1. 21 Feb, 2022 3 commits
  2. 18 Feb, 2022 1 commit
  3. 13 Feb, 2022 1 commit
    • Marc Cornellà's avatar
      fix: apply workaround patch for vcs_info (CVE-2021-45444) · ef3f7c43
      Marc Cornellà authored
      This lib function applies a patch to the VCS_INFO_formats function
      in zsh versions from v5.0.3 until v5.8, which don't quote % chars
      in some arguments received. Normally that just means that some
      % characters in these strings (branch names, directories, etc.)
      will be incorrectly parsed as formatting sequences.
      
      With CVE-2021-45444, however, this means that one of these strings
      from a malicious source (e.g. a malicious git repository) can
      trigger command injection and run arbitrary code in the user's
      machine when visiting such git repository.
      
      Zsh 5.8.1 fixes this vulnerability [1], but older vcs_info setups
      still need a workaround such as this one to patch the vulnerability.
      
      [1] https://github.com/zsh-users/zsh/commit/c3ea1e5d52eff8b7b172fa8c1ccc3462b43b2790
      ef3f7c43
  4. 11 Feb, 2022 4 commits
  5. 10 Feb, 2022 8 commits
  6. 09 Feb, 2022 2 commits
  7. 07 Feb, 2022 4 commits
  8. 04 Feb, 2022 1 commit
  9. 03 Feb, 2022 1 commit
  10. 02 Feb, 2022 1 commit
    • Marc Cornellà's avatar
      fix(cli): allow `omz` commands to be used in a script (#10645) · e1a9d0ce
      Marc Cornellà authored
      The commands `omz plugin {enable,disable}` and `omz theme set`
      automatically reload the zsh session on success. With this
      change, the CLI checks whether the commands are run in an
      interactive session before reloading the zsh session.
      
      This change also conditionally sets the completion function
      for `omz` so that it's not done in a non-interactive session.
      e1a9d0ce
  11. 01 Feb, 2022 4 commits
  12. 28 Jan, 2022 5 commits
  13. 27 Jan, 2022 4 commits
  14. 26 Jan, 2022 1 commit
    • Marc Cornellà's avatar
      fix(npx)!: detect new `npx` versions and fail gracefully (#10452) · 3741d1aa
      Marc Cornellà authored
      BREAKING CHANGE: the `npx` plugin used a feature of `npx` to check for
      npm packages and run them if a command was not found. This feature was
      removed in v7.0.0 and was deemed insecure. The `npx` plugin is now
      officially deprecated and will be removed soon.
      
      Fixes #10452
      3741d1aa