macvim-mirror

mirror of https://github.com/macvim-dev/macvim.git synced 2026-02-14 11:53:26 +01:00

Go to file

Yee Cheng Chin 0380d81c3d Harden NSConnection security in handling third-party connections

Currently, MacVim uses Distributed Objects / NSConnection as the IPC
mechanism. The child Vim process connects to the parent MacVim process
using NSConnection and registers itself. A security issue with this is
that NSConnection is global, and any process can connect to the app, and
MacVim isn't too hardened against this issue. Note that one reason why
we do need the ability for the MacVim app to accept random connections
is to support the `:gui` command from a random Vim process, and to
supported listing server names.

One issue is that while the app protocol (MMAppProtocol) is only a few
functions, we were exposing the entire app, which exposes functions like
`executeInLoginShell`, which could be invoked by the caller, which is
quite unsafe as it could be invoked by any third-party app. Fix this
issue by using `NSProtocolChecker` to make sure we only expose the APIs
that we want to expose.

Each Vim controller now also gets a randomized ID instead of an
incremental one. Currently the API for sending messages from Vim to
MacVim is public, meaning any app can send message to MacVim. Using a
randomized ID makes it more difficult for an attacker to guess the ID
(which used to always start at 1) and injects random commands to MacVim
pretending to be the Vim process.

Also, make sure if MacVim failed to register the NSConnection on launch,
just display an error and terminate. This usually happens if multiple
MacVim instances are opened, but also if an attacking app is trying to
register a connection first using the same name. This way the user would
know something is wrong instead of MacVim being opened by not able to do
anything as it didn't register the connection.

In the near future, the IPC mechanism will be switched to XPC, which is
the preferred way by Apple as Distributed Objects has been deprecated
for a long time. It will have proper security to only accept processes
within the same app to message each other. It will be done in #1157.

2023-09-11 20:52:04 -07:00