Re: Tab-completion problem through ssh when files start by dash (_remote_files:compadd:80: bad option: -@)

[Daniel Shahaf <d.s@xxxxxxxxxxxxxxxxxx>]

Antoine Amarilli wrote on Thu, Apr 13, 2017 at 19:47:17 +0200:
> So it looks to me like the internals of tab-completion are not properly
> escaping the file names in this case, hence the warning. This is mostly
> an annoyance, but maybe there could be some more problematic
> implications (e.g., maybe a malicious jdoe on bar could create files
> that would pass actual options to compadd and mess up more seriously
> with the zsh session on foo).

The «-R remote-func» option seems to be the most obvious method of
injection.  I'm not sure whether it requires a literal function name, or
whether an anonymous function would be accepted too.

> When I do this, the result looks like this:
> 
>   foo% touch blah
>   foo% scp blah jdoe@bar:<TAB>
>   _remote_files:compadd:80: bad option: -@
>   foo% scp test jdoe@bar:
>   [ACTUAL CONTENTS OF ~jdoe ON bar]

I think this fixes it?

diff --git a/Completion/Unix/Type/_remote_files b/Completion/Unix/Type/_remote_files
index 1e9fed1..a5fce9a 100644
--- a/Completion/Unix/Type/_remote_files
+++ b/Completion/Unix/Type/_remote_files
@@ -58,11 +58,13 @@ if zstyle -T ":completion:${curcontext}:files" remote-access; then
     else rempat="${(q)PREFIX%%[^./][^/]#}\*"
   fi
 
+  # remote filenames
   remfiles=(${(M)${(f)"$(_call_program files $cmd $cmd_args $host ls -d1FL -- "$rempat" 2>/dev/null)"}%%[^/]#(|/)})
 
   compset -P '*/'
   compset -S '/*' || (( ${args[(I)-/]} )) || suf='remote file'
 
+  # display strings for remote files and directories
   remdispf=(${remfiles:#*/})
   remdispd=(${(M)remfiles:#*/})
 
@@ -77,9 +79,9 @@ if zstyle -T ":completion:${curcontext}:files" remote-access; then
   while _tags; do
     while _next_label files expl ${suf:-remote directory}; do
       [[ -n $suf ]] &&
-          compadd "$args[@]" "$expl[@]" -d remdispf ${(q)remdispf%[*=|]} && ret=0
+          compadd "$args[@]" "$expl[@]" -d remdispf -- ${(q)remdispf%[*=|]} && ret=0
       compadd ${suf:+-S/} -r "/ \t\n\-" "$args[@]" "$expl[@]" -d remdispd \
-	${(q)remdispd%/} && ret=0
+	-- ${(q)remdispd%/} && ret=0
     done
     (( ret )) || return 0
   done

Thanks for the report!

Daniel