runtime(zip): Detect path traversal issues on Windows
Commit:
https://github.com/vim/vim/commit/6836599733950e1f52864a9742ff3e5bca5820fd
Author: Christian Brabandt <[email protected]>
Date: Tue Apr 14 14:42:48 2026 +0200
runtime(zip): Detect path traversal issues on Windows
Signed-off-by: Christian Brabandt <[email protected]>
diff --git a/runtime/autoload/zip.vim b/runtime/autoload/zip.vim
index f4482fd7f..6a2d6daa3 100644
--- a/runtime/autoload/zip.vim
+++ b/runtime/autoload/zip.vim
@@ -22,6 +22,7 @@
" 2026 Mar 08 by Vim Project: Make ZipUpdatePS() check for powershell
" 2026 Apr 01 by Vim Project: Detect more path traversal attacks
" 2026 Apr 05 by Vim Project: Detect more path traversal attacks
+" 2026 Apr 14 by Vim Project: Detect more path traversal attacks on Windows
" License: Vim License (see vim's :help license)
" Copyright: Copyright (C) 2005-2019 Charles E. Campbell {{{1
" Permission is hereby granted to use and distribute this code,
@@ -405,7 +406,12 @@ fun! zip#Write(fname)
else
let zipfile = substitute(a:fname,'^.\{-}zipfile://\(.\{-}\)::[^\].*$','
','')
let fname = substitute(a:fname,'^.\{-}zipfile://.\{-}::\([^\].*\)$','
','')
- " TODO: what to check on MS-Windows to avoid writing absolute paths?
+ " fname should not start with drive leter or a UNC path
+ if fname =~ '^\%(\%( :[\/]\)\|[\/]\{2}\)'
+ call s:Mess('Error', "***error*** (zip#Write) Path Traversal Attack
detected, not writing!")
+ call s:ChgDir(curdir,s:WARNING,"(zip#Write) unable to return to
".curdir."!")
+ return
+ endif
endif
if fname =~ '^[.]\{1,2}/'
let gnu_cmd = g:zip_zipcmd . ' -d ' .
s:Escape(fnamemodify(zipfile,":p"),0) . ' ' . s:Escape(fname,0)
--
--
You received this message from the "vim_dev" maillist.
Do not top-post! Type your reply below the text you are replying to.
For more information, visit http://www.vim.org/maillist.php
---
You received this message because you are subscribed to the Google Groups
"vim_dev" group.
To unsubscribe from this group and stop receiving emails from it, send an email
to [email protected].
To view this discussion visit
https://groups.google.com/d/msgid/vim_dev/E1wCd8b-002DTw-Nc%40256bit.org.
