fix(installer): prevent command injection via $USER in install.sh (#13960 )

HOME="${HOME:-$(eval echo ~"$USER")}" expands any shell metacharacters in $USER when HOME is unset (CWE-78), e.g. USER='x"; <command>; "'. Validate the username against a safe character set before running the eval and fall back to $PWD for unsafe values. Also quote $USER in the getent call to avoid word splitting. Co-authored-by: Carlo Sala <carlosalag@protonmail.com>
fix(core): add Ghostty OSC 8 support (#13961 )
2026-08-21 07:32:58 +08:00 · 2026-08-20 10:43:07 +02:00 · 2026-08-20 10:18:07 +02:00
8 changed files with 50 additions and 280 deletions
--- a/CONTRIBUTING.md
+++ b/CONTRIBUTING.md
@@ -23,7 +23,6 @@ you would make is not already covered.
 - [A note on AI-assisted contributions](#a-note-on-ai-assisted-contributions)
 - [Use the Search, Luke](#use-the-search-luke)
 - [Commit Guidelines](#commit-guidelines)
-  - [Plugin And Theme Bootstrap Compatibility](#plugin-and-theme-bootstrap-compatibility)
  - [Format](#format)
  - [Style](#style)
 - [Volunteer](#volunteer)
@@ -177,24 +176,6 @@ specification. The automatic changelog tool uses these to automatically generate
 a changelog based on the commit messages. Here's a guide to writing a commit message
 to allow this:

-### Plugin And Theme Bootstrap Compatibility
-
-Oh My Zsh now provides a shared bootstrap entrypoint at `lib/bootstrap.zsh` for plugin-manager setups that don't
-source `oh-my-zsh.sh`.
-
-When working on plugins/themes:
-
- assume bootstrap has already run in manager-driven setups
- rely on bootstrap guarantees (`ZSH*` defaults, cache/completions setup, required `fpath` entries)
- avoid adding per-plugin/per-theme copies of common setup unless truly plugin-specific
-
-Common patterns we should migrate away from over time:
-
- repeated cache setup logic (`mkdir -p "$ZSH_CACHE_DIR/completions"`)
- repeated base `fpath` bootstrapping for OMZ core/custom directories
-
-If your plugin/theme still needs custom initialization, keep it scoped to that plugin/theme behavior only.
-
 ### Format

 ```
--- a/README.md
+++ b/README.md
@@ -46,7 +46,6 @@ Twitter), and join us on [Discord](https://discord.gg/ohmyzsh).
    - [Manual Installation](#manual-installation)
  - [Installation Problems](#installation-problems)
  - [Custom Plugins And Themes](#custom-plugins-and-themes)
-  - [Using Plugin Managers Without `oh-my-zsh.sh`](#using-plugin-managers-without-oh-my-zshsh)
  - [Enable GNU ls In macOS And FreeBSD Systems](#enable-gnu-ls-in-macos-and-freebsd-systems)
  - [Skip Aliases](#skip-aliases)
  - [Async git prompt](#async-git-prompt)
@@ -350,120 +349,6 @@ If you have many functions that go well together, you can put them as a `XYZ.plu
 If you would like to override the functionality of a plugin distributed with Oh My Zsh, create a plugin of the
 same name in the `custom/plugins/` directory and it will be loaded instead of the one in `plugins/`.

-### Using Plugin Managers Without `oh-my-zsh.sh`
-
-Some plugin managers load individual OMZ plugins/themes directly and do not source `oh-my-zsh.sh`.
-For those setups, source this bootstrap entrypoint before loading any OMZ plugin or theme:
-
-```zsh
-source "$ZSH/lib/bootstrap.zsh"
-```
-
-#### Bootstrap compatibility contract
-
-`lib/bootstrap.zsh` is idempotent and is the only required pre-load step for plugin-manager setups.
