Mirrors/fish-shell
2
0
Fork 0
mirror of https://github.com/fish-shell/fish-shell synced 2024-12-29 06:13:20 +00:00
Code Issues Projects Releases Packages Wiki Activity

tab completions: avoid completing gpg --use-embedded-filename

Browse source 
gpg's --use-embedded-filename is a dangerous option that can cause gpg
to write arbitrary content to arbitrary files.

According to the GnuPG maintainer, this is not an option recommended
for use (https://dev.gnupg.org/T4500).  Fish shouldn't encourage users
to supply it.

I've offered https://dev.gnupg.org/T6972 to upstream to make it even
more clear that this option is a bad idea.

While removing it, we might as well also remove
--no-use-embedded-filename, since it is effectively a no-op.

(cherry picked from commit b265152fba)
This commit is contained in:
Daniel Kahn Gillmor 2024-02-02 15:51:05 -05:00 committed by David Adam
parent d655f40d43
commit d24b1ef229
1 changed files with 0 additions and 3 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

3
share/functions/__fish_complete_gpg.fish
View file

@ -264,9 +264,6 @@ function __fish_complete_gpg -d "Internal function for gpg completion code dedup
complete -c $__fish_complete_gpg_command -l for-your-eyes-only -d "Set the 'for your eyes only' flag in the message"
complete -c $__fish_complete_gpg_command -l no-for-your-eyes-only -d "Clear the 'for your eyes only' flag in the message"
complete -c $__fish_complete_gpg_command -l use-embedded-filename -d "Create file with name as given in data"
complete -c $__fish_complete_gpg_command -l no-use-embedded-filename -d "Don't create file with name as given in data"
complete -c $__fish_complete_gpg_command -l completes-needed -x -d "Number of completely trusted users to introduce a new key signer (defaults to 1)"
complete -c $__fish_complete_gpg_command -l marginals-needed -x -d "Number of marginally trusted users to introduce a new key signer (defaults to 3)"