[net.bugs.usg] fun bug in vi

wja@iclbra.UUCP (Wayne Alston) (05/23/85)

An undocumented feature in vi allows a valid command in the file being 
'edited' of the form

	...ex:{command}:
or
	...vi:{command}:

to be actioned before interactive editing is allowed.  However, the bug also 
permits the variants ei and vx. The code reads:-

	if (beg[-2] != 'e' && beg[-2] != 'v') return;
	if (beg[-1] != 'x' && beg[-1] != 'i') return;

in routine checkmodeline().

The bug was discovered by trying to install a user with the initials 'jei' into
/etc/passwd.

Note that the above structure need not be at the beginning of the file.
Try vi'ing a file containing ei:x: .

Wayne Alston
..!reading!iclbra!wja

wcs@ho95b.UUCP (Bill Stewart) (05/25/85)

Wayne Allston at ICL had some comments about the "vi-startup-mode" feature:
	1)  It's undocumented
	2)  It also accepts ei: and vx: in addition to ex: and vi:
	3)  It's more of a misfeature than a feature (paraphrased.)

Well, 2) is clearly a bug, and "somebody" ought to fix it.   I just checked
the source for version 3.9, and the offending lines of code are still there
in checkmodeline().

However, the startup mode is not undocumented, and it's not a misfeature.
Admittedly, the documentation isn't in the manual page, it's in the file
vax/ex.news in the source directory, but this applies to any features added
since the vi 3.5 version came out.  (Hope you've got source! :~)

Whether it's a good feature is somewhat of a religious argument, but I like
it.  However, it would be nice to have a modelines/nomodelines option that
you could set in $EXINIT, to make it safer to edit important files, or other
files where the magic sequences might occur.
-- 
			Bill Stewart	1-201-949-0705
			AT&T Bell Labs, Room 4K-435, Holmdel NJ
			{ihnp4,allegra,cbosgd,vax135}!ho95c!wcs

mark@cbosgd.UUCP (Mark Horton) (05/25/85)

This problem is well known - it came out about a year ago.

It has been fixed in vi 3.10.  The syntax is now something
that's unlikely to show up by accident in text files, and
very few commands are allowed in a mode line.  There
are explicit checks to prevent ! commands, too.

3.10 will probably first be released in System V Release 3.

	Mark

guy@sun.uucp (Guy Harris) (05/25/85)

> An undocumented feature in vi allows a valid command in the file being 
> 'edited' of the form
> 
> 	...ex:{command}:
> or
> 	...vi:{command}:
> 
> to be actioned before interactive editing is allowed.  However, the bug
> also permits the variants ei and vx.

The feature(?) and the bug are in ex/vi 3.7 as well, which comes with 4.2BSD.

> The bug was discovered by trying to install a user with the initials 'jei'
> into /etc/passwd.

The fact that mode-line processing can't be turned off is, arguably, a bug
(the same thing may have bitten us here; "vi" acted strangely when editing
/etc/passwd, and I think there was an entry that looked like a mode line).
Somebody posted some changes to "ex" (which apply both the 4.2BSD's 3.7 and
System V Release 2's 3.9) which added a flag "modelines" which, when on,
enabled mode-line processing; the default was to disable mode-line
processing.

	Guy Harris

honey@down.FUN (Peter Honeyman) (05/28/85)

the fact that the modelines search is for the pattern [ev][xi]: rather
than for (ex|vi): aggravates the problem.
	peter