mirror of
https://github.com/ohmyzsh/ohmyzsh.git
synced 2024-11-12 08:50:08 +00:00
fix(lib): fix potential command injection in title
and spectrum
functions
The `title` function unsafely prints its input without sanitization, which if used with custom user code that calls it, it could trigger command injection. The `spectrum_ls` and `spectrum_bls` could similarly be exploited if a variable is changed in the user's shell environment with a carefully crafted value. This is highly unlikely to occur (and if possible, other methods would be used instead), but with this change the exploit of these two functions is now impossible.
This commit is contained in:
parent
06fc5fb129
commit
a263cdac9c
2 changed files with 10 additions and 9 deletions
|
@ -20,16 +20,18 @@ done
|
|||
|
||||
# Show all 256 colors with color number
|
||||
function spectrum_ls() {
|
||||
setopt localoptions nopromptsubst
|
||||
local ZSH_SPECTRUM_TEXT=${ZSH_SPECTRUM_TEXT:-Arma virumque cano Troiae qui primus ab oris}
|
||||
for code in {000..255}; do
|
||||
print -P -- "$code: $FG[$code]$ZSH_SPECTRUM_TEXT%{$reset_color%}"
|
||||
print -P -- "$code: ${FG[$code]}${ZSH_SPECTRUM_TEXT}%{$reset_color%}"
|
||||
done
|
||||
}
|
||||
|
||||
# Show all 256 colors where the background is set to specific color
|
||||
function spectrum_bls() {
|
||||
setopt localoptions nopromptsubst
|
||||
local ZSH_SPECTRUM_TEXT=${ZSH_SPECTRUM_TEXT:-Arma virumque cano Troiae qui primus ab oris}
|
||||
for code in {000..255}; do
|
||||
print -P -- "$code: $BG[$code]$ZSH_SPECTRUM_TEXT%{$reset_color%}"
|
||||
print -P -- "$code: ${BG[$code]}${ZSH_SPECTRUM_TEXT}%{$reset_color%}"
|
||||
done
|
||||
}
|
||||
|
|
|
@ -7,8 +7,7 @@
|
|||
# (In screen, only short_tab_title is used)
|
||||
# Limited support for Apple Terminal (Terminal can't set window and tab separately)
|
||||
function title {
|
||||
emulate -L zsh
|
||||
setopt prompt_subst
|
||||
setopt localoptions nopromptsubst
|
||||
|
||||
# Don't set the title if inside emacs, unless using vterm
|
||||
[[ -n "$INSIDE_EMACS" && "$INSIDE_EMACS" != vterm ]] && return
|
||||
|
@ -48,13 +47,13 @@ fi
|
|||
|
||||
# Runs before showing the prompt
|
||||
function omz_termsupport_precmd {
|
||||
[[ "${DISABLE_AUTO_TITLE:-}" == true ]] && return
|
||||
title $ZSH_THEME_TERM_TAB_TITLE_IDLE $ZSH_THEME_TERM_TITLE_IDLE
|
||||
[[ "${DISABLE_AUTO_TITLE:-}" != true ]] || return
|
||||
title "$ZSH_THEME_TERM_TAB_TITLE_IDLE" "$ZSH_THEME_TERM_TITLE_IDLE"
|
||||
}
|
||||
|
||||
# Runs before executing the command
|
||||
function omz_termsupport_preexec {
|
||||
[[ "${DISABLE_AUTO_TITLE:-}" == true ]] && return
|
||||
[[ "${DISABLE_AUTO_TITLE:-}" != true ]] || return
|
||||
|
||||
emulate -L zsh
|
||||
setopt extended_glob
|
||||
|
@ -97,10 +96,10 @@ function omz_termsupport_preexec {
|
|||
fi
|
||||
|
||||
# cmd name only, or if this is sudo or ssh, the next cmd
|
||||
local CMD=${1[(wr)^(*=*|sudo|ssh|mosh|rake|-*)]:gs/%/%%}
|
||||
local CMD="${1[(wr)^(*=*|sudo|ssh|mosh|rake|-*)]:gs/%/%%}"
|
||||
local LINE="${2:gs/%/%%}"
|
||||
|
||||
title '$CMD' '%100>...>$LINE%<<'
|
||||
title "$CMD" "%100>...>${LINE}%<<"
|
||||
}
|
||||
|
||||
autoload -Uz add-zsh-hook
|
||||
|
|
Loading…
Reference in a new issue