Re: security problem with ruby code completion in vim

[Nikolai Weibull]

On 6/6/06, Martin Povolný <[EMAIL PROTECTED]> wrote:

Hallo,

I have tested ruby code completion in vim and found that it is quite
insecure.

Lets have file 'a.rb':

system('echo vim je pako > /tmp/pako')

class MyTest
  def test
    return 1
  end
end

And then some file we edit e.g. 'b.rb':

require 'a'

Here's where it happens.  It will actually require 'a' so that it
knows about the stuff in that file.  $SAFE _may_ be a solution.

 nikolai