rpms/vim
7
0
Fork 0
Code Issues Pull Requests Releases Activity
12deb611d3
vim/0001-patch-9.2.0699-security-possible-code-execution-with.patch
RHEL Packaging Agent ed8b07e0b5 Fix CVE-2026-57456: code execution via crafted docstrings in python complete 
Backport upstream commit cce141c42740 (patch 9.2.0699) to fix a
security vulnerability where crafted docstrings could lead to
arbitrary code execution during Python omni-completion.

The fix replaces triple-quoted string insertion with repr() in
Scope.get_code(), Function.get_code(), and Class.get_code() in
both python3complete.vim and pythoncomplete.vim. A new test file
is included to verify the fix.

CVE: CVE-2026-57456
Upstream patches:
 - cce141c427.patch
Resolves: RHEL-192114

This commit was backported by Ymir, a Red Hat Enterprise Linux software maintenance AI agent.

Assisted-by: Ymir
2026-07-31 16:21:41 +02:00

170 lines
6.5 KiB
Diff
Raw Blame History

From e9d7f6f8ad1e7376311ce7af7f0f038fce381176 Mon Sep 17 00:00:00 2001
From: Christian Brabandt <cb@256bit.org>
Date: Sun, 21 Jun 2026 19:50:56 +0000
Subject: [PATCH] patch 9.2.0699: [security]: possible code execution with
python complete
Problem: [security]: possible code execution with python complete
(morningbread)
Solution: Use repr() to quote the doc strings correctly
Github Security Advisory:
https://github.com/vim/vim/security/advisories/GHSA-ppj8-wqjf-6fp3
Supported by AI
Signed-off-by: Christian Brabandt <cb@256bit.org>
---
runtime/autoload/python3complete.vim | 7 ++--
runtime/autoload/pythoncomplete.vim | 7 ++--
src/testdir/Make_all.mak | 2 +
src/testdir/test_plugin_python3complete.vim | 41 +++++++++++++++++++++
4 files changed, 51 insertions(+), 6 deletions(-)
create mode 100644 src/testdir/test_plugin_python3complete.vim
diff --git a/runtime/autoload/python3complete.vim b/runtime/autoload/python3complete.vim
index 6894bd63e..55ccadca4 100644
--- a/runtime/autoload/python3complete.vim
+++ b/runtime/autoload/python3complete.vim
@@ -14,6 +14,7 @@
" i.e. "import url<c-x,c-o>"
" Continue parsing on invalid line??
"
+
" v 0.9
" * Fixed docstring parsing for classes and functions
" * Fixed parsing of *args and **kwargs type arguments
@@ -296,7 +297,7 @@ class Scope(object):
def get_code(self):
str = ""
- if len(self.docstr) > 0: str += '"""'+self.docstr+'"""\n'
+ if len(self.docstr) > 0: str += repr(self.docstr)+'\n'
for l in self.locals:
if l.startswith('import'): str += l+'\n'
str += 'class _PyCmplNoType:\n def __getattr__(self,name):\n return None\n'
@@ -335,7 +336,7 @@ class Class(Scope):
str = '%sclass %s' % (self.currentindent(),self.name)
if len(self.supers) > 0: str += '(%s)' % ','.join(self.supers)
str += ':\n'
- if len(self.docstr) > 0: str += self.childindent()+'"""'+self.docstr+'"""\n'
+ if len(self.docstr) > 0: str += self.childindent()+repr(self.docstr)+'\n'
if len(self.subscopes) > 0:
for s in self.subscopes: str += s.get_code()
else:
@@ -352,7 +353,7 @@ class Function(Scope):
def get_code(self):
str = "%sdef %s(%s):\n" % \
(self.currentindent(),self.name,','.join(self.params))
- if len(self.docstr) > 0: str += self.childindent()+'"""'+self.docstr+'"""\n'
+ if len(self.docstr) > 0: str += self.childindent()+repr(self.docstr)+'\n'
str += "%spass\n" % self.childindent()
return str
diff --git a/runtime/autoload/pythoncomplete.vim b/runtime/autoload/pythoncomplete.vim
index 5f6fee58c..19b96c1d2 100644
--- a/runtime/autoload/pythoncomplete.vim
+++ b/runtime/autoload/pythoncomplete.vim
@@ -12,6 +12,7 @@
" i.e. "import url<c-x,c-o>"
