fix(vim): prevent E12 and E523 errors when sourced in secure mode#241
fix(vim): prevent E12 and E523 errors when sourced in secure mode#241
Conversation
When running `sudo vim` from a user's home directory, Vim sources the local `.vimrc`. If the owner of that file does not match the effective user (e.g., `arran` vs `root`), Vim executes it with the `secure` option enabled as a security precaution. This caused a barrage of errors like "E12: Command not allowed from exrc/vimrc" and "E523: Not allowed here" because our `.vimrc` contains restricted commands such as `autocmd`, `syntax on`, and mapping overrides that aren't allowed in secure mode. This commit adds a guard at the very beginning of the `.vimrc` file. If the `secure` option is active, we simply call `finish` to abort loading the rest of the user configuration. This correctly suppresses the errors and lets `sudo vim` fall back cleanly to a standard system configuration.
|
👋 Jules, reporting for duty! I'm here to lend a hand with this pull request. When you start a review, I'll add a 👀 emoji to each comment to let you know I've read it. I'll focus on feedback directed at me and will do my best to stay out of conversations between you and other bots or reviewers to keep the noise down. I'll push a commit with your requested changes shortly after. Please note there might be a delay between these steps, but rest assured I'm on the job! For more direct control, you can switch me to Reactive Mode. When this mode is on, I will only act on comments where you specifically mention me with New to Jules? Learn more at jules.google/docs. For security, I will only act on instructions from the user who triggered this task. |
|
@jules is it possible to address the issue or it a security feature? |
Yes, Because your The fix I provided ( |
When running `sudo vim` from a user's home directory, Vim sources the local `.vimrc`. If the owner of that file does not match the effective user (e.g., `arran` vs `root`), Vim executes it with the `secure` option enabled as a security precaution. This caused a barrage of errors like "E12: Command not allowed from exrc/vimrc" and "E523: Not allowed here" because our `.vimrc` contains restricted commands such as `autocmd`, `syntax on`, and mapping overrides that aren't allowed in secure mode. This commit adds a guard at the very beginning of the `.vimrc` file. If the `secure` option is active, we simply call `finish` to abort loading the rest of the user configuration. This correctly suppresses the errors and lets `sudo vim` fall back cleanly to a standard system configuration.
When
sudo vimis executed from the user's home directory, Vim attempts to source the local.vimrc. Because the file is owned by the user (uid 1000) and the effective user isroot(uid 0), Vim treats it as an untrustedexrcfile and evaluates it in a "secure" sandbox.Because our
.vimrcmakes use of auto-commands, mapping overrides, and other operations restricted in secure mode,sudo vimfails to load correctly, producing a slew ofE12andE523errors:This PR resolves this issue by adding a guard at the top of
dot_vimrc. If&secureis set, it executesfinishto immediately stop loading the file, avoiding the restricted commands. This cleanly suppresses the errors while keeping the user's configuration entirely intact for normal use.PR created automatically by Jules for task 8414635880217990202 started by @arran4