Re: security problem with ruby code completion in vim

2006-06-18 Thread Mark Guzman
I will modify rubycomplete so that it doesn't load anything from the current buffer by default. This will limit completion to the default environment objects. rubycomplete does not seem to work with $SAFE 3. As a note, sorry about the lag, I missed this thread until Bram brought it to my

Re: security problem with ruby code completion in vim

2006-06-07 Thread Martin Povolný
Nikolai Weibull wrote: On 6/6/06, Martin Povolný [EMAIL PROTECTED] wrote: Nikolai Weibull wrote: On 6/6/06, Martin Povolný [EMAIL PROTECTED] wrote: require 'a' Here's where it happens. It will actually require 'a' so that it knows about the stuff in that file. $SAFE _may_ be a

security problem with ruby code completion in vim

2006-06-06 Thread Martin Povolný
Hallo, I have tested ruby code completion in vim and found that it is quite insecure. Lets have file 'a.rb': system('echo vim je pako /tmp/pako') class MyTest def test return 1 end end And then some file we edit e.g. 'b.rb': require 'a' t = MyTest.new t.t Now put cursor at the and

Re: security problem with ruby code completion in vim

2006-06-06 Thread Nikolai Weibull
On 6/6/06, Martin Povolný [EMAIL PROTECTED] wrote: Hallo, I have tested ruby code completion in vim and found that it is quite insecure. Lets have file 'a.rb': system('echo vim je pako /tmp/pako') class MyTest def test return 1 end end And then some file we edit e.g. 'b.rb':

Re: security problem with ruby code completion in vim

2006-06-06 Thread Martin Povolný
Nikolai Weibull wrote: On 6/6/06, Martin Povolný [EMAIL PROTECTED] wrote: Hallo, I have tested ruby code completion in vim and found that it is quite insecure. Lets have file 'a.rb': system('echo vim je pako /tmp/pako') class MyTest def test return 1 end end And then some file we