adam/vim
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

patch 9.1.1552: [security]: path traversal issue in tar.vim

Browse Source 
Problem:  [security]: path traversal issue in tar.vim
          (@ax)
Solution: warn the user for such things, drop leading /, don't
          forcefully overwrite files when writing temporary files,
          refactor autoload/tar.vim

tar.vim: drop leading / in path names

A tar archive containing files with leading `/` may cause confusions as
to where the content is extracted.  Let's make sure we drop the leading
`/` and use a relative path instead.

Also while at it, had to refactor it quite a bit and increase the
minimum supported Vim version to v9. Also add a test for some basic tar
functionality

closes: #17733
This commit is contained in:
Christian Brabandt
2025-07-15 21:54:00 +02:00
parent 586294a041
commit 87757c6b0a
11 changed files with 340 additions and 224 deletions
Download Patch File Download Diff File Expand all files Collapse all files

8
runtime/plugin/tarPlugin.vim
View File

@ -23,14 +23,14 @@ set cpo&vim
" Public Interface: {{{1
augroup tar
au!
au BufReadCmd tarfile::* call tar#Read(expand("<amatch>"), 1)
au FileReadCmd tarfile::* call tar#Read(expand("<amatch>"), 0)
au BufReadCmd tarfile::* call tar#Read(expand("<amatch>"))
au FileReadCmd tarfile::* call tar#Read(expand("<amatch>"))
au BufWriteCmd tarfile::* call tar#Write(expand("<amatch>"))
au FileWriteCmd tarfile::* call tar#Write(expand("<amatch>"))
if has("unix")
au BufReadCmd tarfile::*/* call tar#Read(expand("<amatch>"), 1)
au FileReadCmd tarfile::*/* call tar#Read(expand("<amatch>"), 0)
au BufReadCmd tarfile::*/* call tar#Read(expand("<amatch>"))
au FileReadCmd tarfile::*/* call tar#Read(expand("<amatch>"))
au BufWriteCmd tarfile::*/* call tar#Write(expand("<amatch>"))
au FileWriteCmd tarfile::*/* call tar#Write(expand("<amatch>"))
endif