• Marc Cornellà's avatar
    fix(plugins): fix potential command injection in `rand-quote` and `hitokoto` · 72928432
    Marc Cornellà authored
    The `rand-quote` plugin uses quotationspage.com and prints part of its content to the
    shell without sanitization, which could trigger command injection. There is no evidence
    that this has been exploited, but this commit removes all possibility for exploit.
    
    Similarly, the `hitokoto` plugin uses the hitokoto.cn website to print quotes to the
    shell, also without sanitization. Furthermore, there is also no evidence that this has
    been exploited, but with this change it is now impossible.
    72928432
hitokoto.plugin.zsh 489 Bytes
if ! (( $+commands[curl] )); then
  echo "hitokoto plugin needs curl to work" >&2
  return
fi

function hitokoto {
  setopt localoptions nopromptsubst

  # Get hitokoto data
  local -a data
  data=("${(ps:\n:)"$(command curl -s --connect-timeout 2 "https://v1.hitokoto.cn" | command jq -j '.hitokoto+"\n"+.from')"}")

  # Exit if could not fetch hitokoto
  [[ -n "$data" ]] || return 0

  local quote="${data[1]}" author="${data[2]}"
  print -P "%F{3}${author}%f: “%F{5}${quote}%f”"
}