CVE-2019-20807 (C, published 2020-05-28T14:15Z)
Description: value: In Vim before 8.1.0881, users can circumvent the rvim restricted mode and execute arbitrary OS commands via scripting interfaces (e.g., Python, Ruby, or Lua).
Severity: MEDIUM (CVSS v3 base score: 5.3)
Weakness: CWE-78 \u2014 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.
Repository: https://github.com/vim/vim
Files changed:
runtime/doc/starting.txt
src/evalfunc.c
src/ex_cmds.c
src/ex_docmd.c
src/if_perl.xs
src/testdir/Make_all.mak
src/testdir/test_restricted.vim
src/version.c
Commit message: patch 8.1.0881: can execute shell commands in rvim through interfaces

Problem:    Can execute shell commands in rvim through interfaces.
Solution:   Disable using interfaces in restricted mode. Allow for writing
            file with writefile(), histadd() and a few others.


Vulnerable code:
						*-Z* *restricted-mode* *E145*
		":sh", filtering, the system() function, backtick expansion,
		delete(), rename(), mkdir(), writefile(), libcall(),
		job_start(), etc.
    if (check_restricted() || check_secure())
    if (check_restricted() || check_secure())
    if (check_restricted() || check_secure())
    if (check_restricted() || check_secure())
	emsg(_("E145: Shell commands not allowed in rvim"));
	    /* Command not allowed in sandbox. */
#ifdef HAVE_SANDBOX
    if (sandbox)
	    emsg(_("E299: Perl evaluation forbidden in sandbox without the Safe module"));
#endif
#ifdef HAVE_SANDBOX
	if (sandbox)
		emsg(_("E299: Perl evaluation forbidden in sandbox without the Safe module"));
#endif /* HAVE_SANDBOX */

Fixed code:
					*-Z* *restricted-mode* *E145* *E981*
		":sh", filtering, the system() function, backtick expansion
		and libcall().
		Also disallowed are delete(), rename(), mkdir(), job_start(),
		etc.
		Interfaces, such as Python, Ruby and Lua, are also disabled,
		since they could be used to execute shell commands.  Perl uses
		the Safe module.
		Note that the user may still find a loophole to execute a
		shell command, it has only been made difficult.
    if (check_secure())
    if (check_restricted() || check_secure())
	return;

    if (check_restricted() || check_secure())
	return;
    if (check_restricted() || check_secure())
	return;

    if (check_restricted() || check_secure())
	return;

    if (check_restricted() || check_secure())
	return;

    if (check_secure())
    if (check_secure())
    if (check_secure())
	emsg(_("E145: Shell commands and some functionality not allowed in rvim"));
	    // Command not allowed in sandbox.
	if (restricted != 0 && (ea.argt & RESTRICT))
	{
	    errormsg = _("E981: Command not allowed in rvim");
	    goto doend;
	}
static char *e_perlsandbox = N_("E299: Perl evaluation forbidden in sandbox without the Safe module");
    if (sandbox || secure)
	    emsg(_(e_perlsandbox));
	if (sandbox || secure)
		emsg(_(e_perlsandbox));
	test_restricted \
	test_restricted.res \
" Test for "rvim" or "vim -Z"

source shared.vim

func Test_restricted()
  let cmd = GetVimCommand('Xrestricted')
  if cmd == ''
    return
  endif

  call writefile([
	\ "silent !ls",
	\ "call writefile([v:errmsg], 'Xrestrout')",
	\ "qa!",
	\ ], 'Xrestricted')
  call system(cmd . ' -Z')
  call assert_match('E145:', join(readfile('Xrestrout')))

  call delete('Xrestricted')
  call delete('Xrestrout')
endfunc

func Run_restricted_test(ex_cmd, error)
  let cmd = GetVimCommand('Xrestricted')
  if cmd == ''
    return
  endif

  call writefile([
	\ a:ex_cmd,
	\ "call writefile([v:errmsg], 'Xrestrout')",
	\ "qa!",
	\ ], 'Xrestricted')
  call system(cmd . ' -Z')
  call assert_match(a:error, join(readfile('Xrestrout')))

  call delete('Xrestricted')
  call delete('Xrestrout')
endfunc

func Test_restricted_lua()
  if !has('lua')
    throw 'Skipped: Lua is not supported'
  endif
  call Run_restricted_test('lua print("Hello, Vim!")', 'E981:')
  call Run_restricted_test('luado return "hello"', 'E981:')
  call Run_restricted_test('luafile somefile', 'E981:')
  call Run_restricted_test('call luaeval("expression")', 'E145:')
endfunc

func Test_restricted_mzscheme()
  if !has('mzscheme')
    throw 'Skipped: MzScheme is not supported'
  endif
  call Run_restricted_test('mzscheme statement', 'E981:')
  call Run_restricted_test('mzfile somefile', 'E981:')
  call Run_restricted_test('call mzeval("expression")', 'E145:')
endfunc

func Test_restricted_perl()
  if !has('perl')
    throw 'Skipped: Perl is not supported'
  endif
  " TODO: how to make Safe mode fail?
  " call Run_restricted_test('perl system("ls")', 'E981:')
  " call Run_restricted_test('perldo system("hello")', 'E981:')
  " call Run_restricted_test('perlfile somefile', 'E981:')
  " call Run_restricted_test('call perleval("system(\"ls\")")', 'E145:')
endfunc

func Test_restricted_python()
  if !has('python')
    throw 'Skipped: Python is not supported'
  endif
  call Run_restricted_test('python print "hello"', 'E981:')
  call Run_restricted_test('pydo return "hello"', 'E981:')
  call Run_restricted_test('pyfile somefile', 'E981:')
  call Run_restricted_test('call pyeval("expression")', 'E145:')
endfunc

func Test_restricted_python3()
  if !has('python3')
    throw 'Skipped: Python3 is not supported'
  endif
  call Run_restricted_test('py3 print "hello"', 'E981:')
  call Run_restricted_test('py3do return "hello"', 'E981:')
  call Run_restricted_test('py3file somefile', 'E981:')
  call Run_restricted_test('call py3eval("expression")', 'E145:')
endfunc

func Test_restricted_ruby()
  if !has('ruby')
    throw 'Skipped: Ruby is not supported'
  endif
  call Run_restricted_test('ruby print "Hello"', 'E981:')
  call Run_restricted_test('rubydo print "Hello"', 'E981:')
  call Run_restricted_test('rubyfile somefile', 'E981:')
endfunc

func Test_restricted_tcl()
  if !has('tcl')
    throw 'Skipped: Tcl is not supported'
  endif
  call Run_restricted_test('tcl puts "Hello"', 'E981:')
  call Run_restricted_test('tcldo puts "Hello"', 'E981:')
  call Run_restricted_test('tclfile somefile', 'E981:')
endfunc
/**/
    881,