From: Daniel Shahaf <d.s@daniel.shahaf.name>
To: Antoine Amarilli <a3nm@a3nm.net>
Cc: zsh-workers@zsh.org
Subject: Re: Tab-completion problem through ssh when files start by dash (_remote_files:compadd:80: bad option: -@)
Date: Sat, 15 Apr 2017 01:19:02 +0000 [thread overview]
Message-ID: <20170415011902.GB12706@fujitsu.shahaf.local2> (raw)
In-Reply-To: <20170413174717.4w6iatxztyutpbps@mu.a3nm.net>
Antoine Amarilli wrote on Thu, Apr 13, 2017 at 19:47:17 +0200:
> So it looks to me like the internals of tab-completion are not properly
> escaping the file names in this case, hence the warning. This is mostly
> an annoyance, but maybe there could be some more problematic
> implications (e.g., maybe a malicious jdoe on bar could create files
> that would pass actual options to compadd and mess up more seriously
> with the zsh session on foo).
The «-R remote-func» option seems to be the most obvious method of
injection. I'm not sure whether it requires a literal function name, or
whether an anonymous function would be accepted too.
> When I do this, the result looks like this:
>
> foo% touch blah
> foo% scp blah jdoe@bar:<TAB>
> _remote_files:compadd:80: bad option: -@
> foo% scp test jdoe@bar:
> [ACTUAL CONTENTS OF ~jdoe ON bar]
I think this fixes it?
diff --git a/Completion/Unix/Type/_remote_files b/Completion/Unix/Type/_remote_files
index 1e9fed1..a5fce9a 100644
--- a/Completion/Unix/Type/_remote_files
+++ b/Completion/Unix/Type/_remote_files
@@ -58,11 +58,13 @@ if zstyle -T ":completion:${curcontext}:files" remote-access; then
else rempat="${(q)PREFIX%%[^./][^/]#}\*"
fi
+ # remote filenames
remfiles=(${(M)${(f)"$(_call_program files $cmd $cmd_args $host ls -d1FL -- "$rempat" 2>/dev/null)"}%%[^/]#(|/)})
compset -P '*/'
compset -S '/*' || (( ${args[(I)-/]} )) || suf='remote file'
+ # display strings for remote files and directories
remdispf=(${remfiles:#*/})
remdispd=(${(M)remfiles:#*/})
@@ -77,9 +79,9 @@ if zstyle -T ":completion:${curcontext}:files" remote-access; then
while _tags; do
while _next_label files expl ${suf:-remote directory}; do
[[ -n $suf ]] &&
- compadd "$args[@]" "$expl[@]" -d remdispf ${(q)remdispf%[*=|]} && ret=0
+ compadd "$args[@]" "$expl[@]" -d remdispf -- ${(q)remdispf%[*=|]} && ret=0
compadd ${suf:+-S/} -r "/ \t\n\-" "$args[@]" "$expl[@]" -d remdispd \
- ${(q)remdispd%/} && ret=0
+ -- ${(q)remdispd%/} && ret=0
done
(( ret )) || return 0
done
Thanks for the report!
Daniel
next prev parent reply other threads:[~2017-04-15 1:24 UTC|newest]
Thread overview: 5+ messages / expand[flat|nested] mbox.gz Atom feed top
2017-04-13 17:47 Antoine Amarilli
2017-04-15 1:19 ` Daniel Shahaf [this message]
2017-04-15 15:59 ` Bart Schaefer
2017-04-16 19:08 ` Antoine Amarilli
2017-04-16 20:14 ` Daniel Shahaf
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20170415011902.GB12706@fujitsu.shahaf.local2 \
--to=d.s@daniel.shahaf.name \
--cc=a3nm@a3nm.net \
--cc=zsh-workers@zsh.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
Code repositories for project(s) associated with this public inbox
https://git.vuxu.org/mirror/zsh/
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).