diff --git a/meta/recipes-support/vim/files/CVE-2026-28417-regression_p1.patch b/meta/recipes-support/vim/files/CVE-2026-28417-regression_p1.patch new file mode 100644 index 0000000000..0289614bfe --- /dev/null +++ b/meta/recipes-support/vim/files/CVE-2026-28417-regression_p1.patch @@ -0,0 +1,78 @@ +From a6e9906380af2b51ea4b77234ef77b14cc712f2c Mon Sep 17 00:00:00 2001 +From: Miguel Barro +Date: Sun, 1 Mar 2026 19:32:29 +0000 +Subject: [PATCH] patch 9.2.0089: netrw: does not take port into account in + hostname validation + +Problem: netrw: does not take port into account in hostname validation + (after v9.2.0073) +Solution: Update hostname validation check and test for an optional port + number (Miguel Barro) + +closes: #19533 + +CVE: CVE-2026-28417 +Upstream-Status: Backport [https://github.com/vim/vim/commit/a6198523fb28a50d96945458792cdb4787d3cdda] + +Backport Changes: +- Omitted src/testdir/test_plugin_netrw.vim because this test file is not + present in the Vim 9.1.1683 source used by Scarthgap. +- Omitted src/version.c because this backport does not change the recipe's + Vim version or its upstream patch-number table. + +Signed-off-by: Miguel Barro +Signed-off-by: Christian Brabandt +(cherry picked from commit a6198523fb28a50d96945458792cdb4787d3cdda) +Signed-off-by: Devansh Patel +--- + runtime/pack/dist/opt/netrw/autoload/netrw.vim | 18 +++++++++++------- + 1 file changed, 11 insertions(+), 7 deletions(-) + +diff --git a/runtime/pack/dist/opt/netrw/autoload/netrw.vim b/runtime/pack/dist/opt/netrw/autoload/netrw.vim +index 1b790d250..69eababf1 100644 +--- a/runtime/pack/dist/opt/netrw/autoload/netrw.vim ++++ b/runtime/pack/dist/opt/netrw/autoload/netrw.vim +@@ -6,6 +6,7 @@ + " 2025 Aug 07 by Vim Project (netrw#BrowseX() distinguishes remote files #17794) + " 2025 Aug 22 by Vim Project netrw#Explore handle terminal correctly #18069 + " 2026 Feb 27 by Vim Project Make the hostname validation more strict ++" 2026 Mar 01 by Vim Project include portnumber in hostname checking #19533 + " Copyright: Copyright (C) 2016 Charles E. Campbell {{{1 + " Permission is hereby granted to use and distribute this code, + " with or without modifications, provided that this copyright +@@ -2575,7 +2576,8 @@ endfunction + + " s:NetrwValidateHostname: Validate that the hostname is valid {{{2 + " Input: +-" hostname, may include an optional username, e.g. user@hostname ++" hostname, may include an optional username and port number, e.g. ++" user@hostname:port + " allow a alphanumeric hostname or an IPv(4/6) address + " Output: + " true if g:netrw_machine is valid according to RFC1123 #Section 2 +@@ -2584,17 +2586,19 @@ function s:NetrwValidateHostname(hostname) + let user_pat = '\%([a-zA-Z0-9._-]\+@\)\?' + " Hostname: 1-64 chars, alphanumeric/dots/hyphens. + " No underscores. No leading/trailing dots/hyphens. +- let host_pat = '[a-zA-Z0-9]\%([-a-zA-Z0-9.]{,62}[a-zA-Z0-9]\)\?$' ++ let host_pat = '[a-zA-Z0-9]\%([-a-zA-Z0-9.]\{0,62}[a-zA-Z0-9]\)\?' ++ " Port: 16 bit unsigned integer ++ let port_pat = '\%(:\d\{1,5\}\)\?$' + + " IPv4: 1-3 digits separated by dots +- let ipv4_pat = '\%(\d\{1,3}\.\)\{3\}\d\{1,3\}$' ++ let ipv4_pat = '\%(\d\{1,3}\.\)\{3\}\d\{1,3\}' + + " IPv6: Hex, colons, and optional brackets +- let ipv6_pat = '\[\?\%([a-fA-F0-9:]\{2,}\)\+\]\?$' ++ let ipv6_pat = '\[\?