2 replaced http://stackoverflow.com/ with https://stackoverflow.com/
source | link

I use vim and have a use case for modelinesuse case for modelines. A modeline means that vim will parse a textfile for lines like:

# vim: set someoption=somevalue

and will then set those options. This is awesome if I'm the person writing the modelines, but it also might break down the assumption that I can open untrusted text files with my text editor with no harm.

Assume that I'm running an updated version of vim. Assume that I don't mind if someone can set annoying options that make things look bad (eg, messing with the tabwidth). What could a malicious text file do?

Thanks!

I use vim and have a use case for modelines. A modeline means that vim will parse a textfile for lines like:

# vim: set someoption=somevalue

and will then set those options. This is awesome if I'm the person writing the modelines, but it also might break down the assumption that I can open untrusted text files with my text editor with no harm.

Assume that I'm running an updated version of vim. Assume that I don't mind if someone can set annoying options that make things look bad (eg, messing with the tabwidth). What could a malicious text file do?

Thanks!

I use vim and have a use case for modelines. A modeline means that vim will parse a textfile for lines like:

# vim: set someoption=somevalue

and will then set those options. This is awesome if I'm the person writing the modelines, but it also might break down the assumption that I can open untrusted text files with my text editor with no harm.

Assume that I'm running an updated version of vim. Assume that I don't mind if someone can set annoying options that make things look bad (eg, messing with the tabwidth). What could a malicious text file do?

Thanks!

    Tweeted twitter.com/#!/StackSecurity/status/334852460847972353
1
source | link

Vim Modeline Vulnerabilities

I use vim and have a use case for modelines. A modeline means that vim will parse a textfile for lines like:

# vim: set someoption=somevalue

and will then set those options. This is awesome if I'm the person writing the modelines, but it also might break down the assumption that I can open untrusted text files with my text editor with no harm.

Assume that I'm running an updated version of vim. Assume that I don't mind if someone can set annoying options that make things look bad (eg, messing with the tabwidth). What could a malicious text file do?

Thanks!