Customization/ohmyzsh
1
0
Fork 0
mirror of https://github.com/ohmyzsh/ohmyzsh.git synced 2024-12-27 06:41:58 +00:00
Code Releases Activity
ohmyzsh/plugins/hitokoto/hitokoto.plugin.zsh

19 lines
489 B
Bash
Raw Normal View History

-mAdd hitokoto plugin (#8422)
2019-12-29 05:04:24 +00:00
if ! (( $+commands[curl] )); then
fix(plugins): fix potential command injection in `rand-quote` and `hitokoto` The `rand-quote` plugin uses quotationspage.com and prints part of its content to the shell without sanitization, which could trigger command injection. There is no evidence that this has been exploited, but this commit removes all possibility for exploit. Similarly, the `hitokoto` plugin uses the hitokoto.cn website to print quotes to the shell, also without sanitization. Furthermore, there is also no evidence that this has been exploited, but with this change it is now impossible.
2021-11-09 08:31:09 +00:00
echo "hitokoto plugin needs curl to work" >&2
return
-mAdd hitokoto plugin (#8422)
2019-12-29 05:04:24 +00:00
fi
function hitokoto {
fix(plugins): fix potential command injection in `rand-quote` and `hitokoto` The `rand-quote` plugin uses quotationspage.com and prints part of its content to the shell without sanitization, which could trigger command injection. There is no evidence that this has been exploited, but this commit removes all possibility for exploit. Similarly, the `hitokoto` plugin uses the hitokoto.cn website to print quotes to the shell, also without sanitization. Furthermore, there is also no evidence that this has been exploited, but with this change it is now impossible.
2021-11-09 08:31:09 +00:00
setopt localoptions nopromptsubst
-mAdd hitokoto plugin (#8422)
2019-12-29 05:04:24 +00:00
fix(plugins): fix potential command injection in `rand-quote` and `hitokoto` The `rand-quote` plugin uses quotationspage.com and prints part of its content to the shell without sanitization, which could trigger command injection. There is no evidence that this has been exploited, but this commit removes all possibility for exploit. Similarly, the `hitokoto` plugin uses the hitokoto.cn website to print quotes to the shell, also without sanitization. Furthermore, there is also no evidence that this has been exploited, but with this change it is now impossible.
2021-11-09 08:31:09 +00:00
# Get hitokoto data
local -a data
data=("${(ps:\n:)"$(command curl -s --connect-timeout 2 "https://v1.hitokoto.cn" | command jq -j '.hitokoto+"\n"+.from')"}")
-mAdd hitokoto plugin (#8422)
2019-12-29 05:04:24 +00:00
fix(plugins): fix potential command injection in `rand-quote` and `hitokoto` The `rand-quote` plugin uses quotationspage.com and prints part of its content to the shell without sanitization, which could trigger command injection. There is no evidence that this has been exploited, but this commit removes all possibility for exploit. Similarly, the `hitokoto` plugin uses the hitokoto.cn website to print quotes to the shell, also without sanitization. Furthermore, there is also no evidence that this has been exploited, but with this change it is now impossible.
2021-11-09 08:31:09 +00:00
# Exit if could not fetch hitokoto
[[ -n "$data" ]] || return 0
local quote="${data[1]}" author="${data[2]}"
print -P "%F{3}${author}%f: “%F{5}${quote}%f”"
-mAdd hitokoto plugin (#8422)
2019-12-29 05:04:24 +00:00
}
Copy permalink