fix: apply workaround patch for vcs_info (CVE-2021-45444)
This lib function applies a patch to the VCS_INFO_formats function
in zsh versions from v5.0.3 until v5.8, which don't quote % chars
in some arguments received. Normally that just means that some
% characters in these strings (branch names, directories, etc.)
will be incorrectly parsed as formatting sequences.
With CVE-2021-45444, however, this means that one of these strings
from a malicious source (e.g. a malicious git repository) can
trigger command injection and run arbitrary code in the user's
machine when visiting such git repository.
Zsh 5.8.1 fixes this vulnerability [1], but older vcs_info setups
still need a workaround such as this one to patch the vulnerability.
[1] https://github.com/zsh-users/zsh/commit/c3ea1e5d52eff8b7b172fa8c1ccc3462b43b2790
Diff
1diff --git a/lib/vcs_info.zsh b/lib/vcs_info.zsh
2new file mode 100644
3index 0000000000000000000000000000000000000000..01dcd90b601dd940296087ac61bd56ec1ceb50ef
4--- /dev/null
5+++ b/lib/vcs_info.zsh
6@@ -0,0 +1,50 @@
7+# Impacted versions go from v5.0.3 to v5.8 (v5.8.1 is the first patched version)
8+autoload -Uz is-at-least
9+if is-at-least 5.8.1 || ! is-at-least 5.0.3; then
10+ return
11+fi
12+
13+# Quote necessary $hook_com[<field>] items just before they are used
14+# in the line "VCS_INFO_hook 'post-backend'" of the VCS_INFO_formats
15+# function, where <field> is:
16+#
17+# base: the full path of the repository's root directory.
18+# base-name: the name of the repository's root directory.
19+# branch: the name of the currently checked out branch.
20+# misc: a string that may contain anything the vcs_info backend wants.
21+# revision: an identifier of the currently checked out revision.
22+# subdir: the path of the current directory relative to the
23+# repository's root directory.
24+#
25+# This patch %-quotes these fields previous to their use in vcs_info hooks and
26+# the zformat call and, eventually, when they get expanded in the prompt.
27+# It's important to quote these here, and not later after hooks have modified the
28+# fields, because then we could be quoting % characters from valid prompt sequences,
29+# like %F{color}, %B, etc.
30+#
31+# 32 │ hook_com[subdir]="$(VCS_INFO_reposub ${hook_com[base]})"
32+# 33 │ hook_com[subdir_orig]="${hook_com[subdir]}"
33+# 34 │
34+# 35 + │ for tmp in base base-name branch misc revision subdir; do
35+# 36 + │ hook_com[$tmp]="${hook_com[$tmp]//\%/%%}"
36+# 37 + │ done
37+# 38 + │
38+# 39 │ VCS_INFO_hook 'post-backend'
39+#
40+# This is especially important so that no command substitution is performed
41+# due to malicious input as a consequence of CVE-2021-45444, which affects
42+# zsh versions from 5.0.3 to 5.8.
43+#
44+autoload -Uz +X regexp-replace VCS_INFO_formats
45+
46+# We use $tmp here because it's already a local variable in VCS_INFO_formats
47+typeset PATCH='for tmp (base base-name branch misc revision subdir) hook_com[$tmp]="${hook_com[$tmp]//\%/%%}"'
48+# Unique string to avoid reapplying the patch if this code gets called twice
49+typeset PATCH_ID=vcs_info-patch-9b9840f2-91e5-4471-af84-9e9a0dc68c1b
50+# Only patch the VCS_INFO_formats function if not already patched
51+if [[ "$functions[VCS_INFO_formats]" != *$PATCH_ID* ]]; then
52+ regexp-replace 'functions[VCS_INFO_formats]' \
53+ "VCS_INFO_hook 'post-backend'" \
54+ ': ${PATCH_ID}; ${PATCH}; ${MATCH}'
55+fi
56+unset PATCH PATCH_ID