Problem:
msgpack#strptime() finds a timestamp by bisecting strftime() output, and
brackets the search with the extreme UTC offsets. The lower bound
subtracts 12 hours, but -12:00 is the westernmost offset, which produces
the *largest* timestamp for a given local time. The easternmost offset
is +14:00, so in any zone east of UTC+12 the search can start above the
target and the function throws:
internal-start-string:Internal error: start > string
With TZ=GMT-14, four of the five timestamps in msgpack_spec.lua fail,
as do three tests in shada_spec.lua, which reaches the same function
through shada#strings_to_sd().
Solution:
Subtract 14 hours instead. The upper bound is already generous enough at
+14, and widening a bisection bracket downwards cannot change the result
in zones that worked before.
The test disables the python3 provider, because msgpack#strptime() only
uses the Vimscript implementation changed here when no provider answers,
and otherwise hands the work to datetime.strptime().
AI-assisted
Problem:
The bundled `zip` plugin is implemented in Vimscript, making it harder to
maintain and build on with Nvim's Lua runtime infrastructure.
Solution:
Add an opt-out `zip.lua` browser backed by `nvim.dir`, and disable the legacy
Vimscript implementation by moving it to `pack/dist/opt/zip/`. Load it with
`:packadd zip`.
Problem: s:SearchBracket()'s skip-expression matches syntax group
names ending in "Comment", "Todo", or "String" to decide
whether a candidate bracket is inside a string/comment
and should be skipped for indentation purposes. Byte and
raw-byte string literals (b"...", rb"...") are highlighted
via the pythonBytes/pythonRawBytes syntax groups, which
don't end in "String", so brackets inside them (e.g.
b"[") were never skipped and were counted as real,
unmatched brackets, producing incorrect indentation.
Solution: Add "Bytes" to the indent script's existing suffix match,
so pythonBytes/pythonRawBytes are recognized directly, the
same way pythonString/pythonFString/pythonRawString
already are.
This supersedes an earlier version of this fix that
renamed pythonBytes/pythonRawBytes to
pythonBytesString/pythonRawBytesString in
runtime/syntax/python.vim.
fixes: vim/vim#20812closes: vim/vim#20827https://github.com/vim/vim/commit/f88e7191da1a03b2e79a2ba5fbc26f4948bcca81
Co-authored-by: qwavies <qwavsbusiness@gmail.com>
Problem: [security]: arbitrary Ex command execution during C
omni-completion (Threonine)
Solution: Match tags typeref literally to block Ex command injection
(Yasuhiro Matsumoto).
Escaping only "/" and "\" left the typeref able to break out of the
:vimgrep pattern without a "/": an unclosed "[" makes vimgrep's pattern
skipping fail, and the parser then treats a following "|" as a command
separator, so the tag value runs as Ex commands during C omni-completion.
Match the field literally with \V so no regex metacharacter can affect
pattern parsing.
Github Security Advisory:
https://github.com/vim/vim/security/advisories/GHSA-cx73-phcg-3j5ghttps://github.com/vim/vim/commit/2f628d8104958fa7421664f792ca6d4f7a39a10f
Co-authored-by: Yasuhiro Matsumoto <mattn.jp@gmail.com>
Patch 9.2.0306 fixed malformed lz4 extraction commands by using "tar -I lz4"
on Linux and leaving non-Linux tar implementations to auto-detect lz4 input.
That still fails on systems where tar does not support either -I lz4 or
automatic lz4 decompression, such as Solaris /usr/bin/tar.
Keep the existing Linux path using GNU tar's "-I lz4" support. For non-Linux
systems, use lz4 explicitly to decompress the archive to stdout and feed the
resulting tar stream to the configured tar extraction command. This is the
same style tar.vim already used for lz4 archives before patch 9.2.0306.
Follow-up for vim/vim#19925closes: vim/vim#20555https://github.com/vim/vim/commit/b0ce576fbc7af4a33226a8d076a01aadd024a23e
Co-authored-by: Vladimír Marek <vlmarek13@gmail.com>
Problem: The security patch 9.2.0561 added a vim.eval() call inside
Completer.evalsource() to honor g:pythoncomplete_allow_import.
But the 'vim' module is only imported inside the outer
vimcomplete() / vimpy3complete() function, not at the script's
top level, so referring to it from a Completer method raises
NameError. The surrounding bare 'except' silently swallows
the error and leaves allow_imports at 0, meaning the opt-in
never takes effect -- 'import os' (and any other
buffer-level import) is always skipped, no candidates are
produced for 'os.<...>' and
Test_popup_and_preview_autocommand() fails on the Windows
CI matrix (Linux skips the test because Python 2 is absent).
