Kusagadzikana muVim kunotungamira kukuita kodhi kana faira rakashata ravhurwa

In text editors Vim ΠΈ neovim akawana vulnerability (CVE-2019-12735), iyo inobvumira kodhi kodhi kuti iitwe kana uchivhura faira rakagadzirwa. Dambudziko rinoitika kana iyo default modeline mode (": set modeline") inoshanda, iyo inokutendera kuti utsanangure sarudzo dzekugadzirisa mufaira rakagadziriswa. Kusagadzikana kwakagadziriswa mukuburitswa
Vim 8.1.1365 ΠΈ Neovim 0.3.6.

Chete nhamba shoma yesarudzo inogona kuiswa kuburikidza nemodeline. Kana chirevo chikatsanangurwa sechisarudzo kukosha, chinoitwa mu sandbox modhi, iyo inobvumira chete yakapusa yakachengeteka mashandiro. Muchiitiko ichi, murairo unoshanda unosanganisira ": source" command, maunogona kushandisa "!" modifier. kumhanyisa mirairo kubva pane yakatarwa faira. Saka, kuita kodhi, zvakakwana kuratidza mumutsara wemodeli chivakwa se "set foldexpr=execute('\:source! some_file'):". MuNeovim, kufona kunoitwa kunorambidzwa, asi assert_fails inogona kushandiswa pachinzvimbo.

Semuenzaniso, kumhanya iyo "uname -a" kuraira, ingovhura faira muVim kana Neovim ine yekutanga kana yekupedzisira mutsara unoti:

:!uname -a||Β» vi:fen:fdm=expr:fde=assert_fails(β€œsource\!\\%”):fdl=0:fdt=”

Kambani "source! %" ichaverenga mirairo kubva kufaira iripo uye ichaita ":!uname -a". Escape sequences inogona kushandiswa kuvanza mutsara wakapihwa kubva pakubuda nekatsi utility. Somuenzaniso, mune izvi kushandisa prototype kana uchivhura faira mu vim, network yekubatanidza inogadzirwa ine shell yekuwana kune akabatwa system, asi iyi faira haizomutsa fungidziro kana yabuditswa kune terminal uchishandisa katsi utility.

Iwe unogona kutarisa chiitiko chemodeline mode nemurairo ": set modeline?". Kuidzima, unogona kuwedzera mutsara "set nomodeline" kune vimrc. Mukugovera, dambudziko rinogadziriswa mukati RHEL, SUSE/openSUSE, Fedora, FreeBSD, Ubuntu, Arch Linux ΠΈ ALT. Kusagadzikana kunoramba kusati kwaitwa mukati Debian (muDebian modeline yakaremara nekusarudzika, saka kusazvibata hakuratidzike mune yakasarudzika mamiriro).

Source: opennet.ru

Voeg