diff --git a/runtime/doc/starting.txt b/runtime/doc/starting.txt
index 8256152..8320039 100644
--- a/runtime/doc/starting.txt
+++ b/runtime/doc/starting.txt
@@ -247,12 +247,18 @@ a slash. Thus "-R" means recovery and "-/R" readonly.
changes and writing.
{not in Vi}
- *-Z* *restricted-mode* *E145*
+ *-Z* *restricted-mode* *E145* *E981*
-Z Restricted mode. All commands that make use of an external
shell are disabled. This includes suspending with CTRL-Z,
- ":sh", filtering, the system() function, backtick expansion,
- delete(), rename(), mkdir(), writefile(), libcall(),
- job_start(), etc.
+ ":sh", filtering, the system() function, backtick expansion
+ and libcall().
+ Also disallowed are delete(), rename(), mkdir(), job_start(),
+ etc.
+ Interfaces, such as Python, Ruby and Lua, are also disabled,
+ since they could be used to execute shell commands. Perl uses
+ the Safe module.
+ Note that the user may still find a loophole to execute a
+ shell command, it has only been made difficult.
{not in Vi}
*-g*
diff --git a/src/evalfunc.c b/src/evalfunc.c
index dd4462d..3cc305a 100644
--- a/src/evalfunc.c
+++ b/src/evalfunc.c
@@ -6446,7 +6446,7 @@ f_histadd(typval_T *argvars UNUSED, typval_T *rettv)
#endif
rettv->vval.v_number = FALSE;
- if (check_restricted() || check_secure())
+ if (check_secure())
return;
#ifdef FEAT_CMDHIST
str = get_tv_string_chk(&argvars[0]); /* NULL on type error */
@@ -7456,6 +7456,9 @@ f_luaeval(typval_T *argvars, typval_T *rettv)
char_u *str;
char_u buf[NUMBUFLEN];
+ if (check_restricted() || check_secure())
+ return;
+
str = get_tv_string_buf(&argvars[0], buf);
do_luaeval(str, argvars + 1, rettv);
}
@@ -8188,6 +8191,8 @@ f_mzeval(typval_T *argvars, typval_T *rettv)
char_u *str;
char_u buf[NUMBUFLEN];
+ if (check_restricted() || check_secure())
+ return;
str = get_tv_string_buf(&argvars[0], buf);
do_mzeval(str, rettv);
}
@@ -8398,6 +8403,9 @@ f_py3eval(typval_T *argvars, typval_T *rettv)
char_u *str;
char_u buf[NUMBUFLEN];
+ if (check_restricted() || check_secure())
+ return;
+
if (p_pyx == 0)
p_pyx = 3;
@@ -8416,6 +8424,9 @@ f_pyeval(typval_T *argvars, typval_T *rettv)
char_u *str;
char_u buf[NUMBUFLEN];
+ if (check_restricted() || check_secure())
+ return;
+
if (p_pyx == 0)
p_pyx = 2;
@@ -8431,6 +8442,9 @@ f_pyeval(typval_T *argvars, typval_T *rettv)
static void
f_pyxeval(typval_T *argvars, typval_T *rettv)
{
+ if (check_restricted() || check_secure())
+ return;
+
# if defined(FEAT_PYTHON) && defined(FEAT_PYTHON3)
init_pyxversion();
if (p_pyx == 2)
@@ -10272,7 +10286,7 @@ f_setbufvar(typval_T *argvars, typval_T *rettv UNUSED)
typval_T *varp;
char_u nbuf[NUMBUFLEN];
- if (check_restricted() || check_secure())
