ts: add zsh/fish/tcsh non-regression cases for the completion injection fix

The bash fix in a previous commit only applied to bash: the unquoted-
word expansion compgen -W performs on its candidate string is specific
to that one builtin. init/zsh-functions/_module.in hands candidates to
'compadd -a <array>', init/fish_completion to 'complete -a "(...)"'
(newline-split command output), and init/tcsh_completion.in to a plain
backtick command's word list -- in all three, each element becomes a
literal candidate string with no further shell expansion, so none of
them were ever vulnerable to this bug class.

Add the same three injection-safety cases (a malicious module name,
LOADEDMODULES entry, and MODULEPATH entry, each embedding shell code)
to 031-zsh.exp/041-fish.exp/051-tcsh.exp, to guard against a future
regression rather than a known vulnerability. Each shell has its own
candidate-display conventions, which change what the literal "contains"
check needs to look for: zsh backslash-escapes special characters
before display/insertion, fish single-quotes a candidate containing a
special character on single-candidate inline completion and (on a
multi-candidate pager listing) strips a "(...)" suffix as if it were a
candidate's own description, colliding with the embedded parentheses
in the crafted candidate itself. fish has no MODULEPATH case: 'unuse'
does not list modulepaths there at all. None of this affects the
actual security check (completion_assert_no_exec, confirming that the
crafted candidate's 'touch' side effect never ran), which needs no
such per-shell handling.

Also widens the completion timeout for the new section in
051-tcsh.exp: each case there spawns a cold tcsh session with nothing
having already warmed up the pty/subprocess pipeline before listing
candidates, which occasionally ran past the default 10 second bound
under a loaded machine.

Assisted-by: Claude:claude-sonnet-5
Signed-off-by: Xavier Delaruelle <xavier.delaruelle@cea.fr>

Author: xdelaruelle

.hunspell.en.dic

@@ -263,6 +263,7 @@ autotools
 availabilities
 avx
 ba
+backtick
 backticks
 badcommand
 baf
@@ -285,6 +286,7 @@ boolvariantname
 boolvr
 bourne
 bugfix
+builtin
 cachebuild
 cacheclear
 cachefile
@@ -341,6 +343,7 @@ comgen
 commandexp
 commandname
 compA
+compadd
 compB
 compat
 compdef
@@ -842,6 +845,7 @@ subdir
 subdirectories
 subdirectory
 submodule
+subprocess
 subprojects
 subshell
 substring

testsuite/completion.00-init/031-zsh.exp

@@ -38,6 +38,15 @@
 #			   @comp_*_opts@ flags into the candidate set
 #			   regardless of prefix, so a bare trailing-space
 #			   listing here only ever shows one set at a time
+#
+#			Also checks, like 021-bash.exp, that a candidate word
+#			built from untrusted text (a module name,
+#			LOADEDMODULES, MODULEPATH) cannot reach a shell
+#			expansion step: init/zsh-functions/_module.in only ever
+#			hands such text to 'compadd -a <array>', where each
+#			array element is used as a literal candidate string, so
+#			this is expected to already be safe -- these cases guard
+#			against a regression, not a known vulnerability
 #		}C%
 #
 ##############################################################################
@@ -393,6 +402,79 @@ completion_zsh_close
 unsetenv_loaded_module
 
