* fix(dotenv): expect explicit yes before loading .env file
* fix(dotenv): implement secure parsing for .env files and add comprehensive tests
* feat(dotenv): check for .env file size to prevent DoS
* fix(dotenv): forbid setting special variables
* fix(dotenv): FIFO shouldn't be read twice
* fix(dotenv): unknown vars should expand to empty
* fix(dotenv): reject extremely large named pipes
* docs(dotenv): update to new parsing system
* fix(dotenv): add support for escaped dollars
* chore(dotenv): only declare local variables once
* fix(dotenv): apply review suggestions
* docs(dotenv): update test instructions
Co-authored-by: Carlo Sala <carlosalag@protonmail.com>
This patch adds missing % character escaping for custom git prompts
used in a few themes. It also includes escaping for git-prompt.sh.
In combination with CVE-2021-45444, this could allow code execution
when displaying branch information in cloned malicious git repositories.
However, zsh 5.8.1 and newer are largely the default zsh versions, and
on those supported distributions with older zsh versions, the CVE has been
found to be also patched.
For this reason, this doesn't qualify as a security patch, but a
bug fix for proper printing of git branches.
BREAKING CHANGE: `rbfu`, the tool to manage Ruby versions, has long
been deprecated (2013-02-05). The plugin has been removed. If you
were still using it, consider using alternative Ruby version
managers: https://www.jetbrains.com/help/ruby/ruby-version-managers.html
BREAKING CHANGE: the fig plugin has been removed. `fig` was sunset
on September 1, 2024. Having this plugin no longer makes sense.
See https://fig.io/ for more information.
There is no inherent security vulnerability in the workflow, but there were
certain practices that increased latent risk. In this commit, we:
- Explicitly bind app token for each step that needs it, instead of setting it for
all steps after "Store app token"
- Refactor "classify" step, to not rely on files passed around, and instead uses
only awk script.
- Remove all instances of template injection within `run` scripts. There was nothing
dangerous, but the practice is unsafe.
- Sanitize all unwanted characters from PR plugin and theme names.
References: W2M1-06 W2M1-07
This avoids false positive detections on other bruteforced paths,
such as .zsh_history or others, which eventually result in
automated false vulnerability submissions.
BREAKING CHANGE: the `ipython` alias was incorrectly trying to manually call
ipython from the installed module in the virtual environment, when actually
a command already exists when loading the virtual environment. This change
removes the unnecessary alias and allows calling the right command.
Fixes#12676
- Rename `git push --force-with-lease ...` to `gpff`
- Add a y/n confirmation prompt to `gpf` before running `git push --force-with-lease ...`
BREAKING CHANGE: this change adds a confirmation prompt to the `gpf` alias before
running the potentially destructive `git push --force-with-lease` command. If you
want to force-run the command without having to confirm it, run `gpff`.
BREAKING CHANGE: the `vault` plugin added completion for the `vault` CLI. Since a while
back there is already official completion. This change removes the deprecated plugin.
BREAKING CHANGE: the `kubectx` plugin now properly displays contexts from the
kubectx_mapping array, without using double quotes. Please refer to the plugin
README to see how to use it properly.
Closes#12534
Co-authored-by: Ken Kelly <ken@kenhkelly.us>
BREAKING CHANGE: the `ripgrep` plugin has been removed, as it only shipped its
completion, which is now already included in all the usual package managers.
BREAKING CHANGE: the `ag` "The Silver Searcher" plugin has been removed, as it
only shipped its completion, which is now already included in all the usual
package managers.
BREAKING CHANGE: the `adb` plugin has been removed in favor of the completion
provided out-of-the-box by zsh since 4.3.14.
This commit removes plugin `adb`, which bundles custom completion for the
`adb` tool for Android. `adb` completion is already supported out of the
box in zsh 4.3.14 and older.
Reference: https://github.com/zsh-users/zsh/commit/d1a557d008b7fa7881327acbd6decdb50631cc9c
Double quotes within the subscript test are interpreted literally, making the
test never match. On subsequent runs, the `$ZSH_CACHE_DIR/completions` directory
is always prepended to `$fpath`, even if it is already there. This commit fixes
that.
Fixes#12551
Co-authored-by: Adem Simsek <adem@simsek.dev>
We removed this mitigation in 0c80a063 because of an assumption
that the issue had been fixed, but it looks like zsh < 5.0.6 has
other issues (see #12360), so we need to disable it for real.
Fixes#12360
BREAKING CHANGE: the new async prompt feature will render prompt information
asyncronously and degrade nicely when the calls take too long to finish, as
the prompt will already be first drawn and interactive. This is
enabled by default for the git prompt and themes that use it (`git_prompt_info`).
If you find that it's not working for you, please open an issue if one is
not already opened, and see https://github.com/ohmyzsh/ohmyzsh#disable-async-git-prompt
for how to turn it off.
This fix conditionally registers the git prompt async handler only
if `git_prompt_info` is used anywhere in the prompt variables.
This is done in the proper order, so that the async request is
processed once the handler has been registered.
This fix also passes the return value of the previous command
to each of the async handlers, in case they are needed.
BREAKING CHANGE: the `git_prompt_info` prompt function has been
reworked by default to use the new async prompt feature. If you're
experiencing issues see #12257.
Co-authored-by: Carlo Sala <carlosalag@protonmail.com>
