Mercurial > vim
view runtime/ftplugin/changelog.vim @ 33203:c3c347a71e05
runtime: don't execute external commands when loading ftplugins
Commit: https://github.com/vim/vim/commit/f7ac0ef5098856bedca26e7073594a407c05636f
Author: Christian Brabandt <cb@256bit.org>
Date: Wed Sep 6 20:41:25 2023 +0200
runtime: don't execute external commands when loading ftplugins
This is a followup to 816fbcc262687b81fc46f82f7bbeb1453addfe0c (patch
9.0.1833: [security] runtime file fixes)
It basically disables that external commands are run on loading of the
filetype plugin, **unless** the user has set the `g:plugin_exec = 1`
global variable in their configuration or for a specific filetype the
variable g:<filetype>_exec=1.
There are a few more plugins, that may execute system commands like
debchangelog, gitcommit, sh, racket, zsh, ps1 but those do at least
do not run those commands by default during loading of the filetype plugin
(there the command is mostly run as convenience for auto-completion or
to provide documentation lookup).
closes: #13034
Signed-off-by: Christian Brabandt <cb@256bit.org>
Co-authored-by: Tim Pope <vim@tpope.org>
author | Christian Brabandt <cb@256bit.org> |
---|---|
date | Wed, 06 Sep 2023 20:45:03 +0200 |
parents | ebedba7a4898 |
children | bd3ee5abdd7a |
line wrap: on
line source
" Vim filetype plugin file " Language: generic Changelog file " Maintainer: Martin Florian <marfl@posteo.de> " Previous Maintainer: Nikolai Weibull <now@bitwi.se> " Latest Revision: 2021-10-17 " Variables: " g:changelog_timeformat (deprecated: use g:changelog_dateformat instead) - " description: the timeformat used in ChangeLog entries. " default: "%Y-%m-%d". " g:changelog_dateformat - " description: the format sent to strftime() to generate a date string. " default: "%Y-%m-%d". " g:changelog_username - " description: the username to use in ChangeLog entries " default: try to deduce it from environment variables and system files. " Local Mappings: " <Leader>o - " adds a new changelog entry for the current user for the current date. " Global Mappings: " <Leader>o - " switches to the ChangeLog buffer opened for the current directory, or " opens it in a new buffer if it exists in the current directory. Then " it does the same as the local <Leader>o described above. " Notes: " run 'runtime ftplugin/changelog.vim' to enable the global mapping for " changelog files. " TODO: " should we perhaps open the ChangeLog file even if it doesn't exist already? " Problem is that you might end up with ChangeLog files all over the place. " If 'filetype' isn't "changelog", we must have been to add ChangeLog opener if &filetype == 'changelog' if exists('b:did_ftplugin') finish endif let b:did_ftplugin = 1 let s:cpo_save = &cpo set cpo&vim " Set up the format used for dates. if !exists('g:changelog_dateformat') if exists('g:changelog_timeformat') let g:changelog_dateformat = g:changelog_timeformat else let g:changelog_dateformat = "%Y-%m-%d" endif endif function! s:username() if exists('g:changelog_username') return g:changelog_username elseif $EMAIL != "" return $EMAIL elseif $EMAIL_ADDRESS != "" return $EMAIL_ADDRESS endif let s:default_login = 'unknown' " Disabled by default for security reasons. if get(g:, 'changelog_exec', get(g:, 'plugin_exec', 0)) let login = s:login() else let login = s:default_login endif return printf('%s <%s@%s>', s:name(login), login, s:hostname()) endfunction function! s:login() return s:trimmed_system_with_default('whoami', s:default_login) endfunction function! s:trimmed_system_with_default(command, default) return s:first_line(s:system_with_default(a:command, a:default)) endfunction function! s:system_with_default(command, default) let output = system(a:command) if v:shell_error return a:default endif return output endfunction function! s:first_line(string) return substitute(a:string, '\n.*$', "", "") endfunction function! s:name(login) for name in [s:gecos_name(a:login), $NAME, s:capitalize(a:login)] if name != "" return name endif endfor endfunction function! s:gecos_name(login) for line in s:try_reading_file('/etc/passwd') if line =~ '^' . a:login . ':' return substitute(s:passwd_field(line, 5), '&', s:capitalize(a:login), "") endif endfor return "" endfunction function! s:try_reading_file(path) try return readfile(a:path) catch return [] endtry endfunction function! s:passwd_field(line, field) let fields = split(a:line, ':', 1) if len(fields) < a:field return "" endif return fields[a:field - 1] endfunction function! s:capitalize(word) return toupper(a:word[0]) . strpart(a:word, 1) endfunction function! s:hostname() return s:trimmed_system_with_default('hostname', 'localhost') endfunction " Format used for new date entries. if !exists('g:changelog_new_date_format') let g:changelog_new_date_format = "%d %u\n\n\t* %p%c\n\n" endif " Format used for new entries to current date entry. if !exists('g:changelog_new_entry_format') let g:changelog_new_entry_format = "\t* %p%c" endif " Regular expression used to find a given date entry. if !exists('g:changelog_date_entry_search') let g:changelog_date_entry_search = '^\s*%d\_s*%u' endif " Regular expression used to find the end of a date entry if !exists('g:changelog_date_end_entry_search') let g:changelog_date_end_entry_search = '^\s*$' endif " Substitutes specific items in new date-entry formats and search strings. " Can be done with substitute of course, but unclean, and need \@! then. function! s:substitute_items(str, date, user, prefix) let str = a:str let middles = {'%': '%', 'd': a:date, 'u': a:user, 'p': a:prefix, 'c': '{cursor}'} let i = stridx(str, '%') while i != -1 let inc = 0 if has_key(middles, str[i + 1]) let mid = middles[str[i + 1]] let str = strpart(str, 0, i) . mid . strpart(str, i + 2) let inc = strlen(mid) - 1 endif let i = stridx(str, '%', i + 1 + inc) endwhile return str endfunction " Position the cursor once we've done all the funky substitution. function! s:position_cursor() if search('{cursor}') > 0 let lnum = line('.') let line = getline(lnum) let cursor = stridx(line, '{cursor}') call setline(lnum, substitute(line, '{cursor}', '', '')) endif startinsert endfunction " Internal function to create a new entry in the ChangeLog. function! s:new_changelog_entry(prefix) " Deal with 'paste' option. let save_paste = &paste let &paste = 1 call cursor(1, 1) " Look for an entry for today by our user. let date = strftime(g:changelog_dateformat) let search = s:substitute_items(g:changelog_date_entry_search, date, \ s:username(), a:prefix) if search(search) > 0 " Ok, now we look for the end of the date entry, and add an entry. call cursor(nextnonblank(line('.') + 1), 1) if search(g:changelog_date_end_entry_search, 'W') > 0 let p = (line('.') == line('$')) ? line('.') : line('.') - 1 else let p = line('.') endif let ls = split(s:substitute_items(g:changelog_new_entry_format, '', '', a:prefix), \ '\n') call append(p, ls) call cursor(p + 1, 1) else " Flag for removing empty lines at end of new ChangeLogs. let remove_empty = line('$') == 1 " No entry today, so create a date-user header and insert an entry. let todays_entry = s:substitute_items(g:changelog_new_date_format, \ date, s:username(), a:prefix) " Make sure we have a cursor positioning. if stridx(todays_entry, '{cursor}') == -1 let todays_entry = todays_entry . '{cursor}' endif " Now do the work. call append(0, split(todays_entry, '\n')) " Remove empty lines at end of file. if remove_empty $-/^\s*$/-1,$delete endif " Reposition cursor once we're done. call cursor(1, 1) endif call s:position_cursor() " And reset 'paste' option let &paste = save_paste endfunction let b:undo_ftplugin = "setl com< fo< et< ai<" setlocal comments= setlocal formatoptions+=t setlocal noexpandtab setlocal autoindent if &textwidth == 0 setlocal textwidth=78 let b:undo_ftplugin .= " tw<" endif if !exists("no_plugin_maps") && !exists("no_changelog_maps") && exists(":NewChangelogEntry") != 2 nnoremap <buffer> <silent> <Leader>o :<C-u>call <SID>new_changelog_entry('')<CR> xnoremap <buffer> <silent> <Leader>o :<C-u>call <SID>new_changelog_entry('')<CR> command! -buffer -nargs=0 NewChangelogEntry call s:new_changelog_entry('') let b:undo_ftplugin .= " | sil! exe 'nunmap <buffer> <Leader>o'" . \ " | sil! exe 'vunmap <buffer> <Leader>o'" . \ " | sil! delc NewChangelogEntry" endif let &cpo = s:cpo_save unlet s:cpo_save else let s:cpo_save = &cpo set cpo&vim if !exists("no_plugin_maps") && !exists("no_changelog_maps") " Add the Changelog opening mapping nnoremap <silent> <Leader>o :call <SID>open_changelog()<CR> let b:undo_ftplugin .= " | silent! exe 'nunmap <buffer> <Leader>o" endif function! s:open_changelog() let path = expand('%:p:h') if exists('b:changelog_path') let changelog = b:changelog_path else if exists('b:changelog_name') let name = b:changelog_name else let name = 'ChangeLog' endif while isdirectory(path) let changelog = path . '/' . name if filereadable(changelog) break endif let parent = substitute(path, '/\+[^/]*$', "", "") if path == parent break endif let path = parent endwhile endif if !filereadable(changelog) return endif if exists('b:changelog_entry_prefix') let prefix = call(b:changelog_entry_prefix, []) else let prefix = substitute(strpart(expand('%:p'), strlen(path)), '^/\+', "", "") endif let buf = bufnr(changelog) if buf != -1 if bufwinnr(buf) != -1 execute bufwinnr(buf) . 'wincmd w' else execute 'sbuffer' buf endif else execute 'split' fnameescape(changelog) endif call s:new_changelog_entry(prefix) endfunction let &cpo = s:cpo_save unlet s:cpo_save endif