| Age | Commit message (Collapse) | Author | Files |
|
random filename generation (#39165)
https://github.com/vim/vim/commit/ab02d65b1f045607e51a28317894c39ae9512d1d
Co-authored-by: Yasuhiro Matsumoto <mattn.jp@gmail.com>
|
|
https://github.com/vim/vim/commit/e6a84bb6b0e45ddb106f689054b0d96aba161f67
Co-authored-by: Christian Brabandt <cb@256bit.org>
|
|
tar#Extract() (#39095)
Problem: runtime(tar): missing path traversal checks in tar#Extract()
Solution: Add check for leading slash, however gnu tar should already
detect this (q1uf3ng)
tar#Extract() did not check for ../ sequences or absolute paths,
unlike zip#Extract() which was patched in recent commits. Add the
same checks: ../ (relative traversal), leading slash (Unix), drive
letter and UNC/leading slash (Windows).
closes: vim/vim#19981
https://github.com/vim/vim/commit/490b737f3e172c3c66744c7531ee85f19618419d
Co-authored-by: q1uf3ng <q1uf3ng@protone.me>
|
|
absolute paths in Extract (#39094)
zip#Write(): the Windows path check did not match a single leading
slash (/path), which resolves to the current drive root on Windows.
Simplify the regex to match any leading slash or backslash.
zip#Extract(): add absolute path checks for both Unix and Windows,
matching the existing checks in zip#Write().
closes: vim/vim#19976
https://github.com/vim/vim/commit/351a16c88f56aeeca5e06095624dd701b264b2a9
Co-authored-by: q1uf3ng <q1uf3ng@protone.me>
|
|
(#39051)
https://github.com/vim/vim/commit/6836599733950e1f52864a9742ff3e5bca5820fd
Co-authored-by: Christian Brabandt <cb@256bit.org>
|
|
Problem:
Neovim's Node.js provider does not support the Bun package manager.
PR #26829 attempted to add this but used a hardcoded path and was abandoned.
Solution:
- Use `bun pm bin -g` to dynamically locate the global binary directory.
- Update `health.lua` to recognize bun installations.
|
|
Problem: runtime(tar): but with dotted path
Solution: Do not strip everything after the first dot
(Aaron Burrow)
tar#Extract was getting the extensionless basename by
stripping away everything starting with the leftmost
dot. So if a directory had a dot or the file had an
'extra' dot then the code did the wrong thing. For
example, if it was given:
/tmp/foo.bar/baz.tar.gz
Then it would treat /tmp/foo as the extensionless
basename, but it actually should have grabbed:
/tmp/foo.bar/baz
This patch fixes the issue by instead looking at the
rightmost dot(s).
This bug was discovered by ChatGPT 5.4. I wrote the
patch and tested vim.
closes: vim/vim#19930
https://github.com/vim/vim/commit/4a1bcc67b4b6fc2dfe564ab4faca490f8afac857
Co-authored-by: Aaron Burrow <burrows@fastmail.com>
|
|
Problem: patch 9.2.0325: runtime(tar): bug in zstd handling
Solution: use correct --zstd argument, separated from other arguments,
rework testing framework (Aaron Burrow).
The tar.vim plugin allows vim to read and manipulate zstd archives,
but it had a bug that caused extraction attempts to fail.
Specifically, if the archive has a .tar.zst or .tzst extension, then
the code was generating invalid extraction commands that looked like
this:
tar --zstdpxf foo.tar.zst foo
When they should be like this:
tar --zstd -pxf foo.tar.zst foo
This patch changes the flag manipulation logic so that --zstd isn't
glued to pxf.
The labor for this change was divided between ChatGPT 5.4 and me.
ChatGPT 5.4 identified the issue (from a code scan?), and I wrote
the patch and tested vim.
related: vim/vim#19930
https://github.com/vim/vim/commit/00285c035aa7d92971bc50b7b124e1408dda53ad
Note: tests need the next patch to pass in Nvim.
