From 4e07448e7a646efcd3ee9417f9cd330e08fabb8a Mon Sep 17 00:00:00 2001
From: Johannes Altmanninger <aclopte@gmail.com>
Date: Sat, 6 Jan 2024 07:43:23 +0100
Subject: [PATCH] fish completions: fix double-evaluation of commandline
We capture the commandline tokens using fish's "commandline --tokenize" (-o).
Given a commandline of
some-cobra-command 'some argument $(123)' "$HOME"
into three arguments while removing the quotes
some-cobra-command
some argument $(123)
$HOME
Later we pass "some argument $(123)" without quotes to the shell's
"eval". This is wrong and causes spurious evaluation of the parenthesis
as command substitution.
Fix this by escaping the arguments.
The upcoming fish 3.8 has a new flag, "commandline -x"
which will expand variables like $HOME properly, see
https://github.com/fish-shell/fish-shell/pull/10212 Use that if
available.
Reproduce the issue by pasting the completion script at
https://github.com/fish-shell/fish-shell/issues/10194#issuecomment-1879563545
to a file "grafana-manager.fish" and running
function grafana-manager; end
source grafana-manager.fish
Then type (without pressing Enter)
grafana-manager public-dashboards delete --organization-id 3 --dashboard-name "k8s (public)" <TAB>
Fixes https://github.com/fish-shell/fish-shell/issues/10194
---
fish_completions.go | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)
diff --git a/fish_completions.go b/fish_completions.go
index 12d61b69..859a7555 100644
--- a/fish_completions.go
+++ b/fish_completions.go
@@ -45,7 +45,9 @@ function __%[1]s_perform_completion
__%[1]s_debug "Starting __%[1]s_perform_completion"
# Extract all args except the last one
- set -l args (commandline -opc)
+ set -l args (
+ commandline -xpc 2>/dev/null ||
+ commandline -opc | string escape)
# Extract the last arg and escape it in case it is a space
set -l lastArg (string escape -- (commandline -ct))