" Continue parsing on invalid line??
"
+
" v 0.9
" * Fixed docstring parsing for classes and functions
" * Fixed parsing of *args and **kwargs type arguments
@@ -314,7 +315,7 @@ class Scope(object):
def get_code(self):
str = ""
- if len(self.docstr) > 0: str += '"""'+self.docstr+'"""\n'
+ if len(self.docstr) > 0: str += repr(self.docstr)+'\n'
for l in self.locals:
if l.startswith('import'): str += l+'\n'
str += 'class _PyCmplNoType:\n def __getattr__(self,name):\n return None\n'
@@ -353,7 +354,7 @@ class Class(Scope):
str = '%sclass %s' % (self.currentindent(),self.name)
if len(self.supers) > 0: str += '(%s)' % ','.join(self.supers)
str += ':\n'
- if len(self.docstr) > 0: str += self.childindent()+'"""'+self.docstr+'"""\n'
+ if len(self.docstr) > 0: str += self.childindent()+repr(self.docstr)+'\n'
if len(self.subscopes) > 0:
for s in self.subscopes: str += s.get_code()
else:
@@ -370,7 +371,7 @@ class Function(Scope):
def get_code(self):
str = "%sdef %s(%s):\n" % \
(self.currentindent(),self.name,','.join(self.params))
- if len(self.docstr) > 0: str += self.childindent()+'"""'+self.docstr+'"""\n'
+ if len(self.docstr) > 0: str += self.childindent()+repr(self.docstr)+'\n'
str += "%spass\n" % self.childindent()
return str
diff --git a/src/testdir/Make_all.mak b/src/testdir/Make_all.mak
index c5d6e01..f1a2b3c 100644
--- a/src/testdir/Make_all.mak
+++ b/src/testdir/Make_all.mak
@@ -213,6 +213,7 @@ NEW_TESTS = \
test_plugin_ccomplete \
test_plugin_tar \
test_plugin_phpcomplete \
+ test_plugin_python3complete \
test_plus_arg_edit \
test_popup \
test_popupwin \
@@ -454,6 +455,7 @@ NEW_TESTS_RES = \
test_plugin_ccomplete.res \
test_plugin_tar.res \
test_plugin_phpcomplete.res \
+ test_plugin_python3complete.res \
test_plus_arg_edit.res \
test_popup.res \
test_popupwin.res \
diff --git a/src/testdir/test_plugin_python3complete.vim b/src/testdir/test_plugin_python3complete.vim
new file mode 100644
index 000000000..80eae4f30
--- /dev/null
+++ b/src/testdir/test_plugin_python3complete.vim
@@ -0,0 +1,41 @@
+" Tests for the Python omni-completion plugin (runtime/autoload/python3complete.vim).
+"
+source check.vim
+CheckFeature python3
+
+" Run omni-completion against the given buffer contents and assert that the
+" marker file was not created.
+func s:CompleteAndExpectNoMarker(buffer_lines, marker_path, msg)
+ call delete(a:marker_path)
+ new
+ setfiletype python
+ call setline(1, a:buffer_lines)
+ call cursor(line('$'), col([line('$'), '$']))
+
+ " The PoC trigger -- direct invocation of the omnifunc with an empty base.
+ " This is the same path Vim takes for CTRL-X CTRL-O.
+ silent! call python3complete#Complete(0, '')
+
+ call assert_false(filereadable(a:marker_path),
+ \ a:msg . ' (marker ' . a:marker_path . ' was created)')
+
+ bwipe!
+ call delete(a:marker_path)
+endfunc
+
+func Test_python3complete_no_exec_via_class_docstring()
+ " A class-body docstring is emitted verbatim between triple quotes by
+ " get_code() and runs at class-definition time during exec(). A single-
+ " quoted source docstring lets an embedded """ survive doc()'s leading/
+ " trailing quote strip and break out of the generated literal.
+ let marker = tempname()
+ call s:CompleteAndExpectNoMarker([
+ \ 'class Foo:',
+ \ ' ''x"""+open("' . marker . '", "w").close()+"""y''',
+ \ ' pass',
+ \ 'Foo.',
+ \ ], marker,
+ \ 'class docstring expression was evaluated during omni-completion')
+endfunc
+
+" vim: shiftwidth=2 sts=2 expandtab
Reference in New Issue View Git Blame Copy Permalink