Sign Up
Log In
Log In
or
Sign Up
Places
All Projects
Status Monitor
Collapse sidebar
openSUSE:Leap:15.2:Staging:D
vim
restrict-shell-commands.patch
Overview
Repositories
Revisions
Requests
Users
Attributes
Meta
File restrict-shell-commands.patch of Package vim
Index: vim-8.0.1568/src/evalfunc.c =================================================================== --- vim-8.0.1568.orig/src/evalfunc.c +++ vim-8.0.1568/src/evalfunc.c @@ -6434,7 +6434,7 @@ f_histadd(typval_T *argvars UNUSED, typv #endif rettv->vval.v_number = FALSE; - if (check_restricted() || check_secure()) + if (check_secure()) return; #ifdef FEAT_CMDHIST str = get_tv_string_chk(&argvars[0]); /* NULL on type error */ @@ -7439,6 +7439,9 @@ f_luaeval(typval_T *argvars, typval_T *r char_u *str; char_u buf[NUMBUFLEN]; + if (check_restricted() || check_secure()) + return; + str = get_tv_string_buf(&argvars[0], buf); do_luaeval(str, argvars + 1, rettv); } @@ -8161,6 +8164,9 @@ f_mzeval(typval_T *argvars, typval_T *re char_u *str; char_u buf[NUMBUFLEN]; + if (check_restricted() || check_secure()) + return; + str = get_tv_string_buf(&argvars[0], buf); do_mzeval(str, rettv); } @@ -8371,6 +8377,10 @@ f_py3eval(typval_T *argvars, typval_T *r char_u *str; char_u buf[NUMBUFLEN]; + if (check_restricted() || check_secure()) + return; + + str = get_tv_string_buf(&argvars[0], buf); if (p_pyx == 0) p_pyx = 3; @@ -8389,6 +8399,9 @@ f_pyeval(typval_T *argvars, typval_T *re char_u *str; char_u buf[NUMBUFLEN]; + if (check_restricted() || check_secure()) + return; + if (p_pyx == 0) p_pyx = 2; @@ -8404,6 +8417,10 @@ f_pyeval(typval_T *argvars, typval_T *re static void f_pyxeval(typval_T *argvars, typval_T *rettv) { + + if (check_restricted() || check_secure()) + return; + # if defined(FEAT_PYTHON) && defined(FEAT_PYTHON3) init_pyxversion(); if (p_pyx == 2) @@ -10245,7 +10262,7 @@ f_setbufvar(typval_T *argvars, typval_T typval_T *varp; char_u nbuf[NUMBUFLEN]; - if (check_restricted() || check_secure()) + if (check_secure()) return; (void)get_tv_number(&argvars[0]); /* issue errmsg if type error */ varname = get_tv_string_chk(&argvars[1]); @@ -10765,7 +10782,7 @@ f_settabvar(typval_T *argvars, typval_T rettv->vval.v_number = 0; - if (check_restricted() || check_secure()) + if (check_secure()) return; tp = find_tabpage((int)get_tv_number_chk(&argvars[0], NULL)); @@ -13581,7 +13598,7 @@ f_writefile(typval_T *argvars, typval_T list_T *list; rettv->vval.v_number = -1; - if (check_restricted() || check_secure()) + if (check_secure()) return; if (argvars[0].v_type != VAR_LIST) Index: vim-8.0.1568/src/ex_docmd.c =================================================================== --- vim-8.0.1568.orig/src/ex_docmd.c +++ vim-8.0.1568/src/ex_docmd.c @@ -2397,6 +2397,13 @@ do_one_cmd( goto doend; } #endif + + if (restricted != 0 && (ea.argt & EX_RESTRICT)) + { + errormsg = _("E981: Command not allowed in rvim"); + goto doend; + } + if (!curbuf->b_p_ma && (ea.argt & MODIFY)) { /* Command not allowed in non-'modifiable' buffer */ Index: vim-8.0.1568/src/if_perl.xs =================================================================== --- vim-8.0.1568.orig/src/if_perl.xs +++ vim-8.0.1568/src/if_perl.xs @@ -930,6 +930,7 @@ VIM_init(void) #ifdef DYNAMIC_PERL static char *e_noperl = N_("Sorry, this command is disabled: the Perl library could not be loaded."); #endif +static char *e_perlsandbox = N_("E299: Perl evaluation forbidden in sandbox without the Safe module"); /* * ":perl" @@ -978,13 +979,12 @@ ex_perl(exarg_T *eap) vim_free(script); } -#ifdef HAVE_SANDBOX - if (sandbox) + if (sandbox || secure) { safe = perl_get_sv("VIM::safe", FALSE); # ifndef MAKE_TEST /* avoid a warning for unreachable code */ if (safe == NULL || !SvTRUE(safe)) - EMSG(_("E299: Perl evaluation forbidden in sandbox without the Safe module")); + EMSG(_(e_perlsandbox)); else # endif { @@ -996,8 +996,8 @@ ex_perl(exarg_T *eap) } } else -#endif - perl_eval_sv(sv, G_DISCARD | G_NOARGS); + + perl_eval_sv(sv, G_DISCARD | G_NOARGS); SvREFCNT_dec(sv); @@ -1259,13 +1259,12 @@ do_perleval(char_u *str, typval_T *rettv ENTER; SAVETMPS; -#ifdef HAVE_SANDBOX - if (sandbox) + if (sandbox || secure) { safe = get_sv("VIM::safe", FALSE); # ifndef MAKE_TEST /* avoid a warning for unreachable code */ if (safe == NULL || !SvTRUE(safe)) - EMSG(_("E299: Perl evaluation forbidden in sandbox without the Safe module")); + EMSG(_(e_perlsandbox)); else # endif { @@ -1281,7 +1280,7 @@ do_perleval(char_u *str, typval_T *rettv } } else -#endif /* HAVE_SANDBOX */ + sv = eval_pv((char *)str, 0); if (sv) { Index: vim-8.0.1568/src/ex_cmds.h =================================================================== --- vim-8.0.1568.orig/src/ex_cmds.h +++ vim-8.0.1568/src/ex_cmds.h @@ -56,6 +56,7 @@ * curbuf_lock is set */ #define MODIFY 0x200000L /* forbidden in non-'modifiable' buffer */ #define EXFLAGS 0x400000L /* allow flags after count in argument */ +#define EX_RESTRICT 0x800000L // forbidden in restricted mode #define FILES (XFILE | EXTRA) /* multiple extra files allowed */ #define WORD1 (EXTRA | NOSPC) /* one extra word allowed */ #define FILE1 (FILES | NOSPC) /* 1 file allowed, defaults to current file */ @@ -860,13 +861,13 @@ EX(CMD_lunmap, "lunmap", ex_unmap, EXTRA|TRLBAR|NOTRLCOM|USECTRLV|CMDWIN, ADDR_LINES), EX(CMD_lua, "lua", ex_lua, - RANGE|EXTRA|NEEDARG|CMDWIN, + RANGE|EXTRA|NEEDARG|CMDWIN|EX_RESTRICT, ADDR_LINES), EX(CMD_luado, "luado", ex_luado, - RANGE|DFLALL|EXTRA|NEEDARG|CMDWIN, + RANGE|DFLALL|EXTRA|NEEDARG|CMDWIN|EX_RESTRICT, ADDR_LINES), EX(CMD_luafile, "luafile", ex_luafile, - RANGE|FILE1|NEEDARG|CMDWIN, + RANGE|FILE1|NEEDARG|CMDWIN|EX_RESTRICT, ADDR_LINES), EX(CMD_lvimgrep, "lvimgrep", ex_vimgrep, RANGE|NOTADR|BANG|NEEDARG|EXTRA|NOTRLCOM|TRLBAR|XFILE, @@ -929,10 +930,10 @@ EX(CMD_mode, "mode", ex_mode, WORD1|TRLBAR|CMDWIN, ADDR_LINES), EX(CMD_mzscheme, "mzscheme", ex_mzscheme, - RANGE|EXTRA|DFLALL|NEEDARG|CMDWIN|SBOXOK, + RANGE|EXTRA|DFLALL|NEEDARG|CMDWIN|SBOXOK|EX_RESTRICT, ADDR_LINES), EX(CMD_mzfile, "mzfile", ex_mzfile, - RANGE|FILE1|NEEDARG|CMDWIN, + RANGE|FILE1|NEEDARG|CMDWIN|EX_RESTRICT, ADDR_LINES), EX(CMD_next, "next", ex_next, RANGE|NOTADR|BANG|FILES|EDITCMD|ARGOPT|TRLBAR, @@ -1115,37 +1116,37 @@ EX(CMD_pwd, "pwd", ex_pwd, TRLBAR|CMDWIN, ADDR_LINES), EX(CMD_python, "python", ex_python, - RANGE|EXTRA|NEEDARG|CMDWIN, + RANGE|EXTRA|NEEDARG|CMDWIN|EX_RESTRICT, ADDR_LINES), EX(CMD_pydo, "pydo", ex_pydo, - RANGE|DFLALL|EXTRA|NEEDARG|CMDWIN, + RANGE|DFLALL|EXTRA|NEEDARG|CMDWIN|EX_RESTRICT, ADDR_LINES), EX(CMD_pyfile, "pyfile", ex_pyfile, - RANGE|FILE1|NEEDARG|CMDWIN, + RANGE|FILE1|NEEDARG|CMDWIN|EX_RESTRICT, ADDR_LINES), EX(CMD_py3, "py3", ex_py3, - RANGE|EXTRA|NEEDARG|CMDWIN, + RANGE|EXTRA|NEEDARG|CMDWIN|EX_RESTRICT, ADDR_LINES), EX(CMD_py3do, "py3do", ex_py3do, - RANGE|DFLALL|EXTRA|NEEDARG|CMDWIN, + RANGE|DFLALL|EXTRA|NEEDARG|CMDWIN|EX_RESTRICT, ADDR_LINES), EX(CMD_python3, "python3", ex_py3, - RANGE|EXTRA|NEEDARG|CMDWIN, + RANGE|EXTRA|NEEDARG|CMDWIN|EX_RESTRICT, ADDR_LINES), EX(CMD_py3file, "py3file", ex_py3file, - RANGE|FILE1|NEEDARG|CMDWIN, + RANGE|FILE1|NEEDARG|CMDWIN|EX_RESTRICT, ADDR_LINES), EX(CMD_pyx, "pyx", ex_pyx, - RANGE|EXTRA|NEEDARG|CMDWIN, + RANGE|EXTRA|NEEDARG|CMDWIN|EX_RESTRICT, ADDR_LINES), EX(CMD_pyxdo, "pyxdo", ex_pyxdo, - RANGE|DFLALL|EXTRA|NEEDARG|CMDWIN, + RANGE|DFLALL|EXTRA|NEEDARG|CMDWIN|EX_RESTRICT, ADDR_LINES), EX(CMD_pythonx, "pythonx", ex_pyx, - RANGE|EXTRA|NEEDARG|CMDWIN, + RANGE|EXTRA|NEEDARG|CMDWIN|EX_RESTRICT, ADDR_LINES), EX(CMD_pyxfile, "pyxfile", ex_pyxfile, - RANGE|FILE1|NEEDARG|CMDWIN, + RANGE|FILE1|NEEDARG|CMDWIN|EX_RESTRICT, ADDR_LINES), EX(CMD_quit, "quit", ex_quit, BANG|RANGE|COUNT|NOTADR|TRLBAR|CMDWIN, @@ -1199,13 +1200,13 @@ EX(CMD_runtime, "runtime", ex_runtime, BANG|NEEDARG|FILES|TRLBAR|SBOXOK|CMDWIN, ADDR_LINES), EX(CMD_ruby, "ruby", ex_ruby, - RANGE|EXTRA|NEEDARG|CMDWIN, + RANGE|EXTRA|NEEDARG|CMDWIN|EX_RESTRICT, ADDR_LINES), EX(CMD_rubydo, "rubydo", ex_rubydo, - RANGE|DFLALL|EXTRA|NEEDARG|CMDWIN, + RANGE|DFLALL|EXTRA|NEEDARG|CMDWIN|EX_RESTRICT, ADDR_LINES), EX(CMD_rubyfile, "rubyfile", ex_rubyfile, - RANGE|FILE1|NEEDARG|CMDWIN, + RANGE|FILE1|NEEDARG|CMDWIN|EX_RESTRICT, ADDR_LINES), EX(CMD_rundo, "rundo", ex_rundo, NEEDARG|FILE1, @@ -1472,13 +1473,13 @@ EX(CMD_tabs, "tabs", ex_tabs, TRLBAR|CMDWIN, ADDR_TABS), EX(CMD_tcl, "tcl", ex_tcl, - RANGE|EXTRA|NEEDARG|CMDWIN, + RANGE|EXTRA|NEEDARG|CMDWIN|EX_RESTRICT, ADDR_LINES), EX(CMD_tcldo, "tcldo", ex_tcldo, - RANGE|DFLALL|EXTRA|NEEDARG|CMDWIN, + RANGE|DFLALL|EXTRA|NEEDARG|CMDWIN|EX_RESTRICT, ADDR_LINES), EX(CMD_tclfile, "tclfile", ex_tclfile, - RANGE|FILE1|NEEDARG|CMDWIN, + RANGE|FILE1|NEEDARG|CMDWIN|EX_RESTRICT, ADDR_LINES), EX(CMD_tearoff, "tearoff", ex_tearoff, NEEDARG|EXTRA|TRLBAR|NOTRLCOM|CMDWIN,
Locations
Projects
Search
Status Monitor
Help
OpenBuildService.org
Documentation
API Documentation
Code of Conduct
Contact
Support
@OBShq
Terms
openSUSE Build Service is sponsored by
The Open Build Service is an
openSUSE project
.
Sign Up
Log In
Places
Places
All Projects
Status Monitor