 
+#
+# candidate words built from untrusted text cannot reach a shell expansion
+# step (see this file's header, and the security fix for the bash-completion
+# command injection this guards against a regression of)
+#
+
+set marker "$env(TESTSUITEDIR)/completion-injection-marker"
+file delete -force $marker
+
+# module avail: malicious module name read off disk
+
+# the marker path is passed through as an env var rather than embedded
+# directly in the filename, since a filename cannot itself contain '/'
+setenv_var INJMARKER $marker
+set evilname {evil$(touch>$INJMARKER)}
+file mkdir $injectdir
+set fd [open "$injectdir/$evilname" w]
+puts $fd {#%Module1.0}
+close $fd
+
+setenv_path_var MODULEPATH $injectdir
+
+completion_zsh_start
+
+## _module_avail_mods hands this candidate to 'compadd', which backslash-
+## escapes every shell metacharacter in it before display/insertion (the
+## same protection this file's header notes _module.in relies on instead of
+## bash's compgen -W): the listing shows 'evil\$\(touch\>\$INJMARKER\)', not
+## the raw string
+set got [completion_zsh_list {module load }]
+completion_assert_no_exec $marker
+completion_assert_contains $got [list [regsub -all {[$()>]} $evilname {\\&}]]
+
+completion_zsh_close
+unsetenv_path_var MODULEPATH
+unsetenv_var INJMARKER
+file delete -force $injectdir
+
+# LOADEDMODULES: malicious already-loaded module name
+
+set evilmod [string map [list MARKERPATH $marker] {python$(touch>MARKERPATH)}]
+setenv_loaded_module [list gcc $evilmod] [list /fake/gcc /fake/evilmod]
+
+completion_zsh_start
+
+set got [completion_zsh_list {module unload }]
+completion_assert_no_exec $marker
+completion_assert_contains $got [list $evilmod]
+
+completion_zsh_close
+unsetenv_loaded_module
+
+# MODULEPATH: malicious path entry (module unuse)
+
+set evilpath [string map [list MARKERPATH $marker] {/opt$(touch>MARKERPATH)}]
+setenv_path_var MODULEPATH /tmp $evilpath
+
+completion_zsh_start
+
+## both entries share a leading '/', so type it explicitly: otherwise zle
+## auto-inserts that common prefix on the first Tab and the double-Tab below
+## would only ring the bell instead of listing (same trap as the "bar"/"ba"
+## cases earlier in this file)
+set got [completion_zsh_list {module unuse /}]
+completion_assert_no_exec $marker
+completion_assert_contains $got [list $evilpath]
+
+completion_zsh_close
+unsetenv_path_var MODULEPATH
+
+file delete -force $marker
+
+
 #
 #  Cleanup
 #

testsuite/completion.00-init/041-fish.exp

@@ -66,6 +66,17 @@
 #			   the word being completed starts with '-' -- so a bare
 #			   trailing-space listing only ever shows one set, same
 #			   as 031-zsh.exp
+#
+#			Also checks, like 021-bash.exp/031-zsh.exp, that a
+#			candidate word built from untrusted text (a module
+#			name, LOADEDMODULES) cannot reach a shell expansion
+#			step: init/fish_completion only ever hands such text to
+#			'complete -a "(...)"', where the parenthesized command's
+#			output is split into literal candidate lines, so this is
+#			expected to already be safe -- these cases guard against
+#			a regression, not a known vulnerability. No MODULEPATH
+#			case here: 'unuse' does not list modulepaths at all in
+#			fish (see this file's header)
 #		}C%
 #
 ##############################################################################
@@ -371,6 +382,69 @@ completion_fish_close
 unsetenv_loaded_module
 
 
+#
+# candidate words built from untrusted text cannot reach a shell expansion
+# step (see this file's header, and the security fix for the bash-completion
+# command injection this guards against a regression of)
+#
+
+set marker "$env(TESTSUITEDIR)/completion-injection-marker"
+file delete -force $marker
+
+# module avail: malicious module name read off disk
+
+# the marker path is passed through as an env var rather than embedded
+# directly in the filename, since a filename cannot itself contain '/'
+setenv_var INJMARKER $marker
+set evilname {evil$(touch>$INJMARKER)}
+file mkdir $injectdir
+set fd [open "$injectdir/$evilname" w]
+puts $fd {#%Module1.0}
+close $fd
+
+setenv_path_var MODULEPATH $injectdir
+
+completion_fish_start
+
+## this fixture has only one module, so a single Tab completes it inline
+## rather than showing a pager listing (see completion_fish_list's own
+## single-candidate fallback) -- and fish, like zsh, protects a candidate
+## containing shell metacharacters before inserting it: fish 4 wraps it in
+## single quotes whereas fish 3 backslash-escapes each metacharacter
+set got [completion_fish_list {module load }]
+completion_assert_no_exec $marker
+completion_assert_any $got [list "'$evilname'"\
+   [regsub -all {[$()>]} $evilname {\\&}]]
+
+completion_fish_close
+unsetenv_path_var MODULEPATH
+unsetenv_var INJMARKER
+file delete -force $injectdir
+
+# LOADEDMODULES: malicious already-loaded module name
+
+set evilmod [string map [list MARKERPATH $marker] {python$(touch>MARKERPATH