-It guarantees:
-
- `ZSH`, `ZSH_CUSTOM`, and `ZSH_CACHE_DIR` defaults
- writable cache fallback to `${XDG_CACHE_HOME:-$HOME/.cache}/oh-my-zsh`
- `$ZSH_CACHE_DIR/completions` directory creation
- required OMZ `fpath` entries for plugins/themes:
-  - `$ZSH/functions`
-  - `$ZSH/completions`
-  - `$ZSH_CUSTOM/functions`
-  - `$ZSH_CUSTOM/completions`
-  - `$ZSH_CACHE_DIR/completions`
- public signal: `OMZ_IS_BOOTSTRAPPED=true` (for one-time hook guards)
-
-What still requires `oh-my-zsh.sh`:
-
- update checks
- plugin auto-discovery from the `plugins=(...)` list
- `compinit`/`compfix` orchestration and zcompdump metadata refresh
- alias filtering via `:omz:*` zstyles during file sourcing
- final full-init signal: `OMZ_IS_LOADED=true`
-
-#### Plugin manager hook guidance
-
-Run bootstrap once, before any OMZ plugin/theme load:
-
-```zsh
-[[ -n "${OMZ_IS_BOOTSTRAPPED:-}" ]] || source "$ZSH/lib/bootstrap.zsh"
-```
-
- **Antigen** (pre-bundle hook pattern):
-
-  ```zsh
-  omz_preload() { [[ -n "${OMZ_IS_BOOTSTRAPPED:-}" ]] || source "$ZSH/lib/bootstrap.zsh"; }
-  omz_preload
-  antigen bundle OMZ::plugins/git
-  antigen apply
-  ```
-
- **Zinit** (`atinit` pre-load hook):
-
-  ```zsh
-  zinit ice atinit'[[ -n "${OMZ_IS_BOOTSTRAPPED:-}" ]] || source "$ZSH/lib/bootstrap.zsh"'
-  zinit snippet OMZ::plugins/git/git.plugin.zsh
-  ```
-
- **zgen** (pre-load hook function called before OMZ loads):
-
-  ```zsh
-  omz_preload() { [[ -n "${OMZ_IS_BOOTSTRAPPED:-}" ]] || source "$ZSH/lib/bootstrap.zsh"; }
-  omz_preload
-  zgen load ohmyzsh/ohmyzsh plugins/git
-  ```
-
- **zplug** (run pre-load hook immediately before OMZ entries):
-
-  ```zsh
-  omz_preload() { [[ -n "${OMZ_IS_BOOTSTRAPPED:-}" ]] || source "$ZSH/lib/bootstrap.zsh"; }
-  omz_preload
-  zplug "plugins/git", from:oh-my-zsh
-  zplug load
-  ```
-
- **antibody** (run pre-load hook before `antibody bundle`/`source` output):
-
-  ```zsh
-  omz_preload() { [[ -n "${OMZ_IS_BOOTSTRAPPED:-}" ]] || source "$ZSH/lib/bootstrap.zsh"; }
-  omz_preload
-  source <(antibody bundle <<'EOF'
-  ohmyzsh/ohmyzsh path:plugins/git
-  EOF
-  )
-  ```
-
- **zulu** (run pre-load hook before OMZ module loads):
-
-  ```zsh
-  omz_preload() { [[ -n "${OMZ_IS_BOOTSTRAPPED:-}" ]] || source "$ZSH/lib/bootstrap.zsh"; }
-  omz_preload
-  zulu install oh-my-zsh
-  ```
-
-Compatibility matrix:
-
-| Load mode | `OMZ_IS_BOOTSTRAPPED` | `OMZ_IS_LOADED` | Suitable for |
-| :-- | :--: | :--: | :-- |
-| `source $ZSH/oh-my-zsh.sh` | ✅ | ✅ | Full OMZ framework features |
-| `source $ZSH/lib/bootstrap.zsh` + manager-loaded OMZ plugins/themes | ✅ | ❌ | Plugin/theme prerequisites only |
-
-#### Manager entrypoints and OMZ-side auto-injection limits
-
-Most plugin managers load OMZ by directly sourcing selected plugin/theme/lib entrypoints, not by sourcing
-`oh-my-zsh.sh`, so OMZ cannot universally inject bootstrap on its own.
-
-| Manager | Typical OMZ entrypoint(s) it loads | Can OMZ auto-inject bootstrap without user hook? |
-| :-- | :-- | :--: |
-| Antigen | `antigen bundle ...` targets after `antigen use oh-my-zsh` | ❌ |
-| Zinit | `OMZ::`, `OMZL::`, `OMZP::`, `OMZT::` snippets | ❌ |
-| zgen | `zgen oh-my-zsh ...` selected OMZ paths | ❌ |
-| zplug | `from:oh-my-zsh` selected OMZ entries | ❌ |
-| antibody | `ohmyzsh/ohmyzsh path:...` selected OMZ paths | ❌ |
-| zulu | OMZ package/module entries selected by zulu | ❌ |
-
 ### Enable GNU ls In macOS And FreeBSD Systems

 <a name="enable-gnu-ls"></a>
--- a/lib/bootstrap.zsh
+++ b/lib/bootstrap.zsh
@@ -1,44 +0,0 @@
-#
-# Shared Oh My Zsh bootstrap entrypoint.