+ if (check_secure())
return;
(void)get_tv_number(&argvars[0]); /* issue errmsg if type error */
varname = get_tv_string_chk(&argvars[1]);
@@ -10792,7 +10806,7 @@ f_settabvar(typval_T *argvars, typval_T *rettv)
rettv->vval.v_number = 0;
- if (check_restricted() || check_secure())
+ if (check_secure())
return;
tp = find_tabpage((int)get_tv_number_chk(&argvars[0], NULL));
@@ -13674,7 +13688,7 @@ f_writefile(typval_T *argvars, typval_T *rettv)
list_T *list;
rettv->vval.v_number = -1;
- if (check_restricted() || check_secure())
+ if (check_secure())
return;
if (argvars[0].v_type != VAR_LIST)
diff --git a/src/ex_cmds.c b/src/ex_cmds.c
index 111fe01..1827fec 100644
--- a/src/ex_cmds.c
+++ b/src/ex_cmds.c
@@ -4693,7 +4693,7 @@ check_restricted(void)
{
if (restricted)
{
- EMSG(_("E145: Shell commands not allowed in rvim"));
+ EMSG(_("E145: Shell commands and some functionality not allowed in rvim"));
return TRUE;
}
return FALSE;
diff --git a/src/ex_cmds.h b/src/ex_cmds.h
index 48b0253..82d6e29 100644
--- a/src/ex_cmds.h
+++ b/src/ex_cmds.h
@@ -56,6 +56,7 @@
* curbuf_lock is set */
#define MODIFY 0x200000L /* forbidden in non-'modifiable' buffer */
#define EXFLAGS 0x400000L /* allow flags after count in argument */
+#define RESTRICT 0x800000L /* forbidden in restricted mode */
#define FILES (XFILE | EXTRA) /* multiple extra files allowed */
#define WORD1 (EXTRA | NOSPC) /* one extra word allowed */
#define FILE1 (FILES | NOSPC) /* 1 file allowed, defaults to current file */
@@ -860,13 +861,13 @@ EX(CMD_lunmap, "lunmap", ex_unmap,
EXTRA|TRLBAR|NOTRLCOM|USECTRLV|CMDWIN,
ADDR_LINES),
EX(CMD_lua, "lua", ex_lua,
- RANGE|EXTRA|NEEDARG|CMDWIN,
+ RANGE|EXTRA|NEEDARG|CMDWIN|RESTRICT,
ADDR_LINES),
EX(CMD_luado, "luado", ex_luado,
- RANGE|DFLALL|EXTRA|NEEDARG|CMDWIN,
+ RANGE|DFLALL|EXTRA|NEEDARG|CMDWIN|RESTRICT,
ADDR_LINES),
EX(CMD_luafile, "luafile", ex_luafile,
- RANGE|FILE1|NEEDARG|CMDWIN,
+ RANGE|FILE1|NEEDARG|CMDWIN|RESTRICT,
ADDR_LINES),
EX(CMD_lvimgrep, "lvimgrep", ex_vimgrep,
RANGE|NOTADR|BANG|NEEDARG|EXTRA|NOTRLCOM|TRLBAR|XFILE,
@@ -929,10 +930,10 @@ EX(CMD_mode, "mode", ex_mode,
WORD1|TRLBAR|CMDWIN,
ADDR_LINES),
EX(CMD_mzscheme, "mzscheme", ex_mzscheme,
- RANGE|EXTRA|DFLALL|NEEDARG|CMDWIN|SBOXOK,
+ RANGE|EXTRA|DFLALL|NEEDARG|CMDWIN|SBOXOK|RESTRICT,
ADDR_LINES),
EX(CMD_mzfile, "mzfile", ex_mzfile,
- RANGE|FILE1|NEEDARG|CMDWIN,
+ RANGE|FILE1|NEEDARG|CMDWIN|RESTRICT,
ADDR_LINES),
EX(CMD_next, "next", ex_next,
RANGE|NOTADR|BANG|FILES|EDITCMD|ARGOPT|TRLBAR,
@@ -1115,37 +1116,37 @@ EX(CMD_pwd, "pwd", ex_pwd,
TRLBAR|CMDWIN,
ADDR_LINES),
EX(CMD_python, "python", ex_python,
- RANGE|EXTRA|NEEDARG|CMDWIN,
