m-chrzan.xyz
aboutsummaryrefslogtreecommitdiff
path: root/contrib/vim/redact_pass.vim
blob: 14919bb2cb65c32a0ba6b11251fbb3229e1e4d6c (plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
"
" redact_pass.vim: Switch off the 'viminfo', 'backup', 'writebackup',
" 'swapfile', and 'undofile' globally when editing a password in pass(1).
"
" This is to prevent anyone being able to extract passwords from your Vim
" cache files in the event of a compromise.
"
" Author: Tom Ryder <tom@sanctum.geek.nz>
" License: Same as Vim itself
"
if exists('g:loaded_redact_pass') || &compatible
  finish
endif
if !has('autocmd')
  finish
endif
let g:loaded_redact_pass = 1

" Pattern to match for the portion of the path after the temporary dir,
" starting with the leading slash
let s:pattern = '\m\C/pass\.[^/]\+/[^/]\+\.txt$'

" Check whether the given dir name is not an empty string, whether the first
" file in the argument list is within the named dir, and that the whole path
" matches the above pattern immediately after that dir name
function! s:PassPath(root)

  " Check we actually got a value, i.e. this wasn't an empty environment
  " variable
  if !strlen(a:root)
    return 0
  endif

  " Full resolved path to the root dir with no trailing slashes
  let l:root = fnamemodify(a:root, ':p:h')

  " Full resolved path to the first file in the arg list
  let l:path = fnamemodify(argv(0), ':p')

  " Check the string all match and at the expected points
  return stridx(l:path, l:root) == 0
        \ && strlen(l:root) == match(l:path, s:pattern)

endfunction

" Check whether we should set redacting options or not
function! s:CheckArgsRedact()

  " Short-circuit unless we're editing just one file and it looks like a path
  " in one of the three expected directories; we're trying hard to make sure
  " this really is a password file and we're not messing with the user's
  " precious settings unnecessarily
  if argc() != 1
        \ || !s:PassPath('/dev/shm')
        \ && !s:PassPath($TMPDIR)
        \ && !s:PassPath('/tmp')
    return
  endif

  " Disable all the leaky options globally
  set nobackup
  set nowritebackup
  set noswapfile
  set viminfo=
  if has('persistent_undo')
    set noundofile
  endif

  " Tell the user what we're doing so they know this worked, via a message and
  " a global variable they can check
  echomsg 'Editing password file--disabled leaky options!'
  let g:redact_pass_redacted = 1

endfunction

" Auto function loads only when Vim starts up
augroup redact_pass
  autocmd!
  autocmd VimEnter * call s:CheckArgsRedact()
augroup END