patch 9.2.0480: [security]: runtime(netrw): code injection via mf command

Problem:  [security]: runtime(netrw): code injection via mf command
          (Christopher Lusk, Zdenek Dohnal)
Solution: Do not use string concatenation inside the filter() commands
          (Zdenek Dohnal)

Github Security Advisory:
https://github.com/vim/vim/security/advisories/GHSA-66hr-7p6x-x5j3

Signed-off-by: Christian Brabandt <cb@256bit.org>

diff --git a/runtime/pack/dist/opt/netrw/autoload/netrw.vim b/runtime/pack/dist/opt/netrw/autoload/netrw.vim
index fbd396566a00c2ad48ecbaeeb18409d1ed4edd67..8681091f09196a43140a5d95339fd9d07683187e 100644 (file)
--- a/runtime/pack/dist/opt/netrw/autoload/netrw.vim
+++ b/runtime/pack/dist/opt/netrw/autoload/netrw.vim
@@ -1,7 +1,7 @@
 " Creator:    Charles E Campbell
 " Previous Maintainer: Luca Saccarola <github.e41mv@aleeas.com>
 " Maintainer: This runtime file is looking for a new maintainer.
-" Last Change: 2026 May 11
+" Last Change: 2026 May 14
 " Copyright:  Copyright (C) 2016 Charles E. Campbell {{{1
 "             Permission is hereby granted to use and distribute this code,
 "             with or without modifications, provided that this copyright
@@ -5153,7 +5153,7 @@ function s:NetrwMarkFile(islocal,fname)
 
         else
             " remove filename from buffer's markfilelist
-            call filter(s:netrwmarkfilelist_{curbufnr},'v:val != a:fname')
+            call filter(s:netrwmarkfilelist_{curbufnr}, {_, v -> v !=# a:fname})
             if s:netrwmarkfilelist_{curbufnr} == []
                 " local markfilelist is empty; remove it entirely
                 call s:NetrwUnmarkList(curbufnr,curdir)
@@ -5174,7 +5174,6 @@ function s:NetrwMarkFile(islocal,fname)
 
     else
         " initialize new markfilelist
-
         let s:netrwmarkfilelist_{curbufnr}= []
         call add(s:netrwmarkfilelist_{curbufnr},substitute(a:fname,'[|@]$','',''))
 
@@ -5194,7 +5193,7 @@ function s:NetrwMarkFile(islocal,fname)
             call add(s:netrwmarkfilelist,netrw#fs#ComposePath(b:netrw_curdir,a:fname))
         else
             " remove new filename from global markfilelist
-            call filter(s:netrwmarkfilelist,'v:val != "'.dname.'"')
+            call filter(s:netrwmarkfilelist, {_, v -> v !=# dname})
             if s:netrwmarkfilelist == []
                 unlet s:netrwmarkfilelist
             endif
@@ -7217,7 +7216,7 @@ function s:NetrwTreeDisplay(dir,depth)
         " hide given patterns
         let listhide= split(g:netrw_list_hide,',')
         for pat in listhide
-            call filter(w:netrw_treedict[dir],'v:val !~ "'.escape(pat,'\\').'"')
+            call filter(w:netrw_treedict[dir], {_, v -> v !~# pat})
         endfor
 
     elseif g:netrw_hide == 2

diff --git a/src/testdir/test_plugin_netrw.vim b/src/testdir/test_plugin_netrw.vim
index c6bd589a437830e13e8bd1fc34fbfcd4e904ec3b..72bf8300e6ea74b9c768bfb69b954ff85c4a38ff 100644 (file)
--- a/src/testdir/test_plugin_netrw.vim
+++ b/src/testdir/test_plugin_netrw.vim
@@ -725,4 +725,19 @@ func Test_netrw_bookmark_marked_file()
   bw!
 endfunc
 
+func Test_netrw_mf_command_injection()
+  CheckUnix
+  CheckExecutable touch
+  let path = tempname()
+  let fname = 'x" . execute("silent! !touch poc") . "'
+  call mkdir(path, 'R')
+  exe "cd " path
+  call writefile([], fname)
+  Explore .
+  call search('^x')
+  :norm mf
+  :norm mf
+  call assert_false(filereadable('poc'), 'Command injection via mf command')
+endfunc
+
 " vim:ts=8 sts=2 sw=2 et

diff --git a/src/version.c b/src/version.c
index c98028a80c9101e8bf0837639f55804c4d7ea308..df580d3de13cea2966091c869403bf09ac5da16e 100644 (file)
--- a/src/version.c
+++ b/src/version.c
@@ -729,6 +729,8 @@ static char *(features[]) =
 
 static int included_patches[] =
 {   /* Add new patch number below this line */
+/**/
+    480,
 /**/
     479,
 /**/