ohmyzsh/lib/completion.zsh
Paul Frederiksen 0725ed84e6 fix(completion): prevent script execution during tab completion
Fixes #13366 - Tab completion after 'git' triggers bin/test execution
Fixes #13310 - Duplicate completion candidates

The 'l:|=* r:|=*' matcher pattern in completion.zsh was causing:
1. Unintended script execution during tab completion
2. Duplicate completion candidates
3. Overly permissive matching

This pattern allowed left-side anchor matching which could cause zsh
to execute scripts like bin/test when searching for completions.

Removed 'l:|=* r:|=*' from all three configuration branches while
preserving essential functionality:
- Case-insensitive matching: m:{[:lower:][:upper:]}={[:upper:][:lower:]}
- Right-side fuzzy matching: r:|=*
- Hyphen-insensitive matching: m:{[:lower:][:upper:]-_}={[:upper:][:lower:]_-}

Testing shows that completion continues to work correctly without
the security and performance issues.
2025-10-24 09:47:17 -07:00

84 lines
3.5 KiB
Bash

# fixme - the load process here seems a bit bizarre
zmodload -i zsh/complist
WORDCHARS=''
unsetopt menu_complete # do not autoselect the first completion entry
unsetopt flowcontrol
setopt auto_menu # show completion menu on successive tab press
setopt complete_in_word
setopt always_to_end
# should this be in keybindings?
bindkey -M menuselect '^o' accept-and-infer-next-history
zstyle ':completion:*:*:*:*:*' menu select
# case insensitive (all), partial-word and substring completion
# NOTE: 'l:|=* r:|=*' matcher removed due to causing unexpected behavior:
# - Can trigger unintended execution of scripts during tab completion (issue #13366)
# - Causes duplicate completion candidates (issue #13310)
# - Creates overly permissive matching that degrades user experience
# The remaining matchers (case-insensitive + right-side anchor) provide all essential
# completion functionality without the problematic side effects.
if [[ "$CASE_SENSITIVE" = true ]]; then
zstyle ':completion:*' matcher-list 'r:|=*'
else
if [[ "$HYPHEN_INSENSITIVE" = true ]]; then
zstyle ':completion:*' matcher-list 'm:{[:lower:][:upper:]-_}={[:upper:][:lower:]_-}' 'r:|=*'
else
zstyle ':completion:*' matcher-list 'm:{[:lower:][:upper:]}={[:upper:][:lower:]}' 'r:|=*'
fi
fi
unset CASE_SENSITIVE HYPHEN_INSENSITIVE
# Complete . and .. special directories
zstyle ':completion:*' special-dirs true
zstyle ':completion:*' list-colors ''
zstyle ':completion:*:*:kill:*:processes' list-colors '=(#b) #([0-9]#) ([0-9a-z-]#)*=01;34=0=01'
if [[ "$OSTYPE" = solaris* ]]; then
zstyle ':completion:*:*:*:*:processes' command "ps -u $USERNAME -o pid,user,comm"
else
zstyle ':completion:*:*:*:*:processes' command "ps -u $USERNAME -o pid,user,comm -w -w"
fi
# disable named-directories autocompletion
zstyle ':completion:*:cd:*' tag-order local-directories directory-stack path-directories
# Use caching so that commands like apt and dpkg complete are usable
zstyle ':completion:*' use-cache yes
zstyle ':completion:*' cache-path $ZSH_CACHE_DIR
# Don't complete uninteresting users
zstyle ':completion:*:*:*:users' ignored-patterns \
adm amanda apache at avahi avahi-autoipd beaglidx bin cacti canna \
clamav daemon dbus distcache dnsmasq dovecot fax ftp games gdm \
gkrellmd gopher hacluster haldaemon halt hsqldb ident junkbust kdm \
ldap lp mail mailman mailnull man messagebus mldonkey mysql nagios \
named netdump news nfsnobody nobody nscd ntp nut nx obsrun openvpn \
operator pcap polkitd postfix postgres privoxy pulse pvm quagga radvd \
rpc rpcuser rpm rtkit scard shutdown squid sshd statd svn sync tftp \
usbmux uucp vcsa wwwrun xfs '_*'
# ... unless we really want to.
zstyle '*' single-ignored show
if [[ ${COMPLETION_WAITING_DOTS:-false} != false ]]; then
expand-or-complete-with-dots() {
# use $COMPLETION_WAITING_DOTS either as toggle or as the sequence to show
[[ $COMPLETION_WAITING_DOTS = true ]] && COMPLETION_WAITING_DOTS="%F{red}…%f"
# turn off line wrapping and print prompt-expanded "dot" sequence
printf '\e[?7l%s\e[?7h' "${(%)COMPLETION_WAITING_DOTS}"
zle expand-or-complete
zle redisplay
}
zle -N expand-or-complete-with-dots
# Set the function as the default tab completion widget
bindkey -M emacs "^I" expand-or-complete-with-dots
bindkey -M viins "^I" expand-or-complete-with-dots
bindkey -M vicmd "^I" expand-or-complete-with-dots
fi
# automatically load bash completion functions
autoload -U +X bashcompinit && bashcompinit