diff options
| author | zeertzjq <zeertzjq@outlook.com> | 2026-04-23 08:55:21 +0800 |
|---|---|---|
| committer | zeertzjq <zeertzjq@outlook.com> | 2026-04-23 12:51:11 +0800 |
| commit | 0b7f2ac405a6429477d0059e5e996141ceb6a6e2 (patch) | |
| tree | 6b4d4d3f3710a6aa77570b056f3a32d821c134b1 | |
| parent | 1cdaa7da10c942562d7b7b91d106dab18b199fdc (diff) | |
vim-patch:3e60f03: runtime(netrw): use fnameescape() with FileUrlEdit()
https://github.com/vim/vim/commit/3e60f03d942d6bb0f7eac61b149e83615518cec0
Co-authored-by: Christian Brabandt <cb@256bit.org>
| -rw-r--r-- | runtime/pack/dist/opt/netrw/autoload/netrw.vim | 3 | ||||
| -rw-r--r-- | test/old/testdir/test_plugin_netrw.vim | 8 |
2 files changed, 10 insertions, 1 deletions
diff --git a/runtime/pack/dist/opt/netrw/autoload/netrw.vim b/runtime/pack/dist/opt/netrw/autoload/netrw.vim index 8570030a7e..d7b3d0d8ec 100644 --- a/runtime/pack/dist/opt/netrw/autoload/netrw.vim +++ b/runtime/pack/dist/opt/netrw/autoload/netrw.vim @@ -22,6 +22,7 @@ " 2026 Feb 21 by Vim Project better absolute path detection on MS-Windows #19477 " 2026 Feb 27 by Vim Project Make the hostname validation more strict " 2026 Mar 01 by Vim Project include portnumber in hostname checking #19533 +" 2026 Apr 01 by Vim Project use fnameescape() with netrw#FileUrlEdit() " Copyright: Copyright (C) 2016 Charles E. Campbell {{{1 " Permission is hereby granted to use and distribute this code, " with or without modifications, provided that this copyright @@ -8286,7 +8287,7 @@ function netrw#FileUrlEdit(fname) endif exe "sil doau BufReadPre ".fname2396e - exe 'NetrwKeepj keepalt edit '.plainfname + exe 'NetrwKeepj keepalt edit '. fnameescape(plainfname) exe 'sil! NetrwKeepj keepalt bdelete '.fnameescape(a:fname) exe "sil doau BufReadPost ".fname2396e diff --git a/test/old/testdir/test_plugin_netrw.vim b/test/old/testdir/test_plugin_netrw.vim index d2980afc6d..5451fddb37 100644 --- a/test/old/testdir/test_plugin_netrw.vim +++ b/test/old/testdir/test_plugin_netrw.vim @@ -602,4 +602,12 @@ func Test_netrw_hostname() endfor endfunc +func Test_netrw_FileUrlEdit_pipe_injection() + CheckExecutable id + let fname = 'Xtestfile' + let url = 'file:///tmp/file.md%7C!id>'..fname + sil call netrw#FileUrlEdit(url) + call assert_false(filereadable(fname), 'Command injection via pipe in file URL') +endfunc + " vim:ts=8 sts=2 sw=2 et |