Solution: Re-import 'vim' at the top of evalsource() in both
pythoncomplete.vim and python3complete.vim so the eval reads
the global, and set g:pythoncomplete_allow_import = 1 in the
test (it is the opt-in intended for callers that trust the
buffer contents) (thinca).
closes: vim/vim#20386https://github.com/vim/vim/commit/868ad62cb8bf8038322eab2badd31bd98b02b9df
Co-authored-by: thinca <thinca@gmail.com>
Problem: tests: no test for using shellescape() in combination with :!
Solution: Add a test that checks runtime files for using wrong
combination of shellescape() with ! ex command
This has lead to a few security relevant issues, so add a test that
checks all runtime files for any ! followed by a shellescape() that does
not use the {special} arg.
related: Commit: 3fb5e58fbc63d86a3e65f1a141b0d67af2 (patch 9.2.0479:
[security]: runtime(tar): command injection in tar plugin)
closes: vim/vim#20286
Supported by AI
https://github.com/vim/vim/commit/fccc2adc98c3d6664f1f2d8ddab17b096e647986
Co-authored-by: Christian Brabandt <cb@256bit.org>
Problem: shellescape() called without {special} flag for :! ex command
Solution: Pass 1 as second argument to shellescape() in :! contexts
related: Commit: 3fb5e58fbc63d86a3e65f1a141b0d67af2 (patch 9.2.0479:
[security]: runtime(tar): command injection in tar plugin)
https://github.com/vim/vim/commit/129486193c16bb5c0208eff5501f9e665b7c4803
Co-authored-by: Christian Brabandt <cb@256bit.org>
Problem: Expected text for interactive marks is in a separate json file
from the tutor file. When the tutor file is updated, line numbers
(potentially many) have to be updated in the json file. This is a
burden for maintenance and automatic testing.
Solution: Put the expected text inline in the tutor file, marked
with `[[]]`. Parse and remove the comments before opening the tutor
file so extmarks can be applied.
Problem: runtime(tar): missing path traversal checks in tar#Extract()
Solution: Add check for leading slash, however gnu tar should already
detect this (q1uf3ng)
tar#Extract() did not check for ../ sequences or absolute paths,
unlike zip#Extract() which was patched in recent commits. Add the
same checks: ../ (relative traversal), leading slash (Unix), drive
letter and UNC/leading slash (Windows).
closes: vim/vim#19981https://github.com/vim/vim/commit/490b737f3e172c3c66744c7531ee85f19618419d
Co-authored-by: q1uf3ng <q1uf3ng@protone.me>
zip#Write(): the Windows path check did not match a single leading
slash (/path), which resolves to the current drive root on Windows.
Simplify the regex to match any leading slash or backslash.
zip#Extract(): add absolute path checks for both Unix and Windows,
matching the existing checks in zip#Write().
closes: vim/vim#19976https://github.com/vim/vim/commit/351a16c88f56aeeca5e06095624dd701b264b2a9
Co-authored-by: q1uf3ng <q1uf3ng@protone.me>
Problem:
Neovim's Node.js provider does not support the Bun package manager.
PR #26829 attempted to add this but used a hardcoded path and was abandoned.
Solution:
- Use `bun pm bin -g` to dynamically locate the global binary directory.
- Update `health.lua` to recognize bun installations.
Problem: runtime(tar): but with dotted path
Solution: Do not strip everything after the first dot
(Aaron Burrow)
tar#Extract was getting the extensionless basename by
stripping away everything starting with the leftmost
dot. So if a directory had a dot or the file had an
'extra' dot then the code did the wrong thing. For
example, if it was given:
/tmp/foo.bar/baz.tar.gz
Then it would treat /tmp/foo as the extensionless
basename, but it actually should have grabbed:
/tmp/foo.bar/baz
This patch fixes the issue by instead looking at the
rightmost dot(s).
This bug was discovered by ChatGPT 5.4. I wrote the
patch and tested vim.
closes: vim/vim#19930https://github.com/vim/vim/commit/4a1bcc67b4b6fc2dfe564ab4faca490f8afac857
Co-authored-by: Aaron Burrow <burrows@fastmail.com>
Problem: patch 9.2.0325: runtime(tar): bug in zstd handling
Solution: use correct --zstd argument, separated from other arguments,
rework testing framework (Aaron Burrow).
The tar.vim plugin allows vim to read and manipulate zstd archives,
but it had a bug that caused extraction attempts to fail.
Specifically, if the archive has a .tar.zst or .tzst extension, then
the code was generating invalid extraction commands that looked like
this:
tar --zstdpxf foo.tar.zst foo
When they should be like this:
tar --zstd -pxf foo.tar.zst foo
This patch changes the flag manipulation logic so that --zstd isn't
glued to pxf.
The labor for this change was divided between ChatGPT 5.4 and me.