-#
-# This file can be sourced by plugin managers that don't source `oh-my-zsh.sh`.
-# It is safe to source multiple times.
-#
-
-# Keep source path for callers that invoke omz_bootstrap again later.
-typeset -g _OMZ_BOOTSTRAP_SOURCE="${${(%):-%x}:a}"
-
-omz_bootstrap() {
-  # If ZSH is not defined, infer from this file location.
-  [[ -n "${ZSH:-}" ]] || export ZSH="${_OMZ_BOOTSTRAP_SOURCE:h:h}"
-
-  # Set ZSH_CUSTOM to the path where custom config files and plugins exist.
-  [[ -n "${ZSH_CUSTOM:-}" ]] || ZSH_CUSTOM="$ZSH/custom"
-
-  # Set cache directory.
-  [[ -n "${ZSH_CACHE_DIR:-}" ]] || ZSH_CACHE_DIR="$ZSH/cache"
-
-  # Ensure cache dir is writable, otherwise fallback to a HOME-based cache.
-  if [[ ! -w "$ZSH_CACHE_DIR" ]]; then
-    ZSH_CACHE_DIR="${XDG_CACHE_HOME:-$HOME/.cache}/oh-my-zsh"
-  fi
-
-  # Create cache and completions dir.
-  command mkdir -p "$ZSH_CACHE_DIR/completions"
-
-  # Add required OMZ search paths.
-  local dir
-  for dir in \
-    "$ZSH/functions" \
-    "$ZSH/completions" \
-    "$ZSH_CUSTOM/functions" \
-    "$ZSH_CUSTOM/completions" \
-    "$ZSH_CACHE_DIR/completions"; do
-    (( ${fpath[(Ie)$dir]} )) || fpath=("$dir" $fpath)
-  done
-
-  # Public signal: OMZ bootstrap has completed.
-  typeset -g OMZ_IS_BOOTSTRAPPED=true
-}
-
-omz_bootstrap "$@"
--- a/lib/tests/bootstrap.test.zsh
+++ b/lib/tests/bootstrap.test.zsh
@@ -1,88 +0,0 @@
-#!/usr/bin/zsh -df
-
-set -u
-
-bootstrap_file="${0:A:h:h}/bootstrap.zsh"
-
-_assert() {
-  local condition="$1" message="$2"
-  if ! eval "$condition"; then
-    print -u2 "\e[31mError\e[0m: $message"
-    return 1
-  fi
-}
-
-test_bootstrap_sets_defaults_and_paths() {
-  local tmp==(:)
-  mkdir -p "$tmp/ohmyzsh"/{functions,completions,cache} "$tmp/ohmyzsh/custom"/{functions,completions}
-
-  (
-    set -e
-    export ZSH="$tmp/ohmyzsh"
-    unset ZSH_CUSTOM ZSH_CACHE_DIR OMZ_IS_BOOTSTRAPPED
-    fpath=()
-    source "$bootstrap_file"
-
-    _assert '[[ "$ZSH_CUSTOM" == "'"$tmp/ohmyzsh/custom"'" ]]' "ZSH_CUSTOM default should be set"
-    _assert '[[ "$ZSH_CACHE_DIR" == "'"$tmp/ohmyzsh/cache"'" ]]' "ZSH_CACHE_DIR default should be set"
-    _assert '[[ -d "'"$tmp/ohmyzsh/cache/completions"'" ]]' "completions dir should be created"
-    _assert '[[ "${fpath[(Ie)'"$tmp/ohmyzsh/functions"']}" -gt 0 ]]' "fpath should include OMZ functions dir"
-    _assert '[[ "${fpath[(Ie)'"$tmp/ohmyzsh/completions"']}" -gt 0 ]]' "fpath should include OMZ completions dir"
-    _assert '[[ "${fpath[(Ie)'"$tmp/ohmyzsh/custom/functions"']}" -gt 0 ]]' "fpath should include custom functions dir"
-    _assert '[[ "${fpath[(Ie)'"$tmp/ohmyzsh/custom/completions"']}" -gt 0 ]]' "fpath should include custom completions dir"
-    _assert '[[ "${fpath[(Ie)'"$tmp/ohmyzsh/cache/completions"']}" -gt 0 ]]' "fpath should include cache completions dir"
-    _assert '[[ "$OMZ_IS_BOOTSTRAPPED" == true ]]' "bootstrap signal should be set"
-  )
-}
-
-test_bootstrap_is_idempotent() {
-  local tmp==(:)
-  mkdir -p "$tmp/ohmyzsh"/{functions,completions,cache} "$tmp/ohmyzsh/custom"/{functions,completions}