Co-authored-by: Aaron Burrow <burrows@fastmail.com>
|
|
Problem: runtime(tar): some issues with lz4 support
Solution: Fix bugs (see below) (Aaron Burrow)
The tar plugin allows users to extract files from tar archives that are
compressed with lz4. But, tar#Extract() builds malformed extraction commands
for lz4-compressed tar archives. This commit fixes three issues in that code.
The first affects archives with a .tlz4 extension and the other two affect
archives with .tar.lz4 extension (but one of these is symmetric to the issue
that .tlz4 archives had).
(1) When trying to extract .tlz4 archives the command created by
tar#Extract looked like this:
tar -I lz4pxf foo.tlz4 foo
This isn't right. It should be something like this:
tar -I lz4 -pxf foo.tlz4 foo
This was happening because tar.plugin is just substituting on the
first - in "tar -pxf". This works fine if we just add a simple flag for
extraction (eg, z for .tgz), but for lz4 we need to add "-I lz4".
I don't believe that there is an obvious good way to fix this without
reworking the way the command is generated. Probably we should collect
the command and flags separately and the flags should be stored in a
set. Then put everything together into a string just before issuing it
as an extraction command. Unfortunately, this might break things for users
because they have access to tar_extractcmd.
This patch just makes the substitution a little bit more clever so that it
does the right thing when substituting on a string like "tar -pxf".
(2) .tar.lz4 extractions had the same issue, which my patch fixes in
the same way.
(3) .tar.lz4 extractions had another issue. There was a space missing
in the command generated by tar#Extract. This meant that commands
looked like this (notice the lack of space between the archive and output
file names):
tar -I lz4pxf foo.tar.lz4foo
This patch just puts a space where it should be.
Finally, I should note that ChatGPT 5.4 initially identified this issue
in the code and generated the test cases. I reviewed the test cases,
wrote the patch, and actually ran vim against the tests (both with and
without the patch).
closes: vim/vim#19925
https://github.com/vim/vim/commit/78954f86c2027c766d9e2b5f7904b5fb4041d250
Co-authored-by: Aaron Burrow <burrows@fastmail.com>
|
|
Problem: runtime(zip): may write using absolute paths
(syndicate)
Solution: Detect this case and abort on Unix, warn in the documentation
about possible issues
https://github.com/vim/vim/commit/46f530e517bd1b59acc2eb0d2aa76d02e54ca9fe
Co-authored-by: Christian Brabandt <cb@256bit.org>
|
|
Problem: [security]: path traversal issue in zip.vim
(Michał Majchrowicz)
Solution: Detect more such attacks and warn the user.
Github Advisory:
https://github.com/vim/vim/security/advisories/GHSA-jc86-w7vm-8p24
https://github.com/vim/vim/commit/7088926316d8d4a7572a242d0765e99adfc8b083
Co-authored-by: Christian Brabandt <cb@256bit.org>
|
|
Problem:
`:Tutor` should open a copy of the tutor file instead of the original. This is
because edits modify the original file buffer, and crashes or other misuse could
potentially corrupt the original file even if it's WO.
Solution:
Copy the tutor file to a temp path before opening. Store the original path in
`b:tutor_file` so metadata json loading still works.
- `tutor#TutorCmd` will now copy the tutor file to a temp path via `tempname()`
before opening with `drop`. Store the original path in `b:tutor_file` only
after the buffer is created.
- `tutor#LoadMetadata` now uses `b:tutor_file` to resolve the JSON path instead
of `expand('%')`, which now points to the temp copy buffer
- `ftplugin/tutor.vim` does not make the `tutor#LoadMetadata` call anymore. It
was guarded by `filereadable(expand('%').'.json')` which fails for the new
temp copy path logic . Instead, `tutor#LoadMetadata` is already called
directly inside `tutor#TutorCmd` since we are already assumed to enable
interactive.
