How safe is it to use an unknown `_vimrc` or `vimscript` file?

Question

I do not know if this question should be asked here or not. In almost every language, malware exists. Is the same also applicable for vimscript?

Suppose vim is running with high system privileges. Is there any possibility that a new vim user could ruin up his/her system by using a plugin or nice looking vimrc file (i.e., so-called malicious scripts in other scripting languages)?

What are the measures that a new user can take care of before running unknown script files? I know that disabling scripts is a obvious solution to that. But there are a really good number of plugins which are quite useful, even for the new learners.

Again to say, this question might not fit here, but I do believe that security is also very important part of the entire picture.

Pointing to some resources or info regarding this would be very much helpful for the new vim users like me.

Answer 1

Well, Vim can execute arbitrary commands with :!. It can set environment variables. Malware scripts that are shell scripts can, therefore, be run from Vimscript.

It can make use of complex Perl, Python, Ruby or Lua programs. So malware written in any of these that makes use of only standard libraries could be embedded in Vim.

Even if neither of these were true, Vim is an editor. If run as root, we could easily edit your /etc/passwd and /etc/shadow files to create a new user and /etc/sudoers to grant them complete sudo privileges, and a cronjob to run shell scripts to set this user up.

As with executing random scripts off the internet, there's no easy way to be safe. In Linux, you could run in a VM with an overlay might tell you what files a given vimrc modifies. It depends on how much risk you perceive.

Answer 2

Extending on muru's answer, you could inspect the code, specially as the plugin code is usually very short (the exceptions are some popular plugins, but by being popular they are safer -- you can expect that many others have reviewed the source).

You don't have to fully understand the code; it would is enough to look for "dangerous" commands:

1. :! and system(): allows the execution of shell commands, thus could change your system
2. :perldo, :python, :lua, :tcl, and :ruby: execute commands on different languages, which may contain system calls embedded
3. :execute: this command executes a string as a command, so it can be use to conceal one of the previous commands (e.g.: in order to make harder to spot call system('malware') or perldo malware, someone could concatenate the string into a variable)
4. function("MyFunc"): call function references -- accepts a variable as a parameter, thus allowing concealing of system()

You could also try running some plugin functions using 'secure' or sandbox to detect shell and external languages (perl, python, etc).