patch 8.1.0538: evaluating a modeline might invoke using a shell command
Problem: Evaluating a modeline might invoke using a shell command. (Paul
Huber)
Solution: Set the sandbox flag when setting options from a modeline.
diff --git a/src/buffer.c b/src/buffer.c
index 8e892da..ee962b2 100644
--- a/src/buffer.c
+++ b/src/buffer.c
@@ -5522,7 +5522,12 @@
current_sctx.sc_seq = 0;
current_sctx.sc_lnum = 0;
#endif
+ // Make sure no risky things are executed as a side effect.
+ ++sandbox;
+
retval = do_set(s, OPT_MODELINE | OPT_LOCAL | flags);
+
+ --sandbox;
#ifdef FEAT_EVAL
current_sctx = save_current_sctx;
#endif