+ RANGE|EXTRA|NEEDARG|CMDWIN|RESTRICT,
ADDR_LINES),
EX(CMD_pydo, "pydo", ex_pydo,
- RANGE|DFLALL|EXTRA|NEEDARG|CMDWIN,
+ RANGE|DFLALL|EXTRA|NEEDARG|CMDWIN|RESTRICT,
ADDR_LINES),
EX(CMD_pyfile, "pyfile", ex_pyfile,
- RANGE|FILE1|NEEDARG|CMDWIN,
+ RANGE|FILE1|NEEDARG|CMDWIN|RESTRICT,
ADDR_LINES),
EX(CMD_py3, "py3", ex_py3,
- RANGE|EXTRA|NEEDARG|CMDWIN,
+ RANGE|EXTRA|NEEDARG|CMDWIN|RESTRICT,
ADDR_LINES),
EX(CMD_py3do, "py3do", ex_py3do,
- RANGE|DFLALL|EXTRA|NEEDARG|CMDWIN,
+ RANGE|DFLALL|EXTRA|NEEDARG|CMDWIN|RESTRICT,
ADDR_LINES),
EX(CMD_python3, "python3", ex_py3,
- RANGE|EXTRA|NEEDARG|CMDWIN,
+ RANGE|EXTRA|NEEDARG|CMDWIN|RESTRICT,
ADDR_LINES),
EX(CMD_py3file, "py3file", ex_py3file,
- RANGE|FILE1|NEEDARG|CMDWIN,
+ RANGE|FILE1|NEEDARG|CMDWIN|RESTRICT,
ADDR_LINES),
EX(CMD_pyx, "pyx", ex_pyx,
- RANGE|EXTRA|NEEDARG|CMDWIN,
+ RANGE|EXTRA|NEEDARG|CMDWIN|RESTRICT,
ADDR_LINES),
EX(CMD_pyxdo, "pyxdo", ex_pyxdo,
- RANGE|DFLALL|EXTRA|NEEDARG|CMDWIN,
+ RANGE|DFLALL|EXTRA|NEEDARG|CMDWIN|RESTRICT,
ADDR_LINES),
EX(CMD_pythonx, "pythonx", ex_pyx,
- RANGE|EXTRA|NEEDARG|CMDWIN,
+ RANGE|EXTRA|NEEDARG|CMDWIN|RESTRICT,
ADDR_LINES),
EX(CMD_pyxfile, "pyxfile", ex_pyxfile,
- RANGE|FILE1|NEEDARG|CMDWIN,
+ RANGE|FILE1|NEEDARG|CMDWIN|RESTRICT,
ADDR_LINES),
EX(CMD_quit, "quit", ex_quit,
BANG|RANGE|COUNT|NOTADR|TRLBAR|CMDWIN,
@@ -1199,13 +1200,13 @@ EX(CMD_runtime, "runtime", ex_runtime,
BANG|NEEDARG|FILES|TRLBAR|SBOXOK|CMDWIN,
ADDR_LINES),
EX(CMD_ruby, "ruby", ex_ruby,
- RANGE|EXTRA|NEEDARG|CMDWIN,
+ RANGE|EXTRA|NEEDARG|CMDWIN|RESTRICT,
ADDR_LINES),
EX(CMD_rubydo, "rubydo", ex_rubydo,
- RANGE|DFLALL|EXTRA|NEEDARG|CMDWIN,
+ RANGE|DFLALL|EXTRA|NEEDARG|CMDWIN|RESTRICT,
ADDR_LINES),
EX(CMD_rubyfile, "rubyfile", ex_rubyfile,
- RANGE|FILE1|NEEDARG|CMDWIN,
+ RANGE|FILE1|NEEDARG|CMDWIN|RESTRICT,
ADDR_LINES),
EX(CMD_rundo, "rundo", ex_rundo,
NEEDARG|FILE1,
@@ -1472,13 +1473,13 @@ EX(CMD_tabs, "tabs", ex_tabs,
TRLBAR|CMDWIN,
ADDR_TABS),
EX(CMD_tcl, "tcl", ex_tcl,
- RANGE|EXTRA|NEEDARG|CMDWIN,
+ RANGE|EXTRA|NEEDARG|CMDWIN|RESTRICT,
ADDR_LINES),
EX(CMD_tcldo, "tcldo", ex_tcldo,
- RANGE|DFLALL|EXTRA|NEEDARG|CMDWIN,
+ RANGE|DFLALL|EXTRA|NEEDARG|CMDWIN|RESTRICT,
ADDR_LINES),
EX(CMD_tclfile, "tclfile", ex_tclfile,
- RANGE|FILE1|NEEDARG|CMDWIN,
+ RANGE|FILE1|NEEDARG|CMDWIN|RESTRICT,
ADDR_LINES),
EX(CMD_tearoff, "tearoff", ex_tearoff,
NEEDARG|EXTRA|TRLBAR|NOTRLCOM|CMDWIN,
diff --git a/src/ex_docmd.c b/src/ex_docmd.c
index ef86fc8..aaf2f9d 100644
--- a/src/ex_docmd.c
+++ b/src/ex_docmd.c
@@ -2372,11 +2372,16 @@ do_one_cmd(
#ifdef HAVE_SANDBOX
if (sandbox != 0 && !(ea.argt & SBOXOK))
{
- /* Command not allowed in sandbox. */
+ // Command not allowed in sandbox.
