Yasuhiro Matsumoto
b076c49282
patch 9.2.0358: runtime(vimball): still path traversal attacks possible
...
Problem: runtime(vimball): still path traversal attacks possible
Solution: block Windows driver letter paths (Yasuhiro Matsumoto)
The path traversal check in vimball#Vimball() did not reject file
names starting with a Windows drive letter (e.g. "C:/foo"). Backslashes
are normalized to forward slashes earlier, so UNC paths are caught by
the leading-slash check, but absolute drive-letter paths slipped
through and could write outside of g:vimball_home on Windows.
Add a "^\a:" check next to the existing "^/" check, and cover it with
a new test.
closes : #19989
Signed-off-by: Yasuhiro Matsumoto <mattn.jp@gmail.com >
Signed-off-by: Christian Brabandt <cb@256bit.org >
2026-04-16 20:03:39 +00:00
..
2026-02-14 15:19:10 +00:00
2026-02-25 21:08:15 +00:00
2026-04-14 16:37:25 +00:00
2026-03-31 15:20:08 +00:00
2026-04-15 17:00:19 +00:00
2026-03-16 22:20:15 +00:00
2026-02-14 15:19:10 +00:00
2026-02-14 15:19:10 +00:00
2026-02-14 15:19:10 +00:00
2026-02-14 15:19:10 +00:00
2026-02-14 15:19:10 +00:00
2026-02-18 22:19:06 +00:00
2026-02-14 15:19:10 +00:00
2026-02-14 15:19:10 +00:00
2024-08-17 15:14:43 +02:00
2024-08-17 15:14:43 +02:00
2026-01-19 18:07:28 +00:00
2024-08-20 19:57:00 +02:00
2024-08-20 19:57:00 +02:00
2026-01-26 19:40:37 +00:00
2026-02-09 18:35:43 +00:00
2024-08-15 21:39:33 +02:00
2024-08-15 21:39:33 +02:00
2026-02-14 15:19:10 +00:00
2026-04-13 15:50:07 +02:00
2026-02-14 15:19:10 +00:00
2026-02-14 15:19:10 +00:00
2026-02-14 15:19:10 +00:00
2026-02-06 09:44:56 +00:00
2026-02-14 15:19:10 +00:00
2026-04-03 08:29:09 +00:00
2026-02-14 15:19:10 +00:00
2026-02-14 15:19:10 +00:00
2026-02-14 15:19:10 +00:00
2026-04-07 21:07:46 +00:00
2026-02-14 15:19:10 +00:00
2026-02-14 15:19:10 +00:00
2026-02-14 15:19:10 +00:00
2026-02-14 15:19:10 +00:00
2026-02-14 15:19:10 +00:00
2026-02-14 15:19:10 +00:00
2026-02-14 15:19:10 +00:00
2026-02-14 15:19:10 +00:00
2026-02-14 15:19:10 +00:00
2026-02-14 15:19:10 +00:00
2026-03-18 21:22:46 +00:00
2026-02-14 15:19:10 +00:00
2026-02-14 15:19:10 +00:00
2026-02-14 15:19:10 +00:00
2026-02-14 15:19:10 +00:00
2026-02-14 15:19:10 +00:00
2026-02-14 15:19:10 +00:00
2026-03-08 21:03:12 +00:00
2026-02-09 18:35:43 +00:00
2026-01-26 19:40:37 +00:00
2026-03-19 21:29:51 +00:00
2026-02-14 15:19:10 +00:00
2026-02-14 15:19:10 +00:00
2026-02-14 15:19:10 +00:00
2026-02-14 15:19:10 +00:00
2026-02-14 15:19:10 +00:00
2026-04-09 18:49:43 +00:00
2026-04-15 19:17:13 +00:00
2026-02-14 15:19:10 +00:00
2026-02-14 15:19:10 +00:00
2026-02-14 15:19:10 +00:00
2026-02-14 15:19:10 +00:00
2026-02-14 15:19:10 +00:00
2026-02-14 15:19:10 +00:00
2026-02-14 15:19:10 +00:00
2026-02-14 15:19:10 +00:00
2026-02-14 15:19:10 +00:00
2026-02-14 15:19:10 +00:00
2026-02-14 15:19:10 +00:00
2026-02-14 15:19:10 +00:00
2026-02-14 15:19:10 +00:00
2026-02-14 15:19:10 +00:00
2026-02-14 15:19:10 +00:00
2026-02-14 15:19:10 +00:00
2026-02-14 15:19:10 +00:00
2025-08-10 10:28:16 +02:00
2026-02-14 15:19:10 +00:00
2026-02-14 15:19:10 +00:00
2026-04-16 14:42:47 +02:00
2026-02-14 15:19:10 +00:00
2026-04-16 20:03:39 +00:00
2026-04-05 15:58:00 +00:00
2026-04-06 12:49:53 +00:00
