Vim/Neovim Arbitrary Code Execution via Modelines

Re:Vim/Neovim Arbitrary Code Execution via Modelines by dmix on Tuesday June 04, 2019 @06:31PM (#20099900)

Modelines are pretty much only for single-use scripts or non important files but are still very useful (the security implications are concerning though).

Usually just to `set ft=zsh' to set a filetype on a file with no (or incorrect) file extensions. Which syntax highlighting and other plugins rely on to activate.

For example, I use them on a TODO.md file to set it as a `task` filetype which is a markdown-friendly todo list: https://github.com/irrationalistic/vim-tasks whereas in Github I want it to render as markdown only so I keep the file extension `.md`.

Another usecase is system/software user config files which have all sorts of file extensions (ie, `.rc` or '.conf') but use a variety of internal formatting (ie, json). These files never leave your personal machines or arrive that way, in my experience at least.

I'd imagine they'd also stick out like a sore-thumb at the bottom of most files if they were maliciously inserted but I'm sure there's some exceptions (targets who don't know what Vim modelines are).

[ Parent | on HN ]

Re:Vim/Neovim Arbitrary Code Execution via Modelines by ebeip90 on Tuesday June 04, 2019 @07:28PM (#20100189)

Why not just set a shebang like

    $ cat foo.sh
    #!/usr/bin/env zsh
    echo $SHELL

Which most editors understand.

    $ file foo.sh
    foo.sh: a /usr/bin/env zsh script text executable, ASCII text
    $ vim --clean -c ':set filetype?' foo.sh
    ...
    filetype=zsh

This ALSO ensures that the correct shell is invoked on your script, instead of your current or default shell.

    $ ./foo.sh
    /usr/local/bin/zsh

[ Parent | on HN ]

Re:Vim/Neovim Arbitrary Code Execution via Modelines by k_sze on Tuesday June 04, 2019 @08:14PM (#20100427)

If the script file is meant to be sourced only, then a shebang is bad style as it gives the wrong hints to human readers.

[ Parent | on HN ]

Re:Vim/Neovim Arbitrary Code Execution via Modelines by JetSpiegel on Friday June 07, 2019 @04:25AM (#20122656)

chmod -x

[ Parent | on HN ]

Re:Vim/Neovim Arbitrary Code Execution via Modelines by dmix on Tuesday June 04, 2019 @11:05PM (#20101144)

I don't see how that helps either of my examples (TODO.md, config files).

Even when it's actual part of ZSH script I'm only using `ft=zsh` when it's a file I'm sourcing, not intended as a runnable script by itself. For example: `~/.exports` which includes my PATH and env variables, as I also import it into `.bashrc` in addition to `.zshrc`.

[ Parent | on HN ]