Zsh completion scripts do not properly escape help text

[corneliusweig]

Cobra gained a much more powerful zsh completion script generator with #646, showing help text for flags and sub-commands.

This help text is not properly escaped, for example when it contains brackets (#899). Also, and more importantly, it does not escape command substitution constructs such as $(cmd). This causes the command in the help text to be executed whenever the completion script is invoked.

Here is a minimal example to demonstrate the problem:

package main

import (
   "fmt"
   "os"

   "github.com/spf13/cobra"
)

var rootCmd = &cobra.Command{
   Use:   "zshexp",
   Short: "Source the script, then invoke completion",
   Run: func(cmd *cobra.Command, args []string) {
      _ = cmd.GenZshCompletion(os.Stdout)
      fmt.Println("compdef _zshexp zshexp") // to make it usable via `source <(./zshexp)`
   },
}

func main() {
   if err := rootCmd.Execute(); err != nil {
      fmt.Println(err)
      os.Exit(1)
   }
}

func init() {
   rootCmd.Flags().BoolP("what", "w", false, "'$(docker-machine)'")
   subCmd := &cobra.Command{
      Use:   "bla",
      Short: "$(cat ~/.bashrc)", // <<<<<<< this command gets executed when invoking the completion
   }
   rootCmd.AddCommand(subCmd)
}

To reproduce the error, do

• go build -o whatever
• source <(./whatever)
• $ ./whatever <tab><tab>, this will execute the command marked above.

[corneliusweig]

fix suggested in #899 (comment)

[github-actions]

This issue is being marked as stale due to a long period of inactivity

[johnSchnake]

#899 (comment) says the issue has been resolved. Closing.