2026-02-14 15:19:10 +00:00
2026-02-14 15:19:10 +00:00
2026-04-15 19:17:13 +00:00
2026-02-14 15:19:10 +00:00
2026-02-14 15:19:10 +00:00
2026-02-14 15:19:10 +00:00
2026-02-14 15:19:10 +00:00
2026-02-14 15:19:10 +00:00
2026-02-14 15:19:10 +00:00
2026-02-14 15:19:10 +00:00
2026-02-14 15:19:10 +00:00
2026-02-14 15:19:10 +00:00
2026-02-14 15:19:10 +00:00
2026-03-17 20:19:59 +00:00
2026-04-14 18:42:38 +00:00
2026-02-14 15:19:10 +00:00
2026-04-15 19:17:13 +00:00
2026-02-14 15:19:10 +00:00
2026-03-04 21:09:25 +00:00
2026-04-05 16:53:52 +00:00
2026-04-05 16:53:52 +00:00
2026-04-07 20:46:10 +00:00
2026-02-14 15:19:10 +00:00
2026-02-14 15:19:10 +00:00
2026-02-14 15:19:10 +00:00
2026-02-14 15:19:10 +00:00
2026-02-14 15:19:10 +00:00
2026-02-14 15:19:10 +00:00
2026-02-14 15:19:10 +00:00
2026-02-14 15:19:10 +00:00
2026-02-14 15:19:10 +00:00
2026-02-14 15:19:10 +00:00
2026-02-14 15:19:10 +00:00
2026-02-14 15:19:10 +00:00
2026-02-14 15:19:10 +00:00
2026-02-14 15:19:10 +00:00
2026-02-14 15:19:10 +00:00
2026-02-14 15:19:10 +00:00
2026-02-14 15:19:10 +00:00
2026-02-14 15:19:10 +00:00
2026-02-14 15:19:10 +00:00
2026-02-14 15:19:10 +00:00
2026-02-14 15:19:10 +00:00
2026-02-14 15:19:10 +00:00
2026-02-14 15:19:10 +00:00
2026-02-14 15:19:10 +00:00
2026-02-14 15:19:10 +00:00
2026-02-14 15:19:10 +00:00
2026-02-14 15:19:10 +00:00
2026-02-14 15:19:10 +00:00
2026-02-14 15:19:10 +00:00
2026-02-14 15:19:10 +00:00
2026-02-14 15:19:10 +00:00
2026-03-13 19:15:25 +00:00
2026-02-14 15:19:10 +00:00
2026-02-14 15:19:10 +00:00
2026-02-14 15:19:10 +00:00
2026-02-14 15:19:10 +00:00
2026-02-14 15:19:10 +00:00
2026-02-14 15:19:10 +00:00
2026-02-14 15:19:10 +00:00
2026-02-14 15:19:10 +00:00
2026-02-14 15:19:10 +00:00
2026-04-10 18:37:25 +00:00
2026-02-14 15:19:10 +00:00
2026-02-14 15:19:10 +00:00
2026-02-14 15:19:10 +00:00
2026-02-14 15:19:10 +00:00
2026-02-14 15:19:10 +00:00
2026-04-15 19:17:13 +00:00
2026-03-08 19:48:32 +00:00
2026-02-14 15:19:10 +00:00
2026-02-14 15:19:10 +00:00
2026-03-05 20:55:39 +00:00
2024-11-28 21:45:39 +01:00
2024-11-28 21:45:39 +01:00
2025-08-20 20:23:29 +02:00
2025-08-20 20:23:29 +02:00
2026-01-19 18:07:28 +00:00
2025-10-07 19:19:43 +00:00
2025-10-07 19:19:43 +00:00
2026-01-26 19:40:37 +00:00
2026-02-09 18:35:43 +00:00
2025-08-18 21:40:40 +02:00
2025-08-18 21:40:40 +02:00
2024-08-17 15:14:43 +02:00
2024-08-17 15:14:43 +02:00
2026-01-19 18:07:28 +00:00
2024-08-20 19:57:00 +02:00
2024-08-20 19:57:00 +02:00
2026-01-26 19:40:37 +00:00
2026-01-26 19:40:37 +00:00
2024-08-15 21:39:33 +02:00
2024-08-15 21:39:33 +02:00
2025-06-29 17:51:33 +02:00
2025-06-30 20:28:46 +02:00
2025-06-24 21:17:25 +02:00
2025-06-24 21:17:25 +02:00
2026-01-19 18:07:28 +00:00
2025-07-09 19:43:51 +02:00
2025-07-09 19:43:51 +02:00
2026-01-26 19:40:37 +00:00
2026-02-09 18:35:43 +00:00
2025-06-23 19:52:42 +02:00
2025-06-23 19:52:42 +02:00
2026-02-14 15:19:10 +00:00
2026-02-14 15:19:10 +00:00
2026-03-12 18:49:38 +00:00
2026-02-14 15:19:10 +00:00
2026-03-25 22:11:55 +00:00
2026-03-25 22:11:55 +00:00
2026-01-19 18:07:28 +00:00
2026-03-31 15:49:44 +00:00
2026-03-31 15:49:44 +00:00
2026-01-26 19:40:37 +00:00
2026-01-26 19:40:37 +00:00
2026-03-25 22:10:09 +00:00
2026-03-25 22:10:09 +00:00