ChatGPT 5.4 identified the issue (from a code scan?), and I wrote
the patch and tested vim.
related: vim/vim#19930https://github.com/vim/vim/commit/00285c035aa7d92971bc50b7b124e1408dda53ad
Note: tests need the next patch to pass in Nvim.
Co-authored-by: Aaron Burrow <burrows@fastmail.com>
Problem: runtime(tar): some issues with lz4 support
Solution: Fix bugs (see below) (Aaron Burrow)
The tar plugin allows users to extract files from tar archives that are
compressed with lz4. But, tar#Extract() builds malformed extraction commands
for lz4-compressed tar archives. This commit fixes three issues in that code.
The first affects archives with a .tlz4 extension and the other two affect
archives with .tar.lz4 extension (but one of these is symmetric to the issue
that .tlz4 archives had).
(1) When trying to extract .tlz4 archives the command created by
tar#Extract looked like this:
tar -I lz4pxf foo.tlz4 foo
This isn't right. It should be something like this:
tar -I lz4 -pxf foo.tlz4 foo
This was happening because tar.plugin is just substituting on the
first - in "tar -pxf". This works fine if we just add a simple flag for
extraction (eg, z for .tgz), but for lz4 we need to add "-I lz4".
I don't believe that there is an obvious good way to fix this without
reworking the way the command is generated. Probably we should collect
the command and flags separately and the flags should be stored in a
set. Then put everything together into a string just before issuing it
as an extraction command. Unfortunately, this might break things for users
because they have access to tar_extractcmd.
This patch just makes the substitution a little bit more clever so that it
does the right thing when substituting on a string like "tar -pxf".
(2) .tar.lz4 extractions had the same issue, which my patch fixes in
the same way.
(3) .tar.lz4 extractions had another issue. There was a space missing
in the command generated by tar#Extract. This meant that commands
looked like this (notice the lack of space between the archive and output
file names):
tar -I lz4pxf foo.tar.lz4foo
This patch just puts a space where it should be.
Finally, I should note that ChatGPT 5.4 initially identified this issue
in the code and generated the test cases. I reviewed the test cases,
wrote the patch, and actually ran vim against the tests (both with and
without the patch).
closes: vim/vim#19925https://github.com/vim/vim/commit/78954f86c2027c766d9e2b5f7904b5fb4041d250
Co-authored-by: Aaron Burrow <burrows@fastmail.com>
Problem:
`:Tutor` should open a copy of the tutor file instead of the original. This is
because edits modify the original file buffer, and crashes or other misuse could
potentially corrupt the original file even if it's WO.
Solution:
Copy the tutor file to a temp path before opening. Store the original path in
`b:tutor_file` so metadata json loading still works.
- `tutor#TutorCmd` will now copy the tutor file to a temp path via `tempname()`
before opening with `drop`. Store the original path in `b:tutor_file` only
after the buffer is created.
- `tutor#LoadMetadata` now uses `b:tutor_file` to resolve the JSON path instead
of `expand('%')`, which now points to the temp copy buffer
- `ftplugin/tutor.vim` does not make the `tutor#LoadMetadata` call anymore. It
was guarded by `filereadable(expand('%').'.json')` which fails for the new
temp copy path logic . Instead, `tutor#LoadMetadata` is already called
directly inside `tutor#TutorCmd` since we are already assumed to enable
interactive.
Co-authored-by: Phạm Bình An <111893501+brianhuster@users.noreply.github.com>
Problem: search() is used to check for the message from tar that
indicates leading slashes found in the tar archive, or to
check for the leading slashes themselves. However, if
'nowrapscan' is in effect these searches are limited to the
last line and don't find any results. This causes the warning
message from tar to be seen in the buffer, the "Path Traversal
Attack Detected" message to be omitted, and editing actions
can fail. This can be seen, for example, when editing
src/testdir/samples/evil.tar.
Solution: Use the 'w' flag for search() (Kevin Goodsell)
closes: vim/vim#19333https://github.com/vim/vim/commit/18d844e365c21043d187f142bc88e75e9966822f
Co-authored-by: Kevin Goodsell <kevin-opensource@omegacrash.net>
This reverts commits:
- 6b652a785033fd4164e049492a7327c1ed7c3e5f
- 2f689d5abde0ccddca9e20d8c93a0299bd054e32
- a025a46d4169587145fb54f04af349cd05cb6122
Several email addresses that are known to be valid caused bounces
due to an issue with my email setup. The previous commits incorrectly
marked these addresses as invalid. So revert the whole thing again.
https://github.com/vim/vim/commit/62d8f3dab5a0b30c31a8df86a973c5e59821a3f0
N/A patch:
vim-patch:2f689d5: runtime: mark more invalid email addresses
Co-authored-by: Christian Brabandt <cb@256bit.org>
Volodymyr Chernetskyi