Ukuba sengozini ku-Vim okuholela ekwenzeni ikhodi lapho kuvulwa ifayela eliyingozi

Kubahleli bombhalo Vim и neovim kutholiwe ukuba sengozini (I-CVE-2019-12735), okuvumela ikhodi engafanele ukuthi isetshenziswe lapho kuvulwa ifayela eliklanywe ngokukhethekile. Inkinga yenzeka uma imodi yemodeli ezenzakalelayo (“:set modeline”) isebenza, ekuvumela ukuthi uchaze izinketho zokuhlela kufayela elicutshunguliwe. Ukuba sengozini kulungisiwe ekukhishweni
Vim 8.1.1365 и I-Neovim 0.3.6.

Inombolo elinganiselwe kuphela yezinketho ezingafakwa nge-modeline. Uma isisho sicaciswe njengenani lenketho, sisetshenziswa kumodi ye-sandbox, evumela kuphela ukusebenza okulula okuphephile. Kulokhu, umyalo ovumelekile uhlanganisa umyalo othi “:source”, lapho ungasebenzisa khona isilungisi “!”. ukusebenzisa imiyalo engafanele efayeleni elishiwo. Ngakho, ukwenza ikhodi, kwanele ukukhombisa emugqeni wemodeli ukwakhiwa okufana nokuthi “set foldexpr=execute('\:source! some_file'):". Ku-Neovim, ukwenza ukushaya kunqatshelwe, kodwa i-assert_fails ingasetshenziswa esikhundleni salokho.

Isibonelo, ukusebenzisa umyalo othi "uname -a", vele uvule ifayela ku-Vim noma i-Neovim umugqa wayo wokuqala noma wokugcina uthi:

:!uname -a||» vi:fen:fdm=expr:fde=assert_fails(“umthombo\!\ \%”):fdl=0:fdt=”

Inkampani "umthombo! %" izofunda imiyalo efayeleni lamanje bese ngokufanele isebenzise ":!uname -a". Ukulandelana kwe-Escape kungasetshenziswa ukufihla umugqa onikeziwe ekukhishweni yinsizakalo yekati. Ngokwesibonelo, kulokhu sebenzisa i-prototype lapho uvula ifayela ku-vim, kwakhiwa uxhumano lwenethiwekhi olunokufinyelela kwegobolondo ohlelweni lwesisulu, kodwa leli fayela ngeke livuse izinsolo lapho likhishwa esigungwini kusetshenziswa insiza yekati.

Ungahlola umsebenzi wemodi yemodeli ngomyalo othi “:set modeline?”. Ukuyikhubaza, ungangeza umugqa "setha i-nomodeline" ku-vimrc. Ekwabalweni inkinga ilungisiwe RHEL, SUSE/openSUSE, Fedora, I-FreeBSD, Ubuntu, I-Arch Linux и ALT. Ubungozi buhlala bungakafakwa Debian (ku-Debian modeline ivaliwe ngokuzenzakalelayo, ngakho ubungozi akuveli esimweni esimisiwe).

Source: opennet.ru