4e3ff3d4fe
Backport fix for CVE-2026-52858 to vim on c8s. Two upstream patches are applied: - Patch 3059 (upstream 9.2.0561): Disables execution of import/from statements in python3complete.vim and pythoncomplete.vim unless g:pythoncomplete_allow_import is explicitly set by the user. - Patch 3060 (upstream 9.2.0568): Follow-up fix adding missing 'import vim' in evalsource() so the opt-in variable is actually honored. Both patches had src/version.c hunks stripped per maintainer rules. Minor conflicts in filetype.txt and test_popup.vim were resolved manually due to differences between vim 8.0 and upstream. CVE: CVE-2026-52858 Upstream patches: -4b850457e1.patch -868ad62cb8.patch Resolves: RHEL-186648 This commit was backported by Ymir, a Red Hat Enterprise Linux software maintenance AI agent. Assisted-by: Ymir
88 lines
3.6 KiB
Diff
88 lines
3.6 KiB
Diff
From 864113433a67171b3292b9e9dc8ca0f1e4249529 Mon Sep 17 00:00:00 2001
|
|
From: thinca <thinca@gmail.com>
|
|
Date: Sun, 31 May 2026 12:33:07 +0000
|
|
Subject: [PATCH] patch 9.2.0568: pythoncomplete: g:pythoncomplete_allow_import
|
|
had no effect
|
|
|
|
Problem: The security patch 9.2.0561 added a vim.eval() call inside
|
|
Completer.evalsource() to honor g:pythoncomplete_allow_import.
|
|
But the 'vim' module is only imported inside the outer
|
|
vimcomplete() / vimpy3complete() function, not at the script's
|
|
top level, so referring to it from a Completer method raises
|
|
NameError. The surrounding bare 'except' silently swallows
|
|
the error and leaves allow_imports at 0, meaning the opt-in
|
|
never takes effect -- 'import os' (and any other
|
|
buffer-level import) is always skipped, no candidates are
|
|
produced for 'os.<...>' and
|
|
Test_popup_and_preview_autocommand() fails on the Windows
|
|
CI matrix (Linux skips the test because Python 2 is absent).
|
|
Solution: Re-import 'vim' at the top of evalsource() in both
|
|
pythoncomplete.vim and python3complete.vim so the eval reads
|
|
the global, and set g:pythoncomplete_allow_import = 1 in the
|
|
test (it is the opt-in intended for callers that trust the
|
|
buffer contents) (thinca).
|
|
|
|
closes: #20386
|
|
|
|
Signed-off-by: thinca <thinca@gmail.com>
|
|
Signed-off-by: Christian Brabandt <cb@256bit.org>
|
|
---
|
|
runtime/autoload/python3complete.vim | 3 +++
|
|
runtime/autoload/pythoncomplete.vim | 3 +++
|
|
src/testdir/test_popup.vim | 4 ++++
|
|
3 files changed, 10 insertions(+)
|
|
|
|
diff --git a/runtime/autoload/python3complete.vim b/runtime/autoload/python3complete.vim
|
|
index 5dcfb73..cd8786d 100644
|
|
--- a/runtime/autoload/python3complete.vim
|
|
+++ b/runtime/autoload/python3complete.vim
|
|
@@ -127,6 +127,9 @@ class Completer(object):
|
|
self.parser = PyParser()
|
|
|
|
def evalsource(self,text,line=0):
|
|
+ # vim is imported locally in vimpy3complete(); re-import here so the
|
|
+ # vim.eval() below works (otherwise NameError, silently caught).
|
|
+ import vim
|
|
sc = self.parser.parse(text,line)
|
|
try: allow_imports = int(
|
|
vim.eval("get(g:, 'pythoncomplete_allow_import', 0)"))
|
|
diff --git a/runtime/autoload/pythoncomplete.vim b/runtime/autoload/pythoncomplete.vim
|
|
index 6f72b11..a4dc18c 100644
|
|
--- a/runtime/autoload/pythoncomplete.vim
|
|
+++ b/runtime/autoload/pythoncomplete.vim
|
|
@@ -144,6 +144,9 @@ class Completer(object):
|
|
self.parser = PyParser()
|
|
|
|
def evalsource(self,text,line=0):
|
|
+ # vim is imported locally in vimcomplete(); re-import here so the
|
|
+ # vim.eval() below works (otherwise NameError, silently caught).
|
|
+ import vim
|
|
sc = self.parser.parse(text,line)
|
|
try: allow_imports = int(
|
|
vim.eval("get(g:, 'pythoncomplete_allow_import', 0)"))
|
|
diff --git a/src/testdir/test_popup.vim b/src/testdir/test_popup.vim
|
|
index ed31985..49ea6c6 100644
|
|
--- a/src/testdir/test_popup.vim
|
|
+++ b/src/testdir/test_popup.vim
|
|
@@ -680,6 +680,9 @@ func Test_popup_and_preview_autocommand()
|
|
au!
|
|
au BufAdd * nested tab sball
|
|
augroup END
|
|
+ " Let pythoncomplete follow the buffer's 'import os' (off by default
|
|
+ " since v9.2.0561) so 'os.' can be completed.
|
|
+ let g:pythoncomplete_allow_import = 1
|
|
set omnifunc=pythoncomplete#Complete
|
|
call setline(1, 'import os')
|
|
" make the line long
|
|
@@ -702,6 +705,7 @@ func Test_popup_and_preview_autocommand()
|
|
augroup END
|
|
augroup! MyBufAdd
|
|
bw!
|
|
+ unlet g:pythoncomplete_allow_import
|
|
endfunc
|
|
|
|
func Test_balloon_split()
|
|
--
|
|
2.52.0
|
|
|