OmarchybotandClaude Opus 5
e713ff3166
Backport of the shared URL check (PR #8174, merged to quattro as 68ab12f7) onto
the v4-0-1 release branch, on top of the #8067 backport it follows.
omarchy-theme-install and omarchy-plugin-add both clone a URL a stranger can
choose, and each carried its own copy of the rule that refuses a git option or a
transport helper before cloning. The rule now lives in omarchy-git-url-check and
both callers ask it: two copies of a security check drift, and the second copy
arrived four months after the first only because someone went looking for it.
That rule was also enforcing half of what it described. <helper>::<address> is
one of two shapes git resolves a remote helper from -- it also runs
git-remote-<scheme> for <scheme>://<address> whenever the scheme is not one it
connects itself, so ext::sh -c id and ext://sh -c id reach the same helper while
only the first was refused. Nothing exploitable follows on a stock system:
protocol.ext.allow defaults to never, and the :// spelling hands git-remote-ext
a command name it cannot exec. But a third-party helper installed on PATH is
reachable through the scheme form alone, and a guard is worth more when it
enforces the rule it states.
The :// shape cannot be refused the way :: is, because it is also how every
legitimate URL arrives, so the scheme is checked against the transports git
still connects itself: ssh git git+ssh ssh+git http https ftp ftps file.
git+ssh and ssh+git are on that list because they are spelled like a helper and
read as plain ssh; leaving them off would refuse a URL that clones today. ext
and fd are off it deliberately. A single colon is always scp-style ssh and a
bare path is always a path, so neither needs constraining.
The check fails closed: the callers read a non-zero status as a refusal, so a
missing omarchy-git-url-check refuses the URL rather than waving it through.
Clean cherry-pick on top of the #8067 backport: every file is byte-identical to
quattro, so merging v4-0-1 into quattro resolves without a conflict. test/shell
passes: 189 files, including the one this adds. test/cli passes, so the new
command's metadata is well-formed. Exercised the check here: https, scp-style,
ssh, git+ssh and scp-style IPv6 all pass, while ext:: ext:// fd:: fd:// and a
leading-dash form are refused, as is an uppercase EXT:// spelling.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_018DEMYa9UWtroz93DhMTtcV
54 lines
1.9 KiB
Bash
Executable File
54 lines
1.9 KiB
Bash
Executable File
#!/bin/bash
|
|
|
|
# omarchy:summary=Install a theme from a git repository
|
|
# omarchy:args=[git-repo-url]
|
|
# omarchy:examples=omarchy theme install https://github.com/example/omarchy-example-theme.git
|
|
# omarchy:examples=omarchy theme install git@github.com:example/omarchy-example-theme.git
|
|
|
|
if [[ -z $1 ]]; then
|
|
echo -e "\e[32mSee https://omarchy.org/themes/\n\e[0m"
|
|
REPO_URL=$(gum input --placeholder="Git repo URL (https or git@host:org/repo.git)" --header="")
|
|
else
|
|
REPO_URL="$1"
|
|
fi
|
|
|
|
if [[ -z $REPO_URL ]]; then
|
|
exit 1
|
|
fi
|
|
|
|
# Refuse a URL that names a git option or a transport helper before cloning. The
|
|
# check is shared with omarchy-plugin-add and explains itself; a missing checker
|
|
# leaves this non-zero, which refuses the URL rather than cloning it.
|
|
omarchy-git-url-check "$REPO_URL" || exit 1
|
|
|
|
THEMES_DIR="$HOME/.config/omarchy/themes"
|
|
|
|
# Strip user@host: prefix from scp-style SSH URLs so basename sees just the path
|
|
REPO_PATH="$REPO_URL"
|
|
[[ $REPO_PATH != *"://"* && $REPO_PATH == *:*/* ]] && REPO_PATH="${REPO_PATH#*:}"
|
|
THEME_NAME=$(basename -- "$REPO_PATH" .git | sed -E 's/^omarchy-//; s/-theme$//' | tr '[:upper:]' '[:lower:]')
|
|
THEME_PATH="$THEMES_DIR/$THEME_NAME"
|
|
|
|
# The name comes from the URL and is joined into a path that is about to be
|
|
# removed, so a repo called `..` would take ~/.config/omarchy with it. A leading
|
|
# dot is refused with it: `host:-s/foo.git` leaves basename with `.git`.
|
|
if [[ -z $THEME_NAME || $THEME_NAME == .* || $THEME_NAME == */* ]]; then
|
|
echo "Error: '$REPO_URL' does not give a usable theme name."
|
|
exit 1
|
|
fi
|
|
|
|
# Remove existing theme if present
|
|
if [[ -d $THEME_PATH ]]; then
|
|
rm -rf "$THEME_PATH"
|
|
fi
|
|
|
|
# Clone the repo directly to ~/.config/omarchy/themes
|
|
if ! git clone -- "$REPO_URL" "$THEME_PATH"; then
|
|
echo "Error: Failed to clone theme repo."
|
|
exit 1
|
|
fi
|
|
|
|
# Apply the new theme with omarchy-theme-set, which stages only the files an
|
|
# extra theme is allowed to contribute and names anything it dropped.
|
|
omarchy-theme-set "$THEME_NAME"
|