mirror of
git://git.code.sf.net/p/zsh/code
synced 2024-12-29 16:25:35 +01:00
NEWS/README: Add missing change documentation for 5.9
This covers the following changes:
users/24971: ${(-)var} sorts on signed integers
47704: POSIX export and readonly ignore "-p" when parameter names also appear
47913: implement CASE_PATHS option to make NO_CASE_GLOB more sensible
48073: Add fc -s as POSIX way of rerunning command without starting editor
49307 with doc update: POSIX_TRAPS fix.
49528: allow multiple -D options to compadd
49534, 49539: separate watch/log functionality out into a module
49561: add zformat -F option, similar to -f but ternary expressions check for
existence instead of doing math evaluation
49597: add a helper for completing numbers with unit suffixes and separate out
defaults, ranges and units in completion descriptions
49611 based on 49590 (Martijn Dekker): disable Inf and NaN in math expressions
for sh emulation
49646: allow colors in WATCHFMT with %F/%K
49694 + doc: Allow using empty STTY= to freeze tty for a single command
49853 + 49882/49883: make "${arr[*]:off}" compatible with ksh/bash
This commit is contained in:
dana
parent
73265d41e3
commit
13f568fea4
3 changed files with 94 additions and 29 deletions
|
|
@ -1,3 +1,8 @@
|
|||
2022-04-09 dana <dana@dana.is>
|
||||
|
||||
* 49958, (tweaked per 50019): NEWS, README: Add missing
|
||||
changes, update for zsh 5.9
|
||||
|
||||
2022-04-06 Matthew Martin <phy1729@gmail.com>
|
||||
|
||||
* 49960: Doc/Zsh/compsys.yo: Sort lists in zshcompsys.
|
||||
|
|
|
|||
85
NEWS
85
NEWS
|
|
@ -4,25 +4,8 @@ CHANGES FROM PREVIOUS VERSIONS OF ZSH
|
|||
|
||||
Note also the list of incompatibilities in the README file.
|
||||
|
||||
Changes since 5.8
|
||||
-----------------
|
||||
|
||||
CVE-2021-45444: Some prompt expansion sequences, such as %F, support
|
||||
'arguments' which are themselves expanded in case they contain colour
|
||||
values, etc. This additional expansion would trigger PROMPT_SUBST
|
||||
evaluation, if enabled. This could be abused to execute code the user
|
||||
didn't expect. e.g., given a certain prompt configuration, an attacker
|
||||
could trick a user into executing arbitrary code by having them check
|
||||
out a Git branch with a specially crafted name.
|
||||
|
||||
This is fixed in the shell itself by no longer performing PROMPT_SUBST
|
||||
evaluation on these prompt-expansion arguments.
|
||||
|
||||
Users who are concerned about an exploit but unable to update their
|
||||
binaries may apply the partial work-around described in the file
|
||||
Etc/CVE-2021-45444-VCS_Info-workaround.patch included with the shell
|
||||
source. [ Reported by RyotaK <security@ryotak.me>. Additional thanks to
|
||||
Marc Cornellà <hello@mcornella.com>. ]
|
||||
Changes since 5.8.1
|
||||
-------------------
|
||||
|
||||
When unsetting a hash element, the string enclosed in square brackets is
|
||||
interpreted literally after any normal command-line-argument expansions.
|
||||
|
|
@ -54,6 +37,9 @@ fractional seconds.
|
|||
The option CLOBBER_EMPTY was added to enable the overwrite behaviour
|
||||
of CLOBBER for empty files only. It is disabled by default.
|
||||
|
||||
A (-) expansion flag was added. It works like (n) but correctly sorts
|
||||
negative numbers.
|
||||
|
||||
The compinit function learnt a -w option to explain why compdump runs.
|
||||
When run without the -i or -u options and compaudit discovers security
|
||||
issues, answering "y" to the "Ignore insecure ..." prompt removes the
|
||||
|
|
@ -69,11 +55,45 @@ widgets. This corresponds to long-standing behavior of other user ZLE
|
|||
widgets. Use the _complete_debug widget to capture XTRACE output, or
|
||||
use "functions -T" to enable tracing of specific completion functions.
