adam/vim
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

patch 9.1.1552: [security]: path traversal issue in tar.vim

Browse Source 
Problem:  [security]: path traversal issue in tar.vim
          (@ax)
Solution: warn the user for such things, drop leading /, don't
          forcefully overwrite files when writing temporary files,
          refactor autoload/tar.vim

tar.vim: drop leading / in path names

A tar archive containing files with leading `/` may cause confusions as
to where the content is extracted.  Let's make sure we drop the leading
`/` and use a relative path instead.

Also while at it, had to refactor it quite a bit and increase the
minimum supported Vim version to v9. Also add a test for some basic tar
functionality

closes: #17733
This commit is contained in:
Christian Brabandt
2025-07-15 21:54:00 +02:00
parent 586294a041
commit 87757c6b0a
11 changed files with 340 additions and 224 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
Filelist
View File

@ -213,7 +213,9 @@ SRC_ALL = \
src/testdir/samples/*.txt \
src/testdir/samples/*.vim \
src/testdir/samples/evil.zip \
src/testdir/samples/evil.tar \
src/testdir/samples/poc.zip \
src/testdir/samples/sample.tar \
src/testdir/samples/test.zip \
src/testdir/samples/test000 \
src/testdir/samples/test_undo.txt.undo \