1
0
Fork 0
mirror of synced 2024-11-26 17:25:35 -05:00
zimfw/modules
Eric Nielsen 53a3cd7933 Fix git-info arbitrary command execution exposure
The contents of git_info are subject to expansion by the shell. Avoid
putting raw ref names in the prompt to protect the user from arbitrary
code execution via specially crafted ref names (e.g., a ref named
'$(IFS=_;cmd=sudo_rm_-rf_/;$cmd)' would execute 'sudo rm -rf /' when the
prompt is drawn). Instead, put the ref names in new global variables and
reference these variables from git_info.

See:
- https://github.com/njhartwell/pw3nage
- 8976500cbb

Fixes #158, Closes #159
2017-03-30 10:17:03 -07:00
..
archive [archive] correct unarchive aliases 2016-01-07 16:20:23 -05:00
completion [completion] update submodule 2017-03-08 06:16:42 -08:00
custom re-word custom/init.zsh 2015-12-31 10:48:03 -05:00
debug [meta] use uname -a to prevent OS conflicts 2016-09-28 03:02:10 -07:00
directory use setopt NO_CLOBBER instead of unsetopt CLOBBER 2017-01-11 22:16:07 -08:00
environment [environment] add customizable term title 2017-01-21 08:54:32 -08:00
fasd [fasd] Fix completion 2017-01-22 10:37:36 -08:00
git git-commit-list: fix typo 2017-03-29 12:57:05 -07:00
git-info Fix git-info arbitrary command execution exposure 2017-03-30 10:17:03 -07:00
history use consistent variable style 2015-12-19 09:48:29 -05:00
history-substring-search [substring-search] update submodule 2017-01-05 22:33:13 -08:00
input [input] Fix typo in README 2016-12-01 23:51:59 -08:00
meta [meta] zmanage: rescope usage to local variable 2016-10-25 16:06:19 -07:00
pacman [pacman] keep old packages for auru 2016-12-01 23:50:37 -08:00
prompt Rewrite steeef theme using git-info 2017-03-29 19:40:07 -07:00
spectrum [spectrum] add FX var check 2016-01-12 13:07:27 -05:00
ssh fix broken variable 2015-12-23 05:13:09 -05:00
syntax-highlighting [syntax-highlighting] update submodule 2017-03-08 06:17:35 -08:00
utility [utility] fix warning when logging in on tty 2017-01-29 14:33:18 -08:00