Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

fix(cli): Don’t use backticks to unbreak zsh compdef #108

Merged
merged 1 commit into from
Oct 28, 2020
Merged

fix(cli): Don’t use backticks to unbreak zsh compdef #108

merged 1 commit into from
Oct 28, 2020

Conversation

d125q
Copy link
Contributor

@d125q d125q commented Oct 28, 2020

Currently, the generated zsh compdef contains something along the
lines of

(( $+functions[_fontship_commands] )) ||
_fontship_commands() {
    local commands; commands=(
        "make:Build specified target(s) with `make`" \
"setup:Configure a font project repository" \
"status:Show status information about setup, configuration, and build state" \
"help:Prints this message or the help of the given subcommand(s)" \
    )
    _describe -t commands 'fontship commands' commands "$@"
}

I.e., it performs command substitution on ‘make’, which in the best
case fails with something along the lines of “make: *** No targets
specified and no makefile found. Stop.” and in the worst case ends up
running ‘make’ for you.

This issue should probably be brought up to clap-rs/clap so that it is
made to use single quotes instead of double quotes and escape
everything correctly.

For now, this commit fixes the issue by using “smart quotes” instead
of backticks.

Currently, the generated zsh compdef contains something along the
lines of

```zsh
(( $+functions[_fontship_commands] )) ||
_fontship_commands() {
    local commands; commands=(
        "make:Build specified target(s) with `make`" \
"setup:Configure a font project repository" \
"status:Show status information about setup, configuration, and build state" \
"help:Prints this message or the help of the given subcommand(s)" \
    )
    _describe -t commands 'fontship commands' commands "$@"
}
```

I.e., it performs command substitution on ‘make’, which in the best
case fails with something along the lines of “make: *** No targets
specified and no makefile found.  Stop.” and in the worst case ends up
running ‘make’ for you.

This issue should probably be brought up to clap-rs/clap so that it is
made to use single quotes instead of double quotes and escape
everything correctly.

For now, this commit fixes the issue by using “smart quotes” instead
of backticks.
@alerque
Copy link
Member

alerque commented Oct 28, 2020

Wow good catch. Yes this is something that should be reported is reported upstream in Clap, it shouldn't be generating dangerous executable code!

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
bug Something isn't working
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants