fix(toolbox): avoid prompt injection

2 years ago · 3b5f018f70
parent 2cb403e89f
commit 3b5f018f70
1 changed files with 3 additions and 1 deletions
--- a/plugins/toolbox/toolbox.plugin.zsh
+++ b/plugins/toolbox/toolbox.plugin.zsh
@ -3,7 +3,9 @@ function toolbox_prompt_info() {
 }

 function toolbox_prompt_name() {
-  [[ -f /run/.containerenv ]] && cat /run/.containerenv | awk -F\" '/name/ { print$2 }'
+  [[ -f /run/.containerenv ]] || return
+  local _to_print="$(cat /run/.containerenv | awk -F\" '/name/ { print$2 }')"
+  echo ${_to_print:gs/%/%%}
 }

 alias tbe="toolbox enter"