Tab-completion problem through ssh when files start by dash (_remote_files:compadd:80: bad option: -@)

[Antoine Amarilli <a3nm@a3nm.net>]

[-- Attachment #1: Type: text/plain, Size: 1603 bytes --]

Hello everyone,

I would like to report what I think may be a bug in zsh. (I am not
subscribed directly, so please include me in any replies.) The bug
concerns tab-completion through ssh in directories containing a file
that starts with a dash.

The bug occurs when running zsh -f (using a fresh user on a Debian
testing amd64 machine, if that matters -- I call the machine "foo"). To
reproduce:

1. Enable autocomplete on machine foo by issuing:

  foo% autoload -Uz compinit
  foo% compinit

2. On a remote machine bar that can be reached by ssh with public-key
authentication from foo, in the home directory of user jdoe, create a
file whose name starts with a dash and occurs early in the alphabet, for
instance "-@":
  
  bar% cd ~jdoe
  bar% touch -- -@

3. Try to scp a file "blah" from foo to bar and use tab-completion
(indicated as <TAB>):

  foo% touch blah
  foo% scp blah jdoe@bar:<TAB>

When I do this, the result looks like this:

  foo% touch blah
  foo% scp blah jdoe@bar:<TAB>
  _remote_files:compadd:80: bad option: -@
  foo% scp test jdoe@bar:
  [ACTUAL CONTENTS OF ~jdoe ON bar]

So it looks to me like the internals of tab-completion are not properly
escaping the file names in this case, hence the warning. This is mostly
an annoyance, but maybe there could be some more problematic
implications (e.g., maybe a malicious jdoe on bar could create files
that would pass actual options to compadd and mess up more seriously
with the zsh session on foo).

I hope that this report is useful! :)

Best regards,

-- 
Antoine Amarilli


[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 833 bytes --]