github-mirror/fish-shell
github-mirror/fish-shell
2
0
Fork 0
mirror of https://github.com/fish-shell/fish-shell.git synced 2025-03-15 23:22:53 +08:00
Code Issues Actions 4 Packages Projects Releases Wiki Activity

tab completions: avoid completing gpg --use-embedded-filename

Browse Source 
gpg's --use-embedded-filename is a dangerous option that can cause gpg
to write arbitrary content to arbitrary files.

According to the GnuPG maintainer, this is not an option recommended
for use (https://dev.gnupg.org/T4500).  Fish shouldn't encourage users
to supply it.

I've offered https://dev.gnupg.org/T6972 to upstream to make it even
more clear that this option is a bad idea.

While removing it, we might as well also remove
--no-use-embedded-filename, since it is effectively a no-op.
This commit is contained in:
Daniel Kahn Gillmor 2024-02-02 15:51:05 -05:00 committed by Fabian Boehm
parent 7c0cc2d2ab
commit b265152fba
1 changed files with 0 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

3
share/functions/__fish_complete_gpg.fish
View File

@ -264,9 +264,6 @@ function __fish_complete_gpg -d "Internal function for gpg completion code dedup
complete -c $__fish_complete_gpg_command -l for-your-eyes-only -d "Set the 'for your eyes only' flag in the message"
complete -c $__fish_complete_gpg_command -l no-for-your-eyes-only -d "Clear the 'for your eyes only' flag in the message"
complete -c $__fish_complete_gpg_command -l use-embedded-filename -d "Create file with name as given in data"
complete -c $__fish_complete_gpg_command -l no-use-embedded-filename -d "Don't create file with name as given in data"
complete -c $__fish_complete_gpg_command -l completes-needed -x -d "Number of completely trusted users to introduce a new key signer (defaults to 1)"
complete -c $__fish_complete_gpg_command -l marginals-needed -x -d "Number of marginally trusted users to introduce a new key signer (defaults to 3)"