linux/ohmyzsh
1
0
Fork 0
mirror of https://github.com/ohmyzsh/ohmyzsh.git synced 2025-12-19 02:02:32 +01:00
Code Issues Projects Releases Packages Wiki Activity Actions

fix(themes): fix potential command injection in pygmalion, pygmalion-virtualenv and refined

Browse source 
The pygmalion and pygmalion-virtualenv themes unsafely handle git prompt information
which results in a double evaluation of this information, so a malicious git repository
could trigger a command injection if the user cloned and entered the repository.

A similar method could be used in the refined theme. All themes have been patched against this
vulnerability.
This commit is contained in:
Marc Cornellà 2021-11-09 09:54:21 +01:00
commit b3ba9978cc
No known key found for this signature in database
GPG key ID: 0314585E776A9C1B
3 changed files with 10 additions and 8 deletions
Download patch file Download diff file Expand all files Collapse all files

1
themes/refined.zsh-theme
View file

@ -70,6 +70,7 @@ preexec() {
# Output additional information about paths, repos and exec time
#
precmd() {
setopt localoptions nopromptsubst
vcs_info # Get version control info before we start outputting stuff
print -P "\n$(repo_information) %F{yellow}$(cmd_exec_time)%f"
unset cmd_timestamp #Reset cmd exec time.