7331b6f4ba
Backport upstream commit cce141c42740f122dd8486ae04e21c2a81016ba8
to fix CVE-2026-57456: possible code execution with python complete
via crafted docstrings.
The fix replaces unsafe triple-quote string concatenation with
repr() in python3complete.vim and pythoncomplete.vim to properly
sanitize docstrings before exec(). A new test file adapted for
vim 8.0 is included to verify the fix.
CVE: CVE-2026-57456
Upstream patches:
- cce141c427.patch
Resolves: RHEL-192102
This commit was backported by Ymir, a Red Hat Enterprise Linux software maintenance AI agent.
Assisted-by: Ymir
145 lines
5.7 KiB
Diff
145 lines
5.7 KiB
Diff
From 578cdd1cd87dcf24959b2031f046932fdfcbe8ab Mon Sep 17 00:00:00 2001
|
|
From: Christian Brabandt <cb@256bit.org>
|
|
Date: Sun, 21 Jun 2026 19:50:56 +0000
|
|
Subject: [PATCH] patch 9.2.0699: [security]: possible code execution with
|
|
python complete
|
|
|
|
Problem: [security]: possible code execution with python complete
|
|
(morningbread)
|
|
Solution: Use repr() to quote the doc strings correctly
|
|
|
|
Github Security Advisory:
|
|
https://github.com/vim/vim/security/advisories/GHSA-ppj8-wqjf-6fp3
|
|
|
|
Supported by AI
|
|
|
|
Signed-off-by: Christian Brabandt <cb@256bit.org>
|
|
---
|
|
runtime/autoload/python3complete.vim | 6 ++--
|
|
runtime/autoload/pythoncomplete.vim | 6 ++--
|
|
src/testdir/Make_all.mak | 1 +
|
|
src/testdir/test_plugin_python3complete.vim | 40 +++++++++++++++++++++
|
|
4 files changed, 47 insertions(+), 6 deletions(-)
|
|
create mode 100644 src/testdir/test_plugin_python3complete.vim
|
|
|
|
diff --git a/runtime/autoload/python3complete.vim b/runtime/autoload/python3complete.vim
|
|
index cd8786d..86fd678 100644
|
|
--- a/runtime/autoload/python3complete.vim
|
|
+++ b/runtime/autoload/python3complete.vim
|
|
@@ -307,7 +307,7 @@ class Scope(object):
|
|
|
|
def get_code(self):
|
|
str = ""
|
|
- if len(self.docstr) > 0: str += '"""'+self.docstr+'"""\n'
|
|
+ if len(self.docstr) > 0: str += repr(self.docstr)+'\n'
|
|
str += 'class _PyCmplNoType:\n def __getattr__(self,name):\n return None\n'
|
|
for sub in self.subscopes:
|
|
str += sub.get_code()
|
|
@@ -344,7 +344,7 @@ class Class(Scope):
|
|
str = '%sclass %s' % (self.currentindent(),self.name)
|
|
if len(self.supers) > 0: str += '(%s)' % ','.join(self.supers)
|
|
str += ':\n'
|
|
- if len(self.docstr) > 0: str += self.childindent()+'"""'+self.docstr+'"""\n'
|
|
+ if len(self.docstr) > 0: str += self.childindent()+repr(self.docstr)+'\n'
|
|
if len(self.subscopes) > 0:
|
|
for s in self.subscopes: str += s.get_code()
|
|
else:
|
|
@@ -361,7 +361,7 @@ class Function(Scope):
|
|
def get_code(self):
|
|
str = "%sdef %s(%s):\n" % \
|
|
(self.currentindent(),self.name,','.join(self.params))
|
|
- if len(self.docstr) > 0: str += self.childindent()+'"""'+self.docstr+'"""\n'
|
|
+ if len(self.docstr) > 0: str += self.childindent()+repr(self.docstr)+'\n'
|
|
str += "%spass\n" % self.childindent()
|
|
return str
|
|
|
|
diff --git a/runtime/autoload/pythoncomplete.vim b/runtime/autoload/pythoncomplete.vim
|
|
index a4dc18c..ea0499b 100644
|
|
--- a/runtime/autoload/pythoncomplete.vim
|
|
+++ b/runtime/autoload/pythoncomplete.vim
|
|
@@ -325,7 +325,7 @@ class Scope(object):
