
|
+
|
|
" Only do this when not done yet for this buffer
|
|
if exists("b:did_ftplugin") | finish | endif
|
|
|
|
@@ -49,9 +50,9 @@ if exists('s:pwsh_cmd')
|
|
" For exclusion of ConEmu, see https://github.com/Maximus5/ConEmu/issues/2048
|
|
command! -buffer -nargs=1 GetHelp silent exe '!' . s:pwsh_cmd . ' -NoLogo -NoProfile -NonInteractive -ExecutionPolicy RemoteSigned -Command Get-Help -Full "<args>" | ' . (has('unix') ? 'LESS= less' : 'less') | redraw!
|
|
elseif has('terminal')
|
|
- command! -buffer -nargs=1 GetHelp silent exe 'term ' . s:pwsh_cmd . ' -NoLogo -NoProfile -NonInteractive -ExecutionPolicy RemoteSigned -Command Get-Help -Full "<args>"' . (executable('less') ? ' | less' : '')
|
|
+ command! -buffer -nargs=1 GetHelp call term_start([s:pwsh_cmd, '-NoLogo', '-NoProfile', '-NonInteractive', '-ExecutionPolicy', 'RemoteSigned', '-Command', "Get-Help -Full '" . substitute(<q-args>, "'", "''", 'g') . "'" . (executable('less') ? ' | less' : '')])
|
|
else
|
|
- command! -buffer -nargs=1 GetHelp echo system(s:pwsh_cmd . ' -NoLogo -NoProfile -NonInteractive -ExecutionPolicy RemoteSigned -Command Get-Help -Full <args>')
|
|
+ command! -buffer -nargs=1 GetHelp echo system([s:pwsh_cmd, '-NoLogo', '-NoProfile', '-NonInteractive', '-ExecutionPolicy', 'RemoteSigned', '-Command', "Get-Help -Full '" . substitute(<q-args>, "'", "''", 'g') . "'"])
|
|
endif
|
|
endif
|
|
setlocal keywordprg=:GetHelp
|
|
diff --git a/runtime/ftplugin/sh.vim b/runtime/ftplugin/sh.vim
|
|
index fccfe4be9..e303847f1 100644
|
|
--- a/runtime/ftplugin/sh.vim
|
|
+++ b/runtime/ftplugin/sh.vim
|
|
@@ -48,9 +48,9 @@ if get(b:, "is_bash", 0)
|
|
if !has("gui_running") && executable("less")
|
|
command! -buffer -nargs=1 ShKeywordPrg silent exe '!bash -c "{ help "<args>" 2>/dev/null || man "<args>"; } | LESS= less"' | redraw!
|
|
elseif has("terminal")
|
|
- command! -buffer -nargs=1 ShKeywordPrg silent exe ':term bash -c "help "<args>" 2>/dev/null || man "<args>""'
|
|
+ command! -buffer -nargs=1 ShKeywordPrg call term_start(['bash', '-c', 'help "$1" 2>/dev/null || man "$1"', '--', <q-args>])
|
|
else
|
|
- command! -buffer -nargs=1 ShKeywordPrg echo system('bash -c "help <args>" 2>/dev/null || man "<args>"')
|
|
+ command! -buffer -nargs=1 ShKeywordPrg echo system(['bash', '-c', 'help "$1" 2>/dev/null || MANPAGER= man "$1"', '--', <q-args>])
|
|
endif
|
|
setlocal keywordprg=:ShKeywordPrg
|
|
let b:undo_ftplugin ..= " | setl kp< | sil! delc -buffer ShKeywordPrg"
|
|
diff --git a/runtime/ftplugin/zsh.vim b/runtime/ftplugin/zsh.vim
|
|
index 40986fccb..1a39a7bf7 100644
|
|
--- a/runtime/ftplugin/zsh.vim
|
|
+++ b/runtime/ftplugin/zsh.vim
|
|
@@ -22,9 +22,9 @@ if executable('zsh') && &shell !~# '/\%(nologin\|false\)$'
|
|
if !has('gui_running') && executable('less')
|
|
command! -buffer -nargs=1 ZshKeywordPrg silent exe '!MANPAGER= zsh -c "autoload -Uz run-help; run-help <args> 2>/dev/null | LESS= less"' | redraw!
|
|
elseif has('terminal')
|
|
- command! -buffer -nargs=1 ZshKeywordPrg silent exe ':term zsh -c "autoload -Uz run-help; run-help <args>"'
|
|
- else
|
|
- command! -buffer -nargs=1 ZshKeywordPrg echo system('zsh -c "autoload -Uz run-help; run-help <args> 2>/dev/null"')
|
|
+ command! -buffer -nargs=1 ZshKeywordPrg call term_start(['zsh', '-c', 'autoload -Uz run-help; run-help "$1"', '--', <q-args>])
|
|
+ elseif has("patch-9.2.0250")
|
|
+ command! -buffer -nargs=1 ZshKeywordPrg echo system(['zsh', '-c', 'autoload -Uz run-help; MANPAGER= run-help "$1" 2>/dev/null', '--', <q-args>])
|
|
endif
|
|
if !exists('current_compiler')
|
|
compiler zsh
|