runtime(tar): force wrapping on search()#19333
Open
KevinGoodsell wants to merge 1 commit intovim:masterfrom
Open
runtime(tar): force wrapping on search()#19333KevinGoodsell wants to merge 1 commit intovim:masterfrom
KevinGoodsell wants to merge 1 commit intovim:masterfrom
Conversation
Problem: search() is used to check for the message from tar that indicates leading slashes found in the tar archive, or to check for the leading slashes themselves. However, if 'nowrapscan' is in effect these searches are limited to the last line and don't find any results. This causes the warning message from tar to be seen in the buffer, the "Path Traversal Attack Detected" message to be omitted, and editing actions can fail. This can be seen, for example, when editing src/testdir/samples/evil.tar. Solution: Use the 'w' flag for search(). Signed-off-by: Kevin Goodsell <kevin-opensource@omegacrash.net>
KevinGoodsell
force-pushed
the
tar-wrapscan
branch
from
991f658 to
9026435
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Problem: search() is used to check for the message from tar that indicates leading slashes found in the tar archive, or to check for the leading slashes themselves. However, if 'nowrapscan' is in effect these searches are limited to the last line and don't find any results. This causes the warning message from tar to be seen in the buffer, the "Path Traversal Attack Detected" message to be omitted, and editing actions can fail. This can be seen, for example, when editing src/testdir/samples/evil.tar.
Solution: Use the 'w' flag for search().