Skip to content
Permalink
Browse files Browse the repository at this point in the history
fix(lib): fix potential command injection in title and spectrum f…
…unctions

The `title` function unsafely prints its input without sanitization, which if used
with custom user code that calls it, it could trigger command injection.

The `spectrum_ls` and `spectrum_bls` could similarly be exploited if a variable is
changed in the user's shell environment with a carefully crafted value. This is
highly unlikely to occur (and if possible, other methods would be used instead),
but with this change the exploit of these two functions is now impossible.
  • Loading branch information
mcornella committed Nov 11, 2021
1 parent 06fc5fb commit a263cda
Show file tree
Hide file tree
Showing 2 changed files with 10 additions and 9 deletions.
6 changes: 4 additions & 2 deletions lib/spectrum.zsh
Expand Up @@ -20,16 +20,18 @@ done

# Show all 256 colors with color number
function spectrum_ls() {
setopt localoptions nopromptsubst
local ZSH_SPECTRUM_TEXT=${ZSH_SPECTRUM_TEXT:-Arma virumque cano Troiae qui primus ab oris}
for code in {000..255}; do
print -P -- "$code: $FG[$code]$ZSH_SPECTRUM_TEXT%{$reset_color%}"
print -P -- "$code: ${FG[$code]}${ZSH_SPECTRUM_TEXT}%{$reset_color%}"
done
}

# Show all 256 colors where the background is set to specific color
function spectrum_bls() {
setopt localoptions nopromptsubst
local ZSH_SPECTRUM_TEXT=${ZSH_SPECTRUM_TEXT:-Arma virumque cano Troiae qui primus ab oris}
for code in {000..255}; do
print -P -- "$code: $BG[$code]$ZSH_SPECTRUM_TEXT%{$reset_color%}"
print -P -- "$code: ${BG[$code]}${ZSH_SPECTRUM_TEXT}%{$reset_color%}"
done
}
13 changes: 6 additions & 7 deletions lib/termsupport.zsh
Expand Up @@ -7,8 +7,7 @@
# (In screen, only short_tab_title is used)
# Limited support for Apple Terminal (Terminal can't set window and tab separately)
function title {
emulate -L zsh
setopt prompt_subst
setopt localoptions nopromptsubst

# Don't set the title if inside emacs, unless using vterm
[[ -n "$INSIDE_EMACS" && "$INSIDE_EMACS" != vterm ]] && return
Expand Down Expand Up @@ -48,13 +47,13 @@ fi

# Runs before showing the prompt
function omz_termsupport_precmd {
[[ "${DISABLE_AUTO_TITLE:-}" == true ]] && return
title $ZSH_THEME_TERM_TAB_TITLE_IDLE $ZSH_THEME_TERM_TITLE_IDLE
[[ "${DISABLE_AUTO_TITLE:-}" != true ]] || return
title "$ZSH_THEME_TERM_TAB_TITLE_IDLE" "$ZSH_THEME_TERM_TITLE_IDLE"
}

# Runs before executing the command
function omz_termsupport_preexec {
[[ "${DISABLE_AUTO_TITLE:-}" == true ]] && return
[[ "${DISABLE_AUTO_TITLE:-}" != true ]] || return

emulate -L zsh
setopt extended_glob
Expand Down Expand Up @@ -97,10 +96,10 @@ function omz_termsupport_preexec {
fi

# cmd name only, or if this is sudo or ssh, the next cmd
local CMD=${1[(wr)^(*=*|sudo|ssh|mosh|rake|-*)]:gs/%/%%}
local CMD="${1[(wr)^(*=*|sudo|ssh|mosh|rake|-*)]:gs/%/%%}"
local LINE="${2:gs/%/%%}"

title '$CMD' '%100>...>$LINE%<<'
title "$CMD" "%100>...>${LINE}%<<"
}

autoload -Uz add-zsh-hook
Expand Down

0 comments on commit a263cda

Please sign in to comment.