• Marc Cornellà's avatar
    fix(lib): fix potential command injection in `title` and `spectrum` functions · a263cdac
    Marc Cornellà authored
    The `title` function unsafely prints its input without sanitization, which if used
    with custom user code that calls it, it could trigger command injection.
    
    The `spectrum_ls` and `spectrum_bls` could similarly be exploited if a variable is
    changed in the user's shell environment with a carefully crafted value. This is
    highly unlikely to occur (and if possible, other methods would be used instead),
    but with this change the exploit of these two functions is now impossible.
    a263cdac
spectrum.zsh 1.2 KB
# A script to make using 256 colors in zsh less painful.
# P.C. Shyamshankar <sykora@lucentbeing.com>
# Copied from https://github.com/sykora/etc/blob/master/zsh/functions/spectrum/

typeset -AHg FX FG BG

FX=(
  reset     "%{%}"
  bold      "%{%}" no-bold      "%{%}"
  italic    "%{%}" no-italic    "%{%}"
  underline "%{%}" no-underline "%{%}"
  blink     "%{%}" no-blink     "%{%}"
  reverse   "%{%}" no-reverse   "%{%}"
)

for color in {000..255}; do
  FG[$color]="%{[38;5;${color}m%}"
  BG[$color]="%{[48;5;${color}m%}"
done

# Show all 256 colors with color number
function spectrum_ls() {
  setopt localoptions nopromptsubst
  local ZSH_SPECTRUM_TEXT=${ZSH_SPECTRUM_TEXT:-Arma virumque cano Troiae qui primus ab oris}
  for code in {000..255}; do
    print -P -- "$code: ${FG[$code]}${ZSH_SPECTRUM_TEXT}%{$reset_color%}"
  done
}

# Show all 256 colors where the background is set to specific color
function spectrum_bls() {
  setopt localoptions nopromptsubst
  local ZSH_SPECTRUM_TEXT=${ZSH_SPECTRUM_TEXT:-Arma virumque cano Troiae qui primus ab oris}
  for code in {000..255}; do
    print -P -- "$code: ${BG[$code]}${ZSH_SPECTRUM_TEXT}%{$reset_color%}"
  done
}