|
||||
|
||||
The fc builtin learnt an -s option which is a POSIX equivalent to the
|
||||
`fc -e-` method of re-executing a command without invoking an editor.
|
||||
|
||||
The option CASE_PATHS was added to control how NO_CASE_GLOB behaves.
|
||||
NO_CASE_GLOB + NO_CASE_PATHS is equivalent to the current NO_CASE_GLOB
|
||||
behaviour. NO_CASE_GLOB + CASE_PATHS treats only path components that
|
||||
contain globbing characters as case-insensitive; this behaviour may
|
||||
yield more predictable results on case-sensitive file systems.
|
||||
NO_CASE_PATHS is the default.
|
||||
|
||||
With the new TYPESET_TO_UNSET option set, "typeset foo" leaves foo unset,
|
||||
in contrast to the default behavior which assigns foo="". Any parameter
|
||||
attributes such as numeric type, sorting, and padding are retained until
|
||||
the parameter is explicitly unset or a conflicting value is assigned.
|
||||
This is similar to default behavior of bash and ksh.
|
||||
This is similar to default behavior of bash and ksh. This option is
|
||||
disabled by default.
|
||||
|
||||
The compadd builtin's -D option can now be specified more than once.
|
||||
|
||||
The zsh/zutil module's zformat builtin learnt an -F option which behaves
|
||||
like -f except that ternary expressions check for existence instead of
|
||||
doing math evaluation.
|
||||
|
||||
The conventional syntax used to indicate units, ranges, and default values
|
||||
in completion descriptions (e.g. `timeout (seconds) (0-60) [20]`) is now
|
||||
recognised by the completion system itself. These components are parsed
|
||||
out of the description and can be individually styled. A _numbers helper
|
||||
function has been added to help function authors offer rich completion
|
||||
for these values.
|
||||
|
||||
The log builtin, WATCH parameter, et al., have been broken out into a
|
||||
separate module, zsh/watch. The module is enabled by default.
|
||||
|
||||
The zsh/watch module's WATCHFMT parameter now supports colours via the
|
||||
%F and %K escapes.
|
||||
|
||||
The STTY parameter can now be set to an empty string before running a
|
||||
command to automatically restore terminal settings after the command
|
||||
finishes.
|
||||
|
||||
The "jobs" command and "$jobstates" and related parameters can report on
|
||||
parent shell jobs even in subshells. This is a snapshot of the parent
|
||||
|
|
@ -81,6 +101,31 @@ state, frozen at the point the subshell started. However, if a subshell
|
|||
starts its own background jobs, the parent state is discarded in order
|
||||
to report on those new jobs.
|
||||
|
||||
Changes from 5.8 to 5.8.1
|
||||
-------------------------
|
||||
|
||||
CVE-2021-45444: Some prompt expansion sequences, such as %F, support
|
||||
'arguments' which are themselves expanded in case they contain colour
|
||||
values, etc. This additional expansion would trigger PROMPT_SUBST
|
||||
evaluation, if enabled. This could be abused to execute code the user
|
||||
didn't expect. e.g., given a certain prompt configuration, an attacker
|
||||
could trick a user into executing arbitrary code by having them check
|
||||
out a Git branch with a specially crafted name.
|
||||
|
||||
This is fixed in the shell itself by no longer performing PROMPT_SUBST
|
||||
evaluation on these prompt-expansion arguments.
|
||||
|
||||
Users who are concerned about an exploit but unable to update their
|
||||
binaries may apply the partial work-around described in the file
|
||||
Etc/CVE-2021-45444-VCS_Info-workaround.patch included with the shell
|
||||
source. [ Reported by RyotaK <security@ryotak.me>. Additional thanks to
|
||||
Marc Cornellà <hello@mcornella.com>. ]
|
||||
|
||||
A regression was introduced in 5.8.1 in which, when reading a script
|
||||
from standard input, zsh itself would consume lines that should otherwise
|
||||
have been consumed by commands executed earlier in the script. This was
|
||||
not intentional and has been fixed in subsequent versions.
