From c3374ffd08194a6bd3ba5594b63bedd092577428 Mon Sep 17 00:00:00 2001
From: Johannes Altmanninger <aclopte@gmail.com>
Date: Tue, 3 Dec 2019 12:18:39 +0100
Subject: [PATCH] Use read --tokenize instead of eval for $BROWSER & $EDITOR

---
 share/functions/edit_command_buffer.fish | 19 ++++++++++---------
 share/functions/funced.fish              |  2 +-
 share/functions/help.fish                | 13 +++++--------
 3 files changed, 16 insertions(+), 18 deletions(-)

diff --git a/share/functions/edit_command_buffer.fish b/share/functions/edit_command_buffer.fish
index 6ea2b0d2c..7440741c3 100644
--- a/share/functions/edit_command_buffer.fish
+++ b/share/functions/edit_command_buffer.fish
@@ -15,26 +15,27 @@ function edit_command_buffer --description 'Edit the command buffer in an extern
     end
 
     # Edit the command line with the users preferred editor or vim or emacs.
-    commandline -b >$f
+    set -l editor
     if set -q VISUAL
-        __fish_disable_bracketed_paste
-        eval $VISUAL $f
-        __fish_enable_bracketed_paste
+        echo $VISUAL | read -at editor
     else if set -q EDITOR
-        __fish_disable_bracketed_paste
-        eval $EDITOR $f
-        __fish_enable_bracketed_paste
+        echo $EDITOR | read -at editor
     else
         echo
         echo (_ 'External editor requested but $VISUAL or $EDITOR not set.')
         echo (_ 'Please set VISUAL or EDITOR to your preferred editor.')
         commandline -f repaint
-        command rm $f
         return 1
     end
 
+    commandline -b >$f
+    __fish_disable_bracketed_paste
+    $editor $f
+    set -l editor_status $status
+    __fish_enable_bracketed_paste
+
     # Here we're checking the exit status of the editor.
-    if test $status -eq 0 -a -s $f
+    if test $editor_status -eq 0 -a -s $f
         # Set the command to the output of the edited command and move the cursor to the
         # end of the edited command.
         commandline -r -- (cat $f)
diff --git a/share/functions/funced.fish b/share/functions/funced.fish
index 7ad717e0a..5d8afb956 100644
--- a/share/functions/funced.fish
+++ b/share/functions/funced.fish
@@ -52,7 +52,7 @@ function funced --description 'Edit function definition'
 
     # Break editor up to get its first command (i.e. discard flags)
     set -l editor_cmd
-    eval set editor_cmd $editor
+    echo $editor | read -ta editor_cmd
     if not type -q -f "$editor_cmd[1]"
         echo (_ "funced: The value for \$EDITOR '$editor' could not be used because the command '$editor_cmd[1]' could not be found")
         set editor fish
diff --git a/share/functions/help.fish b/share/functions/help.fish
index 207293846..2e34bb4d5 100644
--- a/share/functions/help.fish
+++ b/share/functions/help.fish
@@ -30,7 +30,7 @@ function help --description 'Show help for the fish shell'
     if not set -q fish_browser[1]
         if set -q BROWSER
             # User has manually set a preferred browser, so we respect that
-            set fish_browser $BROWSER
+            echo $BROWSER | read -at fish_browser
         else
             # No browser set up, inferring.
             # We check a bunch and use the last we find.
@@ -101,7 +101,7 @@ function help --description 'Show help for the fish shell'
         and not command -sq $fish_browser[1]
             # Escaped quotes are necessary to work with spaces in the path
             # when the command is finally eval'd.
-            set fish_browser cygstart \"$fish_browser\"
+            set fish_browser cygstart $fish_browser
         else
             set need_trampoline 1
         end
@@ -182,12 +182,9 @@ function help --description 'Show help for the fish shell'
         end
     end
 
-    # URL may contain # (anchor) or $ (hidden share in Windows)
-    set page_url (string escape $page_url)
-
     # cmd.exe needs more coaxing.
     if string match -qr 'cmd.exe$' -- $fish_browser[1]
-        eval $fish_browser /c "start $page_url"
+        $fish_browser /c "start $page_url"
         # If browser is known to be graphical, put into background
     else if contains -- $fish_browser[1] $graphical_browsers
         switch $fish_browser[1]
@@ -196,13 +193,13 @@ function help --description 'Show help for the fish shell'
             case '*'
                 printf (_ 'help: Help is being displayed in %s.\n') $fish_browser[1]
         end
-        eval "$fish_browser $page_url &"
+        $fish_browser $page_url &; disown
     else
         # Work around lynx bug where <div class="contents"> always has the same formatting as links (unreadable)
         # by using a custom style sheet. See https://github.com/fish-shell/fish-shell/issues/4170
         if string match -q 'lynx*' -- $fish_browser
             set fish_browser $fish_browser -lss={$__fish_data_dir}/lynx.lss
         end
-        eval $fish_browser $page_url
+        $fish_browser $page_url
     end
 end