problem installing LargeFile.vba

classic Classic list List threaded Threaded
5 messages Options
Reply | Threaded
Open this post in threaded view
|

problem installing LargeFile.vba

iler.ml

I downloaded LargeFile.vba.gz from [0]. To handle vba format, I
downloaded
vimball.vim plugin, latest version. I did not have any vimball.vim
installed before.

Then I followed instructions [1] to install .vba, no luck:

    gunzip LargeFile.vba.gz # that part worked ok
    vim LargeFile.vba # as per [1]
    so%
 Got lots of errors [2]. What am I doing wrong ? vim 7.1.262.

Yakov

[0] http://www.vim.org/scripts/script.php?script_id=1506,

[1] EXTRACTING FROM A VIMBALL says
( in http://www.vim.org/scripts/script.php?script_id=1502 ):
Users of a vimball archive simply need to

    :vim something.vba
    :so %
[2]
Error detected while processing function
vimball#Vimball..<SNR>48_ChgDir:
line    5:
E117: Unknown function: fnameescape
E15: Invalid expression: 'silent cd '.fnameescape(a:newdir)
Error detected while processing function
vimball#Vimball..vimball#RmVimball..<SNR>48_ChgDir:
line    5:
E117: Unknown function: fnameescape
E15: Invalid expression: 'silent cd '.fnameescape(a:newdir)
E117: Unknown function: fnameescape
E15: Invalid expression: 'silent cd '.fnameescape(a:newdir)
Vimball Archive
extracted <plugin/LargeFile.vim>: 72 lines
Error detected while processing function
vimball#Vimball..<SNR>48_ChgDir:
line    5:
E117: Unknown function: fnameescape
E15: Invalid expression: 'silent cd '.fnameescape(a:newdir)
Error detected while processing function vimball#Vimball:
line  122:
E117: Unknown function: fnameescape
E15: Invalid expression: "silent w! ".fnameescape(fnamepath)
wrote /home/lerner/.vim/plugin/LargeFile.vim
line  124:
E117: Unknown function: fnameescape
E116: Invalid arguments for function <SNR>48_RecordInVar
extracted <doc/LargeFile.txt>: 41 lines
Error detected while processing function
vimball#Vimball..<SNR>48_ChgDir:
line    5:
E117: Unknown function: fnameescape
E15: Invalid expression: 'silent cd '.fnameescape(a:newdir)
Error detected while processing function vimball#Vimball:
line  122:
E117: Unknown function: fnameescape
E15: Invalid expression: "silent w! ".fnameescape(fnamepath)
wrote /home/lerner/.vim/doc/LargeFile.txt
line  124:
E117: Unknown function: fnameescape
E116: Invalid arguments for function <SNR>48_RecordInVar
did helptags
Error detected while processing function
vimball#Vimball..<SNR>48_ChgDir:
line    5:
E117: Unknown function: fnameescape
E15: Invalid expression: 'silent cd '.fnameescape(a:newdir)
--~--~---------~--~----~------------~-------~--~----~
You received this message from the "vim_use" maillist.
For more information, visit http://www.vim.org/maillist.php
-~----------~----~----~----~------~----~------~--~---

Reply | Threaded
Open this post in threaded view
|

Re: problem installing LargeFile.vba

Ben Schmidt

Yakov wrote:

> I downloaded LargeFile.vba.gz from [0]. To handle vba format, I
> downloaded
> vimball.vim plugin, latest version. I did not have any vimball.vim
> installed before.
>
> Then I followed instructions [1] to install .vba, no luck:
>
>     gunzip LargeFile.vba.gz # that part worked ok
>     vim LargeFile.vba # as per [1]
>     so%
>  Got lots of errors [2]. What am I doing wrong ? vim 7.1.262.

fnameescape was introduced with Vim 7.1.299, so you will need a newer
Vim or an older VimBall.

Cheers,

Ben.


