Xref: utzoo alt.security:1636 comp.unix.sysv386:818
Path: utzoo!utgpu!news-server.csri.toronto.edu!cs.utexas.edu!uunet!mcsun!ukc!slxsys!ibmpcug!dylan
From: dylan@ibmpcug.co.uk (Matthew Farwell)
Newsgroups: alt.security,comp.unix.sysv386
Subject: Re: Here's how to stop shell escapes from vi
Message-ID: <1990Sep29.002328.27798@ibmpcug.co.uk>
Date: 29 Sep 90 00:23:28 GMT
References: <924@mwtech.UUCP> <27387:Sep2320:07:3890@kramden.acf.nyu.edu> <1990Sep24.040745.10454@chinet.chi.il.us> <1038:Sep2414:36:0390@k <935@mwtech.UUCP> <1990Sep27.215910.11192@hriso.ATT.COM>
Reply-To: dylan@ibmpcug.CO.UK (Matthew Farwell)
Organization: The IBM PC User Group, UK.
Lines: 37

In article <1990Sep27.215910.11192@hriso.ATT.COM> bhh@hriso.ATT.COM (Brad Hansen) writes:
>In article <935@mwtech.UUCP> martin@mwtech.UUCP (Martin Weitzel) writes:
>>If you have two minutes time, please try the following: 2000i-<esc>
>>This should construct a line of 2000 characters, which is above the
>>limits at least my vi (386/ix Rel 2.0.2) can handle. Then insert
>>another character into this line ... and whoops, vi throws you into
>>ex-mode.
>>
>>Nice feature - who would ever have thought? Possibly some user which
>>you carefully tried to keep away from ex-prompts knows this little
>>"feature" (who said it is a bug?).
>
>Fallback to 'ex' mode when vi hits something beyond its capabilities 
>is a well known feature of vi and the other editors based on ex, 
>although it is admittedly not in the man pages.  What would you 
>prefer, a core dump?

The 2000i-<ESC> thing doesn't actually put you back into ex mode on my
version of vi (Xenix 2.3.1), but I agree that there are a lot more ways
to do this. For instance, on this atari I'm sitting in front of, the
shift 3 key (which is marked #) is actually mapped by the terminal
emulation to '^\', which puts me into ex mode. Tell me how would you fix
that without source?

Taking out ex commands takes away half the powers of vi.  I don't think
I could live without :set + :s.

All this means we come back to the statement:

The ONLY way to make vi safe is to hack the source code.

Dylan.
-- 
Matthew J Farwell                 | Email: dylan@ibmpcug.co.uk
The IBM PC User Group, PO Box 360,|        ...!uunet!ukc!ibmpcug!dylan
Harrow HA1 4LQ England            | CONNECT - Usenet Access in the UK!!
Phone: +44 81-863-1191            | Sun? Don't they make coffee machines?