Browse Source

fix(toolbox): avoid prompt injection

Carlo Sala 8 months ago
parent
commit
3b5f018f70
1 changed files with 3 additions and 1 deletions
  1. 3 1
      plugins/toolbox/toolbox.plugin.zsh

+ 3 - 1
plugins/toolbox/toolbox.plugin.zsh

@@ -3,7 +3,9 @@ function toolbox_prompt_info() {
 }
 
 function toolbox_prompt_name() {
-  [[ -f /run/.containerenv ]] && cat /run/.containerenv | awk -F\" '/name/ { print$2 }'
+  [[ -f /run/.containerenv ]] || return
+  local _to_print="$(cat /run/.containerenv | awk -F\" '/name/ { print$2 }')"
+  echo ${_to_print:gs/%/%%}
 }
 
 alias tbe="toolbox enter"