--~--~---------~--~----~------------~-------~--~----~
You received this message from the "vim_use" maillist.
For more information, visit http://www.vim.org/maillist.php
-~----------~----~----~----~------~----~------~--~---

Reply | Threaded
Open this post in threaded view
|

Re: problem installing LargeFile.vba

Charles E Campbell Jr

Ben Schmidt wrote:

>Yakov wrote:
>  
>
>>I downloaded LargeFile.vba.gz from [0]. To handle vba format, I
>>downloaded
>>vimball.vim plugin, latest version. I did not have any vimball.vim
>>installed before.
>>
>>Then I followed instructions [1] to install .vba, no luck:
>>
>>    gunzip LargeFile.vba.gz # that part worked ok
>>    vim LargeFile.vba # as per [1]
>>    so%
>> Got lots of errors [2]. What am I doing wrong ? vim 7.1.262.
>>    
>>
>
>fnameescape was introduced with Vim 7.1.299, so you will need a newer
>Vim or an older VimBall.
>  
>
I like the way that Ben said that!

A person has let us know that there are filenames that can be crafted
that can cause security affects.  Of course, one would have be [insert
pejorative here] to attempt to do anything with such an obvious problem
file other than delete it.  Nonetheless, shellescape() and fnameescape()
have been introduced by Bram to take care of the problem, but plugins do
need to use those functions.  I've been updating the plugins that come
with vim (Yakov could probably just remove the vimball plugin he
downloaded and use the version that came with 7.1) to use these two
functions.  When vim 7.2 comes out these problems should go away.

Regards,
Chip Campbell


--~--~---------~--~----~------------~-------~--~----~
You received this message from the "vim_use" maillist.
For more information, visit http://www.vim.org/maillist.php
-~----------~----~----~----~------~----~------~--~---

Reply | Threaded
Open this post in threaded view
|

Re: problem installing LargeFile.vba

iler.ml

On Jun 16, 2:26 pm, "Charles E. Campbell, Jr."
<[hidden email]> wrote:

> Ben Schmidt wrote:
> >Yakov wrote:
>
> >>I downloaded LargeFile.vba.gz from [0]. To handle vba format, I
> >>downloaded
> >>vimball.vim plugin, latest version. I did not have any vimball.vim
> >>installed before.
>
> >>Then I followed instructions [1] to install .vba, no luck:
>
> >>    gunzip LargeFile.vba.gz # that part worked ok
> >>    vim LargeFile.vba # as per [1]
> >>    so%
> >> Got lots of errors [2]. What am I doing wrong ? vim 7.1.262.
>
> >fnameescape was introduced with Vim 7.1.299, so you will need a newer
> >Vim or an older VimBall.
>
> I like the way that Ben said that!
>
> A person has let us know that there are filenames that can be crafted
> that can cause security affects.  Of course, one would have be [insert
> pejorative here] to attempt to do anything with such an obvious problem
> file other than delete it.  Nonetheless, shellescape() and fnameescape()
> have been introduced by Bram to take care of the problem, but plugins do
> need to use those functions.  I've been updating the plugins that come
> with vim (Yakov could probably just remove the vimball plugin he
> downloaded and use the version that came with 7.1) to use these two
> functions.  When vim 7.2 comes out these problems should go away.
>
> Regards,
> Chip Campbell

NP, I build vim from sources often, will rebuild.

But other computers not always the freshest vim.

Is it possible that plugin did a query of existance of those
funcitons:
     exists("#shellescape") and exists("#fnameescape")
to allow us to continue to use plugin in older versions ?

Yakov
--~--~---------~--~----~------------~-------~--~----~
You received this message from the "vim_use" maillist.
For more information, visit http://www.vim.org/maillist.php
-~----------~----~----~----~------~----~------~--~---

Reply | Threaded
Open this post in threaded view
|

RE: problem installing LargeFile.vba

JohnBeckett

Yakov wrote:
> Is it possible that plugin did a query of existance of those
> funcitons:
>      exists("#shellescape") and exists("#fnameescape") to
> allow us to continue to use plugin in older versions ?

I haven't examined the vulnerability yet, although I note that Bram mentioned it
requires you to be lured into opening a file with a crazy name. However, it IS a
security issue, so I certainly hope that no one modifies a plugin to silently
fallback to insecure behaviour.

We have the situation that we've all been using Vim for years, and have discussed
vulnerabilities before (in relation to modelines), and no one here realised that
this security problem existed. So I don't want anyone replying with a glib "it would
not be a security problem to use workaround xxx"!

John


--~--~---------~--~----~------------~-------~--~----~
You received this message from the "vim_use" maillist.
For more information, visit http://www.vim.org/maillist.php
-~----------~----~----~----~------~----~------~--~---