Files
vim/runtime/doc
Yasuhiro Matsumoto b076c49282 patch 9.2.0358: runtime(vimball): still path traversal attacks possible
Problem:  runtime(vimball): still path traversal attacks possible
Solution: block Windows driver letter paths (Yasuhiro Matsumoto)

The path traversal check in vimball#Vimball() did not reject file
names starting with a Windows drive letter (e.g. "C:/foo"). Backslashes
are normalized to forward slashes earlier, so UNC paths are caught by
the leading-slash check, but absolute drive-letter paths slipped
through and could write outside of g:vimball_home on Windows.

Add a "^\a:" check next to the existing "^/" check, and cover it with
a new test.

closes: #19989

Signed-off-by: Yasuhiro Matsumoto <mattn.jp@gmail.com>
Signed-off-by: Christian Brabandt <cb@256bit.org>
2026-04-16 20:03:39 +00:00
..
2026-02-14 15:19:10 +00:00
2026-03-31 15:20:08 +00:00
2026-02-14 15:19:10 +00:00
2026-02-14 15:19:10 +00:00
2026-02-14 15:19:10 +00:00
2024-08-20 19:57:00 +02:00
2026-02-14 15:19:10 +00:00
2026-02-14 15:19:10 +00:00
2026-02-14 15:19:10 +00:00
2026-02-14 15:19:10 +00:00
2026-02-14 15:19:10 +00:00
2026-02-14 15:19:10 +00:00
2026-02-14 15:19:10 +00:00
2026-02-14 15:19:10 +00:00
2026-02-14 15:19:10 +00:00
2026-02-14 15:19:10 +00:00
2026-02-14 15:19:10 +00:00
2026-02-14 15:19:10 +00:00
2026-02-14 15:19:10 +00:00
2026-02-14 15:19:10 +00:00
2026-02-14 15:19:10 +00:00
2026-02-14 15:19:10 +00:00
2026-02-14 15:19:10 +00:00
2026-02-14 15:19:10 +00:00
2026-02-14 15:19:10 +00:00
2026-02-14 15:19:10 +00:00
2026-02-14 15:19:10 +00:00
2026-02-14 15:19:10 +00:00
2026-02-14 15:19:10 +00:00
2026-02-14 15:19:10 +00:00
2025-08-10 10:28:16 +02:00
2026-02-14 15:19:10 +00:00
2026-02-14 15:19:10 +00:00
2026-02-14 15:19:10 +00:00
2026-02-14 15:19:10 +00:00
2026-02-14 15:19:10 +00:00
2026-02-14 15:19:10 +00:00
2026-02-14 15:19:10 +00:00
2026-02-14 15:19:10 +00:00
2026-02-14 15:19:10 +00:00
2026-02-14 15:19:10 +00:00
2026-02-14 15:19:10 +00:00
2026-02-14 15:19:10 +00:00
2026-02-14 15:19:10 +00:00
2026-02-14 15:19:10 +00:00
2026-02-14 15:19:10 +00:00
2026-02-14 15:19:10 +00:00
2026-02-14 15:19:10 +00:00
2026-02-14 15:19:10 +00:00
2026-02-14 15:19:10 +00:00
2026-02-14 15:19:10 +00:00
2026-02-14 15:19:10 +00:00
2026-02-14 15:19:10 +00:00
2026-02-14 15:19:10 +00:00
2026-02-14 15:19:10 +00:00
2026-02-14 15:19:10 +00:00
2026-02-14 15:19:10 +00:00
2026-02-14 15:19:10 +00:00
2026-02-14 15:19:10 +00:00
2026-02-14 15:19:10 +00:00
2026-02-14 15:19:10 +00:00
2026-02-14 15:19:10 +00:00
2026-02-14 15:19:10 +00:00
2026-02-14 15:19:10 +00:00
2026-02-14 15:19:10 +00:00
2026-02-14 15:19:10 +00:00
2026-02-14 15:19:10 +00:00
2026-02-14 15:19:10 +00:00
2026-02-14 15:19:10 +00:00
2026-02-14 15:19:10 +00:00
2026-02-14 15:19:10 +00:00
2026-02-14 15:19:10 +00:00
2026-02-14 15:19:10 +00:00
2026-02-14 15:19:10 +00:00
2026-02-14 15:19:10 +00:00
2026-02-14 15:19:10 +00:00
2026-02-14 15:19:10 +00:00
2026-02-14 15:19:10 +00:00
2025-10-07 19:19:43 +00:00
2024-08-20 19:57:00 +02:00
2026-02-14 15:19:10 +00:00