-
-  (
-    set -e
-    export ZSH="$tmp/ohmyzsh"
-    unset ZSH_CUSTOM ZSH_CACHE_DIR OMZ_IS_BOOTSTRAPPED
-    fpath=()
-    source "$bootstrap_file"
-    source "$bootstrap_file"
-    omz_bootstrap
-
-    _assert '[[ ${#fpath} -eq ${#${(u)fpath}} ]]' "fpath entries should not duplicate after repeated bootstrap"
-    _assert '[[ "$OMZ_IS_BOOTSTRAPPED" == true ]]' "bootstrap signal should remain true"
-  )
-}
-
-test_bootstrap_uses_writable_cache_fallback() {
-  local tmp==(:)
-  mkdir -p "$tmp/ohmyzsh"/{functions,completions} "$tmp/ohmyzsh/custom"/{functions,completions}
-  mkdir -p "$tmp/no-write" "$tmp/xdg-cache"
-  chmod 0555 "$tmp/no-write"
-
-  (
-    set -e
-    export ZSH="$tmp/ohmyzsh"
-    export XDG_CACHE_HOME="$tmp/xdg-cache"
-    export ZSH_CACHE_DIR="$tmp/no-write"
-    unset ZSH_CUSTOM OMZ_IS_BOOTSTRAPPED
-    fpath=()
-    source "$bootstrap_file"
-
-    _assert '[[ "$ZSH_CACHE_DIR" == "'"$tmp/xdg-cache/oh-my-zsh"'" ]]' "cache dir should fallback when not writable"
-    _assert '[[ -d "'"$tmp/xdg-cache/oh-my-zsh/completions"'" ]]' "fallback completions dir should be created"
-    _assert '[[ "${fpath[(Ie)'"$tmp/xdg-cache/oh-my-zsh/completions"']}" -gt 0 ]]' "fpath should include fallback completions dir"
-  )
-}
-
-tests=(
-  test_bootstrap_sets_defaults_and_paths
-  test_bootstrap_is_idempotent
-  test_bootstrap_uses_writable_cache_fallback
-)
-
-for test_name in $tests; do
-  print -u2 "Test: $test_name"
-  "$test_name" || exit 1
-  print -u2 "\e[32mSuccess\e[0m"
-  print -u2 ""
-done
--- a/oh-my-zsh.sh
+++ b/oh-my-zsh.sh
@@ -50,14 +50,31 @@ unset -f omz_f
 # If ZSH is not defined, use the current script's directory.
 [[ -n "$ZSH" ]] || export ZSH="${${(%):-%x}:a:h}"

-# Shared, manager-agnostic bootstrap.
-source "$ZSH/lib/bootstrap.zsh"
+# Set ZSH_CUSTOM to the path where your custom config files
+# and plugins exists, or else we will use the default custom/
+[[ -n "$ZSH_CUSTOM" ]] || ZSH_CUSTOM="$ZSH/custom"
+
+# Set ZSH_CACHE_DIR to the path where cache files should be created
+# or else we will use the default cache/
+[[ -n "$ZSH_CACHE_DIR" ]] || ZSH_CACHE_DIR="$ZSH/cache"
+
+# Make sure $ZSH_CACHE_DIR is writable, otherwise use a directory in $HOME
+if [[ ! -w "$ZSH_CACHE_DIR" ]]; then
+  ZSH_CACHE_DIR="${XDG_CACHE_HOME:-$HOME/.cache}/oh-my-zsh"
+fi
+
+# Create cache and completions dir and add to $fpath
+mkdir -p "$ZSH_CACHE_DIR/completions"
+(( ${fpath[(Ie)$ZSH_CACHE_DIR/completions]} )) || fpath=("$ZSH_CACHE_DIR/completions" $fpath)

 # Check for updates on initial load...
 source "$ZSH/tools/check_for_upgrade.sh"

 # Initializes Oh My Zsh

+# add a function path
+fpath=($ZSH/{functions,completions} $ZSH_CUSTOM/{functions,completions} $fpath)
+
 # Load all stock functions (from $fpath files) called below.
 autoload -U compaudit compinit zrecompile

@@ -217,6 +234,3 @@ fi

 # set completion colors to be the same as `ls`, after theme has been loaded
 [[ -z "$LS_COLORS" ]] || zstyle ':completion:*' list-colors "${(s.:.)LS_COLORS}"
-
-# Public signal: full Oh My Zsh init script has completed.
