]> git.ipfire.org Git - thirdparty/Python/cpython.git/commit
gh-140006: Harden fish prompt against shadowed builtins (#150936)
authorBernát Gábor <gaborjbernat@gmail.com>
Mon, 22 Jun 2026 15:39:08 +0000 (08:39 -0700)
committerGitHub <noreply@github.com>
Mon, 22 Jun 2026 15:39:08 +0000 (16:39 +0100)
commit0d540afcec0ead73620edb675ebdc47925ba581f
treeeef0f7289b8ca57af6c60bb1eaadebfd8ae195a0
parentb86c305c746f6d5be52227c946b77a009bad8928
gh-140006: Harden fish prompt against shadowed builtins (#150936)

A user function that shadows the `.`/`source` builtin hijacks the
activate.fish prompt. fish resolves functions ahead of builtins, so the
`echo "exit $status" | .` line that restores the exit status pipes into
the user function instead of sourcing. Dot-style directory navigators
redefine `.`, which made the prompt list the directory on every command
and dropped the exit status handed to the original prompt.

Route every builtin the prompt path uses (`source`, `echo`, `printf`,
`set_color`, `functions`) through `builtin` so no user function can
intercept them. These have all been fish builtins with a stable
interface since fish 2.0.0, the version the script already required
through `functions --copy`, so the minimum supported fish version does
not change.
Lib/test/test_venv.py
Lib/venv/scripts/common/activate.fish
Misc/NEWS.d/next/Library/2026-06-04-19-24-13.gh-issue-140006.TD8HKl.rst [new file with mode: 0644]