|
|
|
|
def get_code(self):
|
|
str = ""
|
|
- if len(self.docstr) > 0: str += '"""'+self.docstr+'"""\n'
|
|
+ if len(self.docstr) > 0: str += repr(self.docstr)+'\n'
|
|
str += 'class _PyCmplNoType:\n def __getattr__(self,name):\n return None\n'
|
|
for sub in self.subscopes:
|
|
str += sub.get_code()
|
|
@@ -362,7 +362,7 @@ class Class(Scope):
|
|
str = '%sclass %s' % (self.currentindent(),self.name)
|
|
if len(self.supers) > 0: str += '(%s)' % ','.join(self.supers)
|
|
str += ':\n'
|
|
- if len(self.docstr) > 0: str += self.childindent()+'"""'+self.docstr+'"""\n'
|
|
+ if len(self.docstr) > 0: str += self.childindent()+repr(self.docstr)+'\n'
|
|
if len(self.subscopes) > 0:
|
|
for s in self.subscopes: str += s.get_code()
|
|
else:
|
|
@@ -379,7 +379,7 @@ class Function(Scope):
|
|
def get_code(self):
|
|
str = "%sdef %s(%s):\n" % \
|
|
(self.currentindent(),self.name,','.join(self.params))
|
|
- if len(self.docstr) > 0: str += self.childindent()+'"""'+self.docstr+'"""\n'
|
|
+ if len(self.docstr) > 0: str += self.childindent()+repr(self.docstr)+'\n'
|
|
str += "%spass\n" % self.childindent()
|
|
return str
|
|
|
|
diff --git a/src/testdir/Make_all.mak b/src/testdir/Make_all.mak
|
|
index 4b34928..ed348a4 100644
|
|
--- a/src/testdir/Make_all.mak
|
|
+++ b/src/testdir/Make_all.mak
|
|
@@ -146,6 +146,7 @@ NEW_TESTS = test_arabic.res \
|
|
test_paste.res \
|
|
test_perl.res \
|
|
test_plugin_netrw.res \
|
|
+ test_plugin_python3complete.res \
|
|
test_plus_arg_edit.res \
|
|
test_preview.res \
|
|
test_profile.res \
|
|
diff --git a/src/testdir/test_plugin_python3complete.vim b/src/testdir/test_plugin_python3complete.vim
|
|
new file mode 100644
|
|
index 0000000..639d9ce
|
|
--- /dev/null
|
|
+++ b/src/testdir/test_plugin_python3complete.vim
|
|
@@ -0,0 +1,40 @@
|
|
+" Tests for the Python omni-completion plugin (runtime/autoload/python3complete.vim).
|
|
+
|
|
+if !has('python3')
|
|
+ finish
|
|
+endif
|
|
+
|
|
+func s:CompleteAndExpectNoMarker(buffer_lines, marker_path, msg)
|
|
+ call delete(a:marker_path)
|
|
+ let g:pythoncomplete_allow_import = 0
|
|
+ new
|
|
+ setfiletype python
|
|
+ call setline(1, a:buffer_lines)
|
|
+ call cursor(line('$'), col([line('$'), '$']))
|
|
+
|
|
+ silent! call python3complete#Complete(0, '')
|
|
+
|
|
+ call assert_false(filereadable(a:marker_path),
|
|
+ \ a:msg . ' (marker ' . a:marker_path . ' was created)')
|
|
+
|
|
+ bwipe!
|
|
+ call delete(a:marker_path)
|
|
+ unlet! g:pythoncomplete_allow_import
|
|
+endfunc
|
|
+
|
|
+func Test_python3complete_no_exec_via_class_docstring()
|
|
+ " A class-body docstring is emitted verbatim between triple quotes by
|
|
+ " get_code() and runs at class-definition time during exec(). A single-
|
|
+ " quoted source docstring lets an embedded """ survive doc()'s leading/
|
|
+ " trailing quote strip and break out of the generated literal.
|
|
+ let marker = tempname()
|
|
+ call s:CompleteAndExpectNoMarker([
|
|
+ \ 'class Foo:',
|
|
+ \ ' ''x"""+open("' . marker . '", "w").close()+"""y''',
|
|
+ \ ' pass',
|
|
+ \ 'Foo.',
|
|
+ \ ], marker,
|
|
+ \ 'class docstring expression was evaluated during omni-completion')
|
|
+endfunc
|
|
+
|
|
+" vim: shiftwidth=2 sts=2 expandtab
|