Ciaran McCreesh discovered news ways in which a VIM modeline
can be used to trojan a text file. The patch by Bram
Moolenaar reads:
Problem: Unusual characters in an option value may cause
unexpected behavior, especially for a modeline. (Ciaran
McCreesh)
Solution: Don't allow setting termcap options or
'printdevice' or 'titleold' in a modeline. Don't list
options for "termcap" and "all" in a modeline. Don't allow
unusual characters in 'filetype', 'syntax', 'backupext',
'keymap', 'patchmode' and 'langmenu'.
Note: It is generally recommended that VIM
users use set nomodeline
in
~/.vimrc
to avoid the possibility of trojaned
text files.