patch 9.2.0435: [security]: backticks in 'path' may cause shell execution on completion
Commit: https://github.com/vim/vim/commit/190cb3c2b9c769a3972bcfd991a7b5b6cb771ef0 Author: Christian Brabandt <[email protected]> Date: Sun May 3 16:10:03 2026 +0000 patch 9.2.0435: [security]: backticks in 'path' may cause shell execution on completion Problem: [security]: Backticks enclosed shell commands in the 'path' option value are executed during completion (q1uf3ng). Solution: Skip path entries containing backticks, add P_SECURE to 'path' option, so that it cannot be set from a modeline (for symmetry with the 'cdpath' option) Github Advisory: https://github.com/vim/vim/security/advisories/GHSA-hwg5-3cxw-wvvg Supported by AI. Signed-off-by: Christian Brabandt <[email protected]> diff --git a/runtime/doc/options.txt b/runtime/doc/options.txt index 7e1d4cb67..4628a1624 100644 --- a/runtime/doc/options.txt +++ b/runtime/doc/options.txt @@ -1,4 +1,4 @@ -*options.txt* For Vim version 9.2. Last change: 2026 May 01 +*options.txt* For Vim version 9.2. Last change: 2026 May 03 VIM REFERENCE MANUAL by Bram Moolenaar @@ -6799,6 +6799,9 @@ A jump table for the options with a short description can be found at |Q_op|. < Replace the ';' with a ':' or whatever separator is used. Note that this doesn't work when $INCL contains a comma or white space. + This option cannot be set from a |modeline| or in the |sandbox|, for + security reasons. + *'perldll'* 'perldll' string (default depends on the build) global diff --git a/src/findfile.c b/src/findfile.c index ed0ee76c4..af9523dcd 100644 --- a/src/findfile.c +++ b/src/findfile.c @@ -2412,6 +2412,10 @@ expand_path_option( { buflen = copy_option_part(&path_option, buf, MAXPATHL, " ,"); + // do not expand backticks, could have been set via a modeline + if (vim_strchr(buf, '`') != NULL) + continue; + if (buf[0] == '.' && (buf[1] == NUL || vim_ispathsep(buf[1]))) { size_t plen; diff --git a/src/optiondefs.h b/src/optiondefs.h index 0a93b70f8..f712ab7a1 100644 --- a/src/optiondefs.h +++ b/src/optiondefs.h @@ -1958,7 +1958,7 @@ static struct vimoption options[] = (char_u *)&p_pm, PV_NONE, did_set_backupext_or_patchmode, NULL, {(char_u *)"", (char_u *)0L} SCTX_INIT}, - {"path", "pa", P_STRING|P_EXPAND|P_VI_DEF|P_COMMA|P_NODUP, + {"path", "pa", P_STRING|P_EXPAND|P_VI_DEF|P_SECURE|P_COMMA|P_NODUP, (char_u *)&p_path, PV_PATH, NULL, NULL, { #if defined(AMIGA) || defined(MSWIN) diff --git a/src/testdir/test_find_complete.vim b/src/testdir/test_find_complete.vim index 079fb7804..8b8b71c30 100644 --- a/src/testdir/test_find_complete.vim +++ b/src/testdir/test_find_complete.vim @@ -161,4 +161,21 @@ func Test_find_complete() set path& endfunc +" Verify that backticks in 'path' are not executed +func Test_find_completion_backtick_in_path() + CheckUnix + CheckExecutable id + + new Xpoc.c + setl path+=`id>Xrce_marker` + " Triggering completion must not execute the backtick command. + call getcompletion('', 'file_in_path') + call assert_false(filereadable('Xrce_marker')) + call feedkeys(":find ", "xt") + call assert_false(filereadable('Xrce_marker')) + + bwipe! + call delete('Xrce_marker') +endfunc + " vim: shiftwidth=2 sts=2 expandtab diff --git a/src/testdir/test_modeline.vim b/src/testdir/test_modeline.vim index 6884ab473..6cbf87638 100644 --- a/src/testdir/test_modeline.vim +++ b/src/testdir/test_modeline.vim @@ -665,4 +665,18 @@ func Test_modeline_strict_cannot_be_set_from_modeline() let &modeline = modeline endfunc +" Verify that backticks in 'path' set from a modeline are not executed +func Test_path_modeline() + let lines =<< trim END + // vim: set path+=foobar : + END + call writefile(lines, 'Xpoc.c', 'D') + + set nomodelinestrict modeline + call assert_fails('split Xpoc.c', 'E520:') + + bwipe! + set modelinestrict& modeline& +endfunc + " vim: shiftwidth=2 sts=2 expandtab diff --git a/src/version.c b/src/version.c index 6d8157e4a..2691f438b 100644 --- a/src/version.c +++ b/src/version.c @@ -729,6 +729,8 @@ static char *(features[]) = static int included_patches[] = { /* Add new patch number below this line */ +/**/ + 435, /**/ 434, /**/ -- -- You received this message from the "vim_dev" maillist. Do not top-post! Type your reply below the text you are replying to. For more information, visit http://www.vim.org/maillist.php --- You received this message because you are subscribed to the Google Groups "vim_dev" group. To unsubscribe from this group and stop receiving emails from it, send an email to [email protected]. To view this discussion visit https://groups.google.com/d/msgid/vim_dev/E1wJbZt-0046kX-HC%40256bit.org.