\%([a-fA-F0-9:]\{2,}\)\+\]\?' + +- return a:hostname =~? '^'.user_pat.host_pat || +- \ a:hostname =~? '^'.user_pat.ipv4_pat || +- \ a:hostname =~? '^'.user_pat.ipv6_pat ++ return a:hostname =~? '^'.user_pat.host_pat.port_pat || ++ \ a:hostname =~? '^'.user_pat.ipv4_pat.port_pat || ++ \ a:hostname =~? '^'.user_pat.ipv6_pat.port_pat + endfunction + + " NetUserPass: set username and password for subsequent ftp transfer {{{2 diff --git a/meta/recipes-support/vim/files/CVE-2026-28417-regression_p2.patch b/meta/recipes-support/vim/files/CVE-2026-28417-regression_p2.patch new file mode 100644 index 0000000000..e33c64ac91 --- /dev/null +++ b/meta/recipes-support/vim/files/CVE-2026-28417-regression_p2.patch @@ -0,0 +1,53 @@ +From 047b5dfc3213a42d7db960569f53b37e332f3c76 Mon Sep 17 00:00:00 2001 +From: Christian Brabandt +Date: Thu, 28 May 2026 20:53:53 +0000 +Subject: [PATCH] patch 9.2.0553: runtime(netrw): netrw rejects hostnames + containing _ + +Problem: runtime(netrw): netrw rejects hostnames containing _ + (lilydjwg) +Solution: Relax the restriction and allow the underscore + +fixes: #20344 + +CVE: CVE-2026-28417 +Upstream-Status: Backport [https://github.com/vim/vim/commit/93d177cd2b69bac58fc51a5a514d7bc71e264b11] + +Backport Changes: +- Preserved Scarthgap's multi-line netrw change history and appended the + upstream 2026 May 28 change instead of replacing it with a single date. +- Omitted src/testdir/test_plugin_netrw.vim because this test file is not + present in the Vim 9.1.1683 source used by Scarthgap. +- Omitted src/version.c because this backport does not change the recipe's + Vim version or its upstream patch-number table. + +Signed-off-by: Christian Brabandt +(cherry picked from commit 93d177cd2b69bac58fc51a5a514d7bc71e264b11) +Signed-off-by: Devansh Patel +--- + runtime/pack/dist/opt/netrw/autoload/netrw.vim | 5 +++-- + 1 file changed, 3 insertions(+), 2 deletions(-) + +diff --git a/runtime/pack/dist/opt/netrw/autoload/netrw.vim b/runtime/pack/dist/opt/netrw/autoload/netrw.vim +index 69eababf1..58aecc81e 100644 +--- a/runtime/pack/dist/opt/netrw/autoload/netrw.vim ++++ b/runtime/pack/dist/opt/netrw/autoload/netrw.vim +@@ -7,6 +7,7 @@ + " 2025 Aug 22 by Vim Project netrw#Explore handle terminal correctly #18069 + " 2026 Feb 27 by Vim Project Make the hostname validation more strict + " 2026 Mar 01 by Vim Project include portnumber in hostname checking #19533 ++" 2026 May 28 by Vim Project allow underscores in hostname checking #20344 + " Copyright: Copyright (C) 2016 Charles E. Campbell {{{1 + " Permission is hereby granted to use and distribute this code, + " with or without modifications, provided that this copyright +@@ -2585,8 +2586,8 @@ function s:NetrwValidateHostname(hostname) + " Username: + let user_pat = '\%([a-zA-Z0-9._-]\+@\)\?' + " Hostname: 1-64 chars, alphanumeric/dots/hyphens. +- " No underscores. No leading/trailing dots/hyphens. +- let host_pat = '[a-zA-Z0-9]\%([-a-zA-Z0-9.]\{0,62}[a-zA-Z0-9]\)\?' ++ " No leading/trailing dots/hyphens. ++ let host_pat = '[a-zA-Z0-9_]\%([-a-zA-Z0-9._]\{0,62}[a-zA-Z0-9_]\)\?' + " Port: 16 bit unsigned integer + let port_pat = '\%(:\d\{1,5\}\)\?$' + diff --git a/meta/recipes-support/vim/vim.inc b/meta/recipes-support/vim/vim.inc index 5a34c1fa35..bd2ce2f6ab 100644 --- a/meta/recipes-support/vim/vim.inc +++ b/meta/recipes-support/vim/vim.inc @@ -30,6 +30,8 @@ SRC_URI = "git://github.com/vim/vim.git;branch=master;protocol=https \ file://CVE-2026-28421.patch \ file://CVE-2026-32249.patch \ file://CVE-2026-28417.patch \ + file://CVE-2026-28417-regression_p1.patch \ + file://CVE-2026-28417-regression_p2.patch \ file://CVE-2026-45130.patch \ file://CVE-2026-46483.patch \ file://CVE-2026-28420.patch \