-typeset -g OMZ_IS_LOADED=true
--- a/tools/changelog.sh
+++ b/tools/changelog.sh
@@ -221,12 +221,12 @@ supports_hyperlinks() {

  # If $TERM_PROGRAM is set, these terminals support hyperlinks
  case "$TERM_PROGRAM" in
-  Hyper|iTerm.app|terminology|WezTerm|vscode) return 0 ;;
+  ghostty|Hyper|iTerm.app|terminology|vscode|WezTerm) return 0 ;;
  esac

  # These termcap entries support hyperlinks
  case "$TERM" in
-  xterm-kitty|alacritty|alacritty-direct) return 0 ;;
+  alacritty|alacritty-direct|xterm-ghostty|xterm-kitty) return 0 ;;
  esac

  # xfce4-terminal supports hyperlinks
--- a/tools/install.sh
+++ b/tools/install.sh
@@ -49,9 +49,31 @@ USER=${USER:-$(id -u -n)}
 # $HOME is defined at the time of login, but it could be unset. If it is unset,
 # a tilde by itself (~) will not be expanded to the current user's home directory.
 # POSIX: https://pubs.opengroup.org/onlinepubs/009696899/basedefs/xbd_chap08.html#tag_08_03
-HOME="${HOME:-$(getent passwd $USER 2>/dev/null | cut -d: -f6)}"
-# macOS does not have getent, but this works even if $HOME is unset
-HOME="${HOME:-$(eval echo ~"$USER")}"
+if [ -z "$HOME" ]; then
+  HOME=$(getent passwd "$USER" 2>/dev/null | cut -d: -f6)
+
+  # macOS does not have getent; fall back to tilde expansion, but only if
+  # $USER is a safe username. The eval below would otherwise expand any shell
+  # metacharacters in $USER and allow command injection (CWE-78).
+  case "$USER" in
+    *[![:alnum:]_.-]*|'')
+      ;;
+    *)
+      resolved_home=$(eval echo ~"$USER")
+      # Unknown users are not expanded and produce a literal "~username".
+      [ "$resolved_home" = "~$USER" ] || HOME=$resolved_home
+      ;;
+  esac
+
+  case "$HOME" in
+    /*) ;;
+    *)
+      echo "Error: unable to determine the current user's home directory." >&2
+      echo "Set HOME explicitly and rerun the installer." >&2
+      exit 1
+      ;;
+  esac
+fi


 # Track if $ZSH was provided
@@ -168,12 +190,12 @@ supports_hyperlinks() {

  # If $TERM_PROGRAM is set, these terminals support hyperlinks
  case "$TERM_PROGRAM" in
-  Hyper|iTerm.app|terminology|WezTerm|vscode) return 0 ;;
+  ghostty|Hyper|iTerm.app|terminology|vscode|WezTerm) return 0 ;;
  esac

  # These termcap entries support hyperlinks
  case "$TERM" in
-  xterm-kitty|alacritty|alacritty-direct) return 0 ;;
+  alacritty|alacritty-direct|xterm-ghostty|xterm-kitty) return 0 ;;
  esac

  # xfce4-terminal supports hyperlinks
--- a/tools/upgrade.sh
+++ b/tools/upgrade.sh
@@ -95,12 +95,12 @@ supports_hyperlinks() {

  # If $TERM_PROGRAM is set, these terminals support hyperlinks
  case "$TERM_PROGRAM" in
-  Hyper|iTerm.app|terminology|WezTerm|vscode) return 0 ;;
+  ghostty|Hyper|iTerm.app|terminology|vscode|WezTerm) return 0 ;;
  esac

  # These termcap entries support hyperlinks
  case "$TERM" in
-  xterm-kitty|alacritty|alacritty-direct) return 0 ;;
+  alacritty|alacritty-direct|xterm-ghostty|xterm-kitty) return 0 ;;
  esac

  # xfce4-terminal supports hyperlinks