errormsg = (char_u *)_(e_sandbox);
goto doend;
}
#endif
+ if (restricted != 0 && (ea.argt & RESTRICT))
+ {
+ errormsg = (char_u *)_("E981: Command not allowed in rvim");
+ goto doend;
+ }
if (!curbuf->b_p_ma && (ea.argt & MODIFY))
{
/* Command not allowed in non-'modifiable' buffer */
diff --git a/src/if_perl.xs b/src/if_perl.xs
index 7b45033..fc8d613 100644
--- a/src/if_perl.xs
+++ b/src/if_perl.xs
@@ -930,6 +930,7 @@ VIM_init(void)
#ifdef DYNAMIC_PERL
static char *e_noperl = N_("Sorry, this command is disabled: the Perl library could not be loaded.");
#endif
+static char *e_perlsandbox = N_("E299: Perl evaluation forbidden in sandbox without the Safe module");
/*
* ":perl"
@@ -978,13 +979,12 @@ ex_perl(exarg_T *eap)
vim_free(script);
}
-#ifdef HAVE_SANDBOX
- if (sandbox)
+ if (sandbox || secure)
{
safe = perl_get_sv("VIM::safe", FALSE);
# ifndef MAKE_TEST /* avoid a warning for unreachable code */
if (safe == NULL || !SvTRUE(safe))
- EMSG(_("E299: Perl evaluation forbidden in sandbox without the Safe module"));
+ EMSG(_(e_perlsandbox));
else
# endif
{
@@ -996,7 +996,6 @@ ex_perl(exarg_T *eap)
}
}
else
-#endif
perl_eval_sv(sv, G_DISCARD | G_NOARGS);
SvREFCNT_dec(sv);
@@ -1259,13 +1258,12 @@ do_perleval(char_u *str, typval_T *rettv)
ENTER;
SAVETMPS;
-#ifdef HAVE_SANDBOX
- if (sandbox)
+ if (sandbox || secure)
{
safe = get_sv("VIM::safe", FALSE);
# ifndef MAKE_TEST /* avoid a warning for unreachable code */
if (safe == NULL || !SvTRUE(safe))
- EMSG(_("E299: Perl evaluation forbidden in sandbox without the Safe module"));
+ EMSG(_(e_perlsandbox));
else
# endif
{
@@ -1281,7 +1279,6 @@ do_perleval(char_u *str, typval_T *rettv)
}
}
else
-#endif /* HAVE_SANDBOX */
sv = eval_pv((char *)str, 0);
if (sv) {
diff --git a/src/testdir/Make_all.mak b/src/testdir/Make_all.mak
index e36089a..5f1c38c 100644
--- a/src/testdir/Make_all.mak
+++ b/src/testdir/Make_all.mak
@@ -156,6 +156,7 @@ NEW_TESTS = test_arabic.res \
test_quotestar.res \
test_regex_char_classes.res \
test_registers.res \
+ test_restricted.res \
test_retab.res \
test_ruby.res \
test_scrollbind.res \
diff --git a/src/testdir/test_restricted.vim b/src/testdir/test_restricted.vim
new file mode 100644
index 0000000..9dd937c
--- /dev/null
+++ b/src/testdir/test_restricted.vim
@@ -0,0 +1,107 @@
+" Test for "rvim" or "vim -Z"
+
+source shared.vim
+
+func Test_restricted()
+ let cmd = GetVimCommand('Xrestricted')
+ if cmd == ''
+ return
+ endif
+
+ call writefile([
+ \ "silent !ls",
+ \ "call writefile([v:errmsg], 'Xrestrout')",
+ \ "qa!",
+ \ ], 'Xrestricted')
+ call system(cmd . ' -Z')
+ call assert_match('E145:', join(readfile('Xrestrout')))
+
+ call delete('Xrestricted')
+ call delete('Xrestrout')
+endfunc
