annotate SECURITY.md @ 34196:57b21d421cb2 v9.1.0048

patch 9.1.0048: Abort opening cmdwin if autocmds screw things up Commit: https://github.com/vim/vim/commit/43b395ec2e7d24a067d7cb00109818b64da144a5 Author: Sean Dewar <seandewar@users.noreply.github.com> Date: Wed Aug 16 16:17:31 2023 +0100 patch 9.1.0048: Abort opening cmdwin if autocmds screw things up Problem: Autocmds triggered from opening the cmdwin (in win_split and do_ecmd) can cause issues such as E199, as the current checks are insufficient. Solution: Commands executed from the cmdwin apply to the old curwin/buf, so they should be kept in a "suspended" state; abort if they've changed. Also abort if cmdwin/buf was tampered with, and check that curwin is correct. Try to clean up the cmdwin buffer (only if hidden and non-current to simplify things; the same approach is used when closing cmdwin normally), and add a beep. (Sean Dewar) It'd be nice to also check that curwin was *really* created by win_split, as autocommands can change curwin before it returns (so it can't be assumed to be that of the split); for now, this means that the cmdwin may not be the botwin in that case, which is probably OK. closes: #12819 Signed-off-by: Sean Dewar <seandewar@users.noreply.github.com> Signed-off-by: Christian Brabandt <cb@256bit.org>
author Christian Brabandt <cb@256bit.org>
date Tue, 23 Jan 2024 23:00:05 +0100
parents 13e4398925ea
children
Ignore whitespace changes - Everywhere: Within whitespace: At end of lines:
rev   line source
32717
b807b0aa8e1f Add security policy (#12687)
Christian Brabandt <cb@256bit.org>
parents:
diff changeset
1 # Security Policy
b807b0aa8e1f Add security policy (#12687)
Christian Brabandt <cb@256bit.org>
parents:
diff changeset
2
b807b0aa8e1f Add security policy (#12687)
Christian Brabandt <cb@256bit.org>
parents:
diff changeset
3 ## Reporting a vulnerability
b807b0aa8e1f Add security policy (#12687)
Christian Brabandt <cb@256bit.org>
parents:
diff changeset
4
33648
13e4398925ea please report security issues to the vim-security list
Christian Brabandt <cb@256bit.org>
parents: 33616
diff changeset
5 If you want to report a security issue, please privately disclose the issue to the vim-security mailing list
13e4398925ea please report security issues to the vim-security list
Christian Brabandt <cb@256bit.org>
parents: 33616
diff changeset
6 vim-security@googlegroups.com
13e4398925ea please report security issues to the vim-security list
Christian Brabandt <cb@256bit.org>
parents: 33616
diff changeset
7
13e4398925ea please report security issues to the vim-security list
Christian Brabandt <cb@256bit.org>
parents: 33616
diff changeset
8 This is a private list, read only by the maintainers, but anybody can post, after moderation.
32717
b807b0aa8e1f Add security policy (#12687)
Christian Brabandt <cb@256bit.org>
parents:
diff changeset
9
b807b0aa8e1f Add security policy (#12687)
Christian Brabandt <cb@256bit.org>
parents:
diff changeset
10 **Please don't publicly disclose the issue until it has been addressed by us.**