Re: [SECURITY] Restricted mode bypass via unnamed-buffer save

Benno Schulenberg <[email protected]> Sun, 19 Apr 2026 16:25:21 +0200

Newsgroups	gmane.editors.nano.devel
Message-ID	<[email protected]>

Op 18-04-2026 om 23:49 schreef G:
> Although restricted mode is documented as allowing edits only to files 
> specified on the command line, the current implementation still accepts free-
> form filename input at the Write-File prompt when the current buffer has no
> filename yet.

This is a feature.  The restricted mode is normally "forced" onto the user
(by some script or whatever).  If this script does not provide a filename,
then it explicitly allows the user to write whatever they like into the
new buffer and save it under any name and anywhere they like.  If the
controlling script does not want that, then it should provide a filename.

> The save path then blocks only overwrites and renames of existing files, not
> writes to brand-new paths.

There would be no need for blocking overwrites of existing files if a
restricted nano did not purposely allow the saving of a new buffer.


> This violates two explicit, user-facing security claims:
> 
> 1. **`doc/nano.1:210-214`** (for `-R` / `--restricted`):
> 
>> Restricted mode: don't read or write to any file not specified on the
>> command line.

It also says: "don't allow a file to be [...] saved under a different name
if it already has one".  The addition of "if it already has one" tries to
convey that saving a new buffer under any name is allowed.  Sure, the docs
can be improved, but the code is working as intended.

> 2. **`doc/rnano.1:29-31`**:
> 
>> This allows editing only the specified file or files, and doesn't allow
>> the user access to the filesystem nor to a command shell.

Yes, but the synopsis shows the `file` argument as optional:

     rnano [options] [[+line[,column]] file]...


Anyway, `rvim` also allows editing a nameless buffer and saving it under
any name.  Have you reported an issue there too?


Benno

OpenPGP_signature.asc (application/pgp-signature, 840 B)