mirror of
https://github.com/neovim/neovim.git
synced 2026-11-03 04:40:37 -06:00
vim-patch:9.2.1011: [security]: arbitrary Ex command execution during C omni-completion (#41501)
Problem: arbitrary Ex command execution during C omni-completion via
tag file names (Yazan Balawneh)
Solution: Escape the | for all returned tag files
Github Security Advisory:
https://github.com/vim/vim/security/advisories/GHSA-r77m-8m55-rpr6
https://github.com/vim/vim/commit/331d5d67028505c5b6043603a57d1e8497b922b5
Co-authored-by: Christian Brabandt <cb@256bit.org>
This commit is contained in:
1 parent
ec982dfb93
commit
f9186e0c0e
2 files changed
+31
-1
No files matched your search
@@ -533,7 +533,7 @@ endfunc
|
||||
" member.
|
||||
func s:StructMembers(typename, items, all)
|
||||
" Todo: What about local structures?
|
||||
let fnames = join(map(tagfiles(), 'escape(v:val, " \\#%")'))
|
||||
let fnames = join(map(tagfiles(), 'escape(v:val, " \\#%|")'))
|
||||
if fnames == ''
|
||||
return []
|
||||
endif
|
||||
|
||||
Reference in new issue
Block a user