Zsh Mailing List Archive
Messages sorted by: Reverse Date, Date, Thread, Author

Re: The zsh equivalent to Bash's "complete -W" to complete a command using only a list of words



Shlomi Fish wrote on Sat, Apr 09, 2016 at 16:40:52 +0300:
>     compdef "_values $description $val1 $val2 $val3 $val4..." Theme
> 
> Where $description is a short description and $val1 $val2 are the values.

That's vulnerable to shell injection.

You need either to change "" to '' or to change «$foo» to «${(q)foo}»,
depending on whether you intend the variables to be interpolated at the
time you run compdef or at the time you invoke the completion.

Cheers,

Daniel
(I realize you might have intended those variables as metasyntax...)



Messages sorted by: Reverse Date, Date, Thread, Author