|
||||
|
||||
Changes from 5.7.1-test-3 to 5.8
|
||||
--------------------------------
|
||||
|
||||
|
|
|
|||
33
README
33
README
|
|
@ -5,11 +5,12 @@ THE Z SHELL (ZSH)
|
|||
Version
|
||||
-------
|
||||
|
||||
This is version 5.8.1 of the shell. This is a security and bugfix release.
|
||||
This is version 5.9 of the shell. This is a security and feature release.
|
||||
There are several visible improvements since 5.8.1, as well as bug fixes.
|
||||
All zsh installations are encouraged to upgrade as soon as possible.
|
||||
|
||||
Note in particular the changes highlighted under "Incompatibilities since
|
||||
5.8" below. See NEWS for more information.
|
||||
5.8.1" below. See NEWS for more information.
|
||||
|
||||
Installing Zsh
|
||||
--------------
|
||||
|
|
@ -30,16 +31,13 @@ Zsh is a shell with lots of features. For a list of some of these, see the
|
|||
file FEATURES, and for the latest changes see NEWS. For more
|
||||
details, see the documentation.
|
||||
|
||||
Incompatibilities since 5.8
|
||||
---------------------------
|
||||
Incompatibilities since 5.8.1
|
||||
-----------------------------
|
||||
|
||||
compinit: A "y" response to the "Ignore ... and continue?" prompt removes
|
||||
insecure elements from the set of completion functions, where previously
|
||||
it ignored the compaudit result and included all elements.
|
||||
|
||||
PROMPT_SUBST expansion is no longer performed on arguments to prompt-
|
||||
expansion sequences such as %F.
|
||||
|
||||
Build-time change: The default value of the --enable-gdbm configure
|
||||
argument has changed from "yes" to "no". Thus, the zsh/db/gdbm module will
|
||||
not be built unless --enable-gdbm is passed explicitly.
|
||||
|
|
@ -105,11 +103,25 @@ emulate sh: When zsh emulates sh, the final command in a pipeline is now run in
|
|||
a subshell. This differs from the behavior in the native (zsh) mode, but is
|
||||
consistent with most other sh implementations.
|
||||
|
||||
The export and readonly builtins now ignore the -p option when there are
|
||||
operands given and POSIX_BUILTINS is enabled. This more closely matches the
|
||||
behaviour of bash and ksh.
|
||||
|
||||
getopts now calculates OPTIND in a similar manner to other shells when the
|
||||
POSIX_BUILTINS option is enabled.
|
||||
|
||||
Incompatibilities between 5.7.1 and 5.8
|
||||
---------------------------------------
|
||||
Ignored-signal traps are now inherited by subshells when the POSIX_TRAPS
|
||||
option is enabled.
|
||||
|
||||
emulate sh: Inf and NaN are now treated as parameter names in arithmetic
|
||||
context when zsh is emulating sh.
|
||||
|
||||
The ${name:offset:length} expansion syntax now behaves more similarly to
|
||||
other shells in that the offset and length are applied as array indices
|
||||
prior to scalar conversion in e.g. "${*:0:2}".
|
||||
|
||||
Incompatibilities between 5.7.1 and 5.8.1
|
||||
-----------------------------------------
|
||||
|
||||
The history expansion !:1:t2 used to be interpreted such that the 2
|
||||
was a separate character added after the history expansion. Now
|
||||
|
|
@ -140,6 +152,9 @@ changes made in the course of fixing CVE-2019-20044. Please report this
|
|||
to the zsh-workers mailing list if your system is affected. See NEWS for
|
||||
more.
|
||||
|
||||
PROMPT_SUBST expansion is no longer performed on arguments to prompt-
|
||||
expansion sequences such as %F.
|
||||
|
||||
Incompatibilities between 5.6.2 and 5.7.1
|
||||
-----------------------------------------
|
||||
|
||||
|
|
|
|||
Loading…
Reference in a new issue