Hello everyone, I would like to report what I think may be a bug in zsh. (I am not subscribed directly, so please include me in any replies.) The bug concerns tab-completion through ssh in directories containing a file that starts with a dash. The bug occurs when running zsh -f (using a fresh user on a Debian testing amd64 machine, if that matters -- I call the machine "foo"). To reproduce: 1. Enable autocomplete on machine foo by issuing: foo% autoload -Uz compinit foo% compinit 2. On a remote machine bar that can be reached by ssh with public-key authentication from foo, in the home directory of user jdoe, create a file whose name starts with a dash and occurs early in the alphabet, for instance "-@": bar% cd ~jdoe bar% touch -- -@ 3. Try to scp a file "blah" from foo to bar and use tab-completion (indicated as <TAB>): foo% touch blah foo% scp blah jdoe@bar:<TAB> When I do this, the result looks like this: foo% touch blah foo% scp blah jdoe@bar:<TAB> _remote_files:compadd:80: bad option: -@ foo% scp test jdoe@bar: [ACTUAL CONTENTS OF ~jdoe ON bar] So it looks to me like the internals of tab-completion are not properly escaping the file names in this case, hence the warning. This is mostly an annoyance, but maybe there could be some more problematic implications (e.g., maybe a malicious jdoe on bar could create files that would pass actual options to compadd and mess up more seriously with the zsh session on foo). I hope that this report is useful! :) Best regards, -- Antoine Amarilli
Attachment:
signature.asc
Description: PGP signature