Rashin lahani a cikin Vim wanda ke haifar da aiwatar da lamba lokacin buɗe fayil ɗin mugunta

A cikin masu gyara rubutu Vim и neovim samu rauni (CVE-2019-12735), wanda ke ba da damar aiwatar da lambar sabani lokacin buɗe fayil ɗin da aka kera na musamman. Matsalar tana faruwa ne lokacin da tsohuwar yanayin ƙirar ƙirar (": set modeline") ke aiki, wanda ke ba ku damar ayyana zaɓuɓɓukan gyarawa a cikin fayil ɗin da aka sarrafa. Kafaffen rauni a cikin sakewa
Hoton 8.1.1365 и Neovim 0.3.6.

Za a iya shigar da iyakataccen adadin zaɓuɓɓuka ta hanyar ƙirar ƙirar ƙira. Idan an ayyana magana azaman ƙimar zaɓi, ana aiwatar da shi a cikin yanayin sandbox, wanda ke ba da damar ayyukan aminci mafi sauƙi kawai. A wannan yanayin, ingantaccen umarnin ya haɗa da umarnin ": source", wanda a ciki zaku iya amfani da mai gyara "!". don gudanar da umarni na sabani daga ƙayyadadden fayil. Don haka, don aiwatar da lambar, ya isa a nuna a cikin layin ƙirar gini kamar “set foldexpr=execute('\:source! some_file'):”. A cikin Neovim, an hana aiwatar da kiran kira, amma ana iya amfani da assert_fails maimakon.

Misali, don gudanar da umarnin “name-a”, kawai buɗe fayil a cikin Vim ko Neovim wanda layin farko ko na ƙarshe ya ce:

:!uname -a||» vi:fen:fdm=expr:fde=assert_fails("source\!\%"):fdl=0:fdt="

Kamfanin "source! %" zai karanta umarni daga fayil ɗin na yanzu kuma don haka ya aiwatar da ":! uname -a". Ana iya amfani da jeri na tserewa don ɓoye wani layi da aka bayar daga fitarwa ta kayan aikin cat. Misali, a cikin wannan amfani da samfur lokacin buɗe fayil a cikin vim, an ƙirƙiri hanyar haɗin yanar gizo tare da samun damar harsashi zuwa tsarin wanda aka azabtar, amma wannan fayil ɗin ba zai haifar da tuhuma ba yayin fitarwa zuwa tashar ta amfani da kayan aikin cat.

Kuna iya duba ayyukan ƙirar ƙirar tare da umarnin ": saita modeline?". Don kashe shi, zaku iya ƙara layin "saitin nomodeline" zuwa vimrc. A cikin rabawa ana gyara matsalar a ciki RHEL, SUSE/budeSUSE, Fedora, FreeBSD, Ubuntu, Arch Linux и Alt. Rashin lahani ya kasance a ciki Debian (a cikin ƙirar Debian an kashe ta tsohuwa, don haka raunin ba ya bayyana a cikin tsohuwar yanayin).

source: budenet.ru

Add a comment