Co-authored-by: Phạm Bình An <111893501+brianhuster@users.noreply.github.com>
|
|
(#38597)
Problem: runtime(rustfmt): not correctly escaping directory names
Solution: Use fnamescape() (Michał Majchrowicz)
https://github.com/vim/vim/commit/068c0604c95e76f0f98984f908747deba94ed155
Co-authored-by: Christian Brabandt <cb@256bit.org>
|
|
powershell (#38204)
fixes: vim/vim#19576
https://github.com/vim/vim/commit/2c1269f0d34f6526f0aaff89b85e0a83e9233fe1
Co-authored-by: Christian Brabandt <cb@256bit.org>
|
|
fixes: vim/vim#7292
https://github.com/vim/vim/commit/89712b9f0e8cbf6074cc5dc0465bdd62245ad9c1
Co-authored-by: Christian Brabandt <cb@256bit.org>
|
|
- ':!' is not stable, so use system() to get more consistent behaviour.
- Only warns when using 'pwsh'.
- Remove trailing spaces.
closes: vim/vim#19370
https://github.com/vim/vim/commit/abac1c1aa67d96313a9cfd086e2267f1c684e740
Co-authored-by: Mao-Yining <mao.yining@outlook.com>
Co-Authored-by: @lxhillwind
|
|
related: vim/vim#19354
https://github.com/vim/vim/commit/27630b28ad70fd97466e324f741f90ca3ef2536a
Co-authored-by: Mao-Yining <mao.yining@outlook.com>
|
|
robust (#37764)
closes: vim/vim#19341
https://github.com/vim/vim/commit/7ccb81bdb6c5454ff801be11082775ec82a96efc
Co-authored-by: Christian Brabandt <cb@256bit.org>
|
|
Problem: search() is used to check for the message from tar that
indicates leading slashes found in the tar archive, or to
check for the leading slashes themselves. However, if
'nowrapscan' is in effect these searches are limited to the
last line and don't find any results. This causes the warning
message from tar to be seen in the buffer, the "Path Traversal
Attack Detected" message to be omitted, and editing actions
can fail. This can be seen, for example, when editing
src/testdir/samples/evil.tar.
Solution: Use the 'w' flag for search() (Kevin Goodsell)
closes: vim/vim#19333
https://github.com/vim/vim/commit/18d844e365c21043d187f142bc88e75e9966822f
Co-authored-by: Kevin Goodsell <kevin-opensource@omegacrash.net>
|
|
b:completingLangExtension. (#37712)
closes: vim/vim#19259
https://github.com/vim/vim/commit/61044eb5364b7a044820933e2cb32d7b0e7c9cdd
Co-authored-by: Arkissa <mrarkssac@gmail.com>
|
|
don't hide rustfmt error
closes: vim/vim#19251
https://github.com/vim/vim/commit/ad0dd7cd1ef405086e8266f8f62221a307a72fe9
Co-authored-by: Arkissa <mrarkssac@gmail.com>
|
|
Problem: A few more typos in various files
Solution: Fix those (zeertzjq, antonkesy)
related: neovim/neovim#37348
closes: vim/vim#19153
https://github.com/vim/vim/commit/6a2b5b2246833f7922e38eabab7090e29e89c3a1
Co-authored-by: Anton Kesy <anton@kesy.de>
|
|
closes: vim/vim#19112
https://github.com/vim/vim/commit/5eb10c5359e05338050819b8229bd4c8af36d365
Co-authored-by: Christian Brabandt <cb@256bit.org>
|
|
maintainer email (#37222)
https://github.com/vim/vim/commit/57352b279d4de492dee4be07d6bc4a116599bbac
Co-authored-by: Christian Brabandt <cb@256bit.org>
|
|
commits (#37192)
This reverts commits:
- 6b652a785033fd4164e049492a7327c1ed7c3e5f
- 2f689d5abde0ccddca9e20d8c93a0299bd054e32
- a025a46d4169587145fb54f04af349cd05cb6122
Several email addresses that are known to be valid caused bounces
due to an issue with my email setup. The previous commits incorrectly
marked these addresses as invalid. So revert the whole thing again.