+
+func Run_restricted_test(ex_cmd, error)
+ let cmd = GetVimCommand('Xrestricted')
+ if cmd == ''
+ return
+ endif
+
+ call writefile([
+ \ a:ex_cmd,
+ \ "call writefile([v:errmsg], 'Xrestrout')",
+ \ "qa!",
+ \ ], 'Xrestricted')
+ call system(cmd . ' -Z')
+ call assert_match(a:error, join(readfile('Xrestrout')))
+
+ call delete('Xrestricted')
+ call delete('Xrestrout')
+endfunc
+
+func Test_restricted_lua()
+ if !has('lua')
+ throw 'Skipped: Lua is not supported'
+ endif
+ call Run_restricted_test('lua print("Hello, Vim!")', 'E981:')
+ call Run_restricted_test('luado return "hello"', 'E981:')
+ call Run_restricted_test('luafile somefile', 'E981:')
+ call Run_restricted_test('call luaeval("expression")', 'E145:')
+endfunc
+
+func Test_restricted_mzscheme()
+ if !has('mzscheme')
+ throw 'Skipped: MzScheme is not supported'
+ endif
+ call Run_restricted_test('mzscheme statement', 'E981:')
+ call Run_restricted_test('mzfile somefile', 'E981:')
+ call Run_restricted_test('call mzeval("expression")', 'E145:')
+endfunc
+
+func Test_restricted_perl()
+ if !has('perl')
+ throw 'Skipped: Perl is not supported'
+ endif
+ " TODO: how to make Safe mode fail?
+ " call Run_restricted_test('perl system("ls")', 'E981:')
+ " call Run_restricted_test('perldo system("hello")', 'E981:')
+ " call Run_restricted_test('perlfile somefile', 'E981:')
+ " call Run_restricted_test('call perleval("system(\"ls\")")', 'E145:')
+endfunc
+
+func Test_restricted_python()
+ if !has('python')
+ throw 'Skipped: Python is not supported'
+ endif
+ call Run_restricted_test('python print "hello"', 'E981:')
+ call Run_restricted_test('pydo return "hello"', 'E981:')
+ call Run_restricted_test('pyfile somefile', 'E981:')
+ call Run_restricted_test('call pyeval("expression")', 'E145:')
+endfunc
+
+func Test_restricted_python3()
+ if !has('python3')
+ throw 'Skipped: Python3 is not supported'
+ endif
+ call Run_restricted_test('py3 print "hello"', 'E981:')
+ call Run_restricted_test('py3do return "hello"', 'E981:')
+ call Run_restricted_test('py3file somefile', 'E981:')
+ call Run_restricted_test('call py3eval("expression")', 'E145:')
+endfunc
+
+func Test_restricted_ruby()
+ if !has('ruby')
+ throw 'Skipped: Ruby is not supported'
+ endif
+ call Run_restricted_test('ruby print "Hello"', 'E981:')
+ call Run_restricted_test('rubydo print "Hello"', 'E981:')
+ call Run_restricted_test('rubyfile somefile', 'E981:')
+endfunc
+
+func Test_restricted_tcl()
+ if !has('tcl')
+ throw 'Skipped: Tcl is not supported'
+ endif
+ call Run_restricted_test('tcl puts "Hello"', 'E981:')
+ call Run_restricted_test('tcldo puts "Hello"', 'E981:')
+ call Run_restricted_test('tclfile somefile', 'E981:')
+endfunc