Jörn Engel wrote:
> On Thu, Dec 03, 2015 at 02:12:08AM +0000, Random832 wrote:
> > On 2015-12-02, Jörn Engel <[email protected]> wrote:
> > > The vim bug is to try "$TMPDIR" even though the environment variable
> > > isn't set. Arguably that could become a security-issue if I can create
> > > a "$TMPDIR" in a directory I control and trick someone else to open a
> > > file from that directory.
> >
> > If it were possible to trick someone to open an existing file in the
> > temporary directory, that'd be a problem even under normal
> > circumstances, since /tmp (/var/tmp, /usr/tmp, etc, all typical values
> > for TMPDIR) is world-writable.
>
> Fair point.
>
> > > So independently of what praise you might
> > > want to heap on my fuse-thing, vim is equally at fault here.
> >
> > Vim isn't opening a file that exists, it is trying to find a file that
> > doesn't exist. Which means it can't be tricked into opening a file that
> > exists.
>
> It still is a bug. Using a directory called "$TMPDIR" is silly at best.
> The only reason it has survived as long as it has is that the
> misbehaviour is typically 2-3 extra syscalls, not 30s of wait time.
Does this patch fix your problem:
--- a/fileio.c 2015-12-03 13:52:48.451584080 +0100
+++ b/fileio.c 2015-12-03 17:31:53.457770134 +0100
@@ -7390,8 +7390,9 @@
/* expand $TMP, leave room for "/v1100000/999999999" */
expand_env((char_u *)tempdirs[i], itmp, TEMPNAMELEN - 20);
- if (mch_isdir(itmp)) /* directory exists */
+ if (itemp[0] != '$' && mch_isdir(itmp))
{
+ /* directory exists */
# ifdef __EMX__
/* If $TMP contains a forward slash (perhaps using bash or
* tcsh), don't add a backslash, use a forward slash!
--
hundred-and-one symptoms of being an internet addict:
178. You look for an icon to double-click to open your bedroom window.
/// Bram Moolenaar -- [email protected] -- http://www.Moolenaar.net \\\
/// sponsor Vim, vote for features -- http://www.Vim.org/sponsor/ \\\
\\\ an exciting new programming language -- http://www.Zimbu.org ///
\\\ help me help AIDS victims -- http://ICCF-Holland.org ///
--
--
You received this message from the "vim_dev" maillist.
Do not top-post! Type your reply below the text you are replying to.
For more information, visit http://www.vim.org/maillist.php
---
You received this message because you are subscribed to the Google Groups
"vim_dev" group.
To unsubscribe from this group and stop receiving emails from it, send an email
to [email protected].
For more options, visit https://groups.google.com/d/optout.