https://github.com/vim/vim/commit/62d8f3dab5a0b30c31a8df86a973c5e59821a3f0
N/A patch:
vim-patch:2f689d5: runtime: mark more invalid email addresses
Co-authored-by: Christian Brabandt <cb@256bit.org>
|
|
https://github.com/vim/vim/commit/a025a46d4169587145fb54f04af349cd05cb6122
Co-authored-by: Christian Brabandt <cb@256bit.org>
|
|
https://github.com/vim/vim/commit/2f689d5abde0ccddca9e20d8c93a0299bd054e32
Skip colors/ and syntax/help_ru.vim: missing previous changes.
Co-authored-by: Christian Brabandt <cb@256bit.org>
|
|
closes: vim/vim#18967
https://github.com/vim/vim/commit/1a4a1b9fa6a57af49e2d0955850f21c631e92263
Co-authored-by: zoumi <zoumi@users.noreply.github.com>
|
|
Problem:
When Nvim wants to paste from tmux, it doesn't tell tmux to read the OS
clipboard first, so it may have stale clipboard state.
Solution:
Tickle `tmux refresh-client -l`, before requesting paste, as recommended
in the tmux manpage. https://man7.org/linux/man-pages/man1/tmux.1.html
Fixes https://github.com/neovim/neovim/issues/36786
Signed-off-by: Elias Assaf <elyas51000@gmail.com>
|
|
This reverts 2495e7e. That past change meant that we would modify the
buffer contents of a tmux session if it exists, even if the current Nvim
process wasn't running inside of it. Depending on the tmux
configuration, this could even affect the clipboard of an actually
attached tmux client, since tmux itself uses OSC 52 to forward buffer
writes to attached clients.
While autodetection is usually a trade-off and can rarely make everybody
happy, this behavior goes counter the principle of least surprise. If
really desired, it can be brought back by explicit configuration.
|
|
Since NeoVim is installed in `Program Files` directory by default, path
to tutor filename must be quoted before passing to `:drop`.
|
|
was loaded (#36527)
fixes: vim/vim#18716
https://github.com/vim/vim/commit/b74ec159ddae8dac0f1a2f3777392336de08e0c5
Co-authored-by: Christian Brabandt <cb@256bit.org>
Co-authored-by: gcanat <72149218+gcanat@users.noreply.github.com>
|
|
default (#36361)
This reverts commit 4ac995bf9366c6624a0724d19b2226f4c95694b3.
This was added in vim/vim#16807, with no explanation for why it was necessary beyond
"it's an example of an idea". It completely breaks `gq` for me—rustfmt doesn't
reflow comments so is not an appropriate tool here! Beyond that, formatting a
selection with rustfmt treats that selection as if it were an entire file,
throwing away any indentation.
For example, the commit causes `gq` to turn this:
```rust
pub fn foo() {
// blah blah blah blah blah blah blah blah blah blah blah blah blah blah blah blah blah blah blah blah blah blah blah blah blah blah blah blah blah blah blah blah blah blah blah blah blah blah blah blah blah blah blah blah blah blah blah blah blah blah blah blah blah blah blah blah blah blah blah blah blah blah blah blah blah blah blah blah blah blah blah blah blah blah blah blah blah blah
}
```
into this:
```rust
pub fn foo() {
// blah blah blah blah blah blah blah blah blah blah blah blah blah blah blah blah blah blah blah blah blah blah blah blah blah blah blah blah blah blah blah blah blah blah blah blah blah blah blah blah blah blah blah blah blah blah blah blah blah blah blah blah blah blah blah blah blah blah blah blah blah blah blah blah blah blah blah blah blah blah blah blah blah blah blah blah blah blah
}
```
which is totally wrong. In contrast, if I clear `formatprg` then `gq` does the
right thing again:
```rust
pub fn foo() {
// blah blah blah blah blah blah blah blah blah blah blah blah blah blah blah blah blah blah
// blah blah blah blah blah blah blah blah blah blah blah blah blah blah blah blah blah blah
// blah blah blah blah blah blah blah blah blah blah blah blah blah blah blah blah blah blah
// blah blah blah blah blah blah blah blah blah blah blah blah blah blah blah blah blah blah
// blah blah blah blah blah blah
}
```
related: vim/vim#16967
related: vim/vim#17055
closes: vim/vim#18640
https://github.com/vim/vim/commit/eba51337d4b8051b768164f3394d680742234ca8
Co-authored-by: Aaron Jacobs <jacobsa@google.com>
|
|
Problem: :Tutor may not work as expected
Solution: set buftype=nowrite instead of nofile
(Phạm Bình An)
closes: vim/vim#18613
https://github.com/vim/vim/commit/9978bb77c68c2afa056b7c1ec0fa9d9648cb1960
Co-authored-by: Phạm Bình An <phambinhanctb2004@gmail.com>
|
|
Problem:
Spell file downloads relied on Vimscript and netrw (:Nread). If netrw is
disabled, downloads fail.
Solution:
Port the logic to Lua as `nvim.spellfile` and wire it via a Lua plugin that
handles `SpellFileMissing`. Use `vim.net.request()` with a timeout for HTTP,
prompt via `vim.fn.input` and report via `vim.notify`.
Closes #7189
|
|
fixes: vim/vim#17987
closes: vim/vim#18345
https://github.com/vim/vim/commit/70d745a61bc12d94b9b217887004c1a5c263cb9d
Co-authored-by: Shay <shay_public@hotmail.com>
|
|
(#35740)
closes: vim/vim#17848
https://github.com/vim/vim/commit/becf1844e03462b2c997689caafc77bc9c812252
Co-authored-by: Luca Saccarola <github.e41mv@aleeas.com>
|
|
plugin (#35142)
Add complete_check() to ccomplete completion script to avoid UI hangs
and keep Vim responsive as ccomplete can be slow on huge files.
closes: vim/vim#17826
https://github.com/vim/vim/commit/3add0d5e75f82e34c3740ef697620cd330507ae5
vim-patch:44309b9: runtime(ccomplete): return partial results on complete_check()
closes: vim/vim#17838
https://github.com/vim/vim/commit/44309b9d08ba657d8c2ee5ed614c14b0fa0cfefc
Co-authored-by: Maxim Kim <habamax@gmail.com>
|
|
fixes: vim/vim#17745
closes: vim/vim#17749
https://github.com/vim/vim/commit/1afe8c3a4d9d61a4762c11ddf4c50050a92bd23e
Co-authored-by: Christian Brabandt <cb@256bit.org>
|
|
|
|
Problem:
From https://matrix.to/#/!cylwlNXSwagQmZSkzs:matrix.org/$Ofj-TFIsEMbp0O9OhE8xuZSNi-nhRLtZTOgs6JRLNrs?via=matrix.org&via=gitter.im&via=mozilla.org
In lesson 2.6, users are asked to remove the second, forth and fifth
lines with `dd` command, then they are asked to undo twice to make the
text go back to original state. But after that, the mark ✗ appears
again, which confuses the user because they think they do something
wrong. This is a limitation with the current implementation, which is
based on line number only.
Solution:
Reimplement interactive marks as extmarks in Lua. This also make the
feature less fragile, as users can remove, add some arbitrary lines
without breaking the interactive marks.
Co-authored-by: Justin M. Keyes <justinkz@gmail.com>
|
|
Problem: [security]: path traversal issue in tar.vim
(@ax)
Solution: warn the user for such things, drop leading /, don't
forcefully overwrite files when writing temporary files,
refactor autoload/tar.vim
tar.vim: drop leading / in path names
A tar archive containing files with leading `/` may cause confusions as
to where the content is extracted. Let's make sure we drop the leading
`/` and use a relative path instead.
Also while at it, had to refactor it quite a bit and increase the
minimum supported Vim version to v9. Also add a test for some basic tar
functionality
closes: vim/vim#17733
https://github.com/vim/vim/commit/87757c6b0a4b2c1f71c72ea8e1438b8fb116b239
Co-authored-by: Christian Brabandt <cb@256bit.org>
|
|
mapping doc
related: vim/vim#17124
https://github.com/vim/vim/commit/470317f78b110b4559cecb26039b5f93447c1bf0
Co-authored-by: Christian Brabandt <cb@256bit.org>
|
|
file(1)
fixes: #vim/vim#16761
closes: vim/vim#16769
https://github.com/vim/vim/commit/a250738303f85132335d69fd1936501b189eebce
Co-authored-by: Christian Brabandt <cb@256bit.org>
Co-authored-by: Jim Zhou <jimzhouzzy@gmail.com>
|
|
Problem: [security]: path traversal issue in zip.vim (@ax)
Solution: drop leading ../ on write of zipfiles, don't forcefully
overwrite existing files
A zip plugin which contains filenames with leading '../' may cause
confusion as to where the content will be extracted. Let's drop such
things and make sure we use a relative filename instead and don't
forcefully overwrite temporary files. Also, warn the user of such
things.
related: vim/vim#17733
https://github.com/vim/vim/commit/586294a04179d855c3d1d4ee5ea83931963680b8
vim-patch:e1044fb: runtime(zip): raise minimum Vim version to v9.0
vim-patch:e2d9b0d: runtime(zip): zip plugin does not work with Vim 9.0
Co-authored-by: Christian Brabandt <cb@256bit.org>
|
|
Problems:
- Unlike in Vim, Neovim does not report pack/*/start/* in the resolved value of 'rtp' (see `:help packages-runtimepath`)
- This means that the tutor plugin cannot find the tutors in pack/*/start/*
Solution:
- Use nvim_list_runtime_paths() instead of &rtp
|
|
Problem:
With these settings, copy/pasting `blockwise-visual` (with `CTRL+V`)
incorrectly pastes as a `linewise` mode because `regtype` is ignored:
vim.opt.clipboard = 'unnamedplus'
vim.g.clipboard = 'osc52'
To reproduce: press `CTRL+V` and select some characters press `p` and
observe that it is pasted in `linewise` mode.
Solution:
Enable the [clipboard.vim](https://github.com/neovim/neovim/blob/master/runtime/autoload/provider/clipboard.vim#L281-L283))
cache for function providers, so that `regtype` is maintained for the OSC52
clipboard provider.
|
|
runtime files
fixes: vim/vim#17372
closes: vim/vim#17377
https://github.com/vim/vim/commit/c8b7e6129a057fbcbff0d9e73dd8a476fd97a813
Co-authored-by: Gregory Anders <greg@gpanders.com>
|
|
Problem: wrong link to Chapter 2 in vim-01-beginner.tutor
Solution: Fix the link to Chapter 2, add test for links in tutor files
(Phạm Bình An)
In order to write the test, I exposed the function `s:GlobTutorials` as
`tutor#GlobTutorials` and make it also accept a `locale` argument.
closes: vim/vim#17356
https://github.com/vim/vim/commit/e8302da74aee55fe8f6496b5b711fed7d92318c5
Co-authored-by: Phạm Bình An <111893501+brianhuster@users.noreply.github.com>
|
|
While at it, use `:lcd` to temporarily set the window local directory
instead of `:cd` for the global working directory.
fixes: vim/vim#17334
closes: vim/vim#17339
https://github.com/vim/vim/commit/719ec0fe154e321bf7cf2cb2f93e8aa30036b87e
Co-authored-by: Michele Sorcinelli <michelesr@autistici.org>
|