.viminfo file gets deleted and re-created with 666 permissions

[David]

Binary package hint: vim

Version: 1:7.0-035+1ubuntu5

sa@inyo:~$ rm .viminfo
sa@inyo:~$ ln -s /dev/null .viminfo
sa@inyo:~$ ls -l .viminfo
lrwxrwxrwx 1 sa sa 9 2007-01-12 17:16 .viminfo -> /dev/null
sa@inyo:~$ umask 007
sa@inyo:~$ /usr/bin/vim.basic -c 'quit'
sa@inyo:~$ ls -l .viminfo
-rw-rw-rw- 1 sa sa 509 2007-01-12 17:16 .viminfo

As you can see the .viminfo file gets deleted and re-created with permissions 666 by vim.

Note that the use of -c 'quit' is just to simplify the bug for transcribing here -- I promise you the same thing happens if you use vim for editing/saving a document as well.

I consider this a security bug. vim deletes a file without telling me, and not only that but when it re-creates it, it ignores my umask by making it world writable. This is not what I expected it to do.

[Micah Cowan (micahcowan)]

Thank you for submitting this bug report.

I've confirmed in Feisty, for regular vim-gnome, and also in the latest bleeding-edge sources from upstream. I'll bring this up with them.

[Micah Cowan (micahcowan)]

Discussion with vim-dev here: http://tech.groups.yahoo.com/group/vimdev/message/46895

[Micah Cowan (micahcowan)]

Upstream believes it is not a bug. The proper way to disable the use of .viminfo is to ":set viminfo=".

I pointed out that symlinking to /dev/null is a fairly common idiom; but OTOH there would be a strong case that the idiom applies to files that the user supplies to a program; .viminfo is something that vim generates itself, and overwrites each time (moving a temporary file over it), so replacing it with a symlink could be considered "mucking with internal vim stuff".

See Bram's assessment, here: http://tech.groups.yahoo.com/group/vimdev/message/46903