News for hackers. Stuff that matters.

A comment on Vim/Neovim Arbitrary Code Execution via Modelines. Parent comment

Re:Vim/Neovim Arbitrary Code Execution via Modelines by ebeip90 on Tuesday June 04, 2019 @07:28PM (#20100189)
Why not just set a shebang like

    $ cat foo.sh
    #!/usr/bin/env zsh
    echo $SHELL
Which most editors understand.

    $ file foo.sh
    foo.sh: a /usr/bin/env zsh script text executable, ASCII text
    $ vim --clean -c ':set filetype?' foo.sh
    ...
    filetype=zsh
This ALSO ensures that the correct shell is invoked on your script, instead of your current or default shell.

    $ ./foo.sh
    /usr/local/bin/zsh
[ Parent | on HN ]
Re:Vim/Neovim Arbitrary Code Execution via Modelines by k_sze on Tuesday June 04, 2019 @08:14PM (#20100427)
If the script file is meant to be sourced only, then a shebang is bad style as it gives the wrong hints to human readers.
[ Parent | on HN ]
Re:Vim/Neovim Arbitrary Code Execution via Modelines by JetSpiegel on Friday June 07, 2019 @04:25AM (#20122656)
chmod -x
[ Parent | on HN ]
Re:Vim/Neovim Arbitrary Code Execution via Modelines by dmix on Tuesday June 04, 2019 @11:05PM (#20101144)
I don't see how that helps either of my examples (TODO.md, config files).

Even when it's actual part of ZSH script I'm only using `ft=zsh` when it's a file I'm sourcing, not intended as a runnable script by itself. For example: `~/.exports` which includes my PATH and env variables, as I also import it into `.bashrc` in addition to `.zshrc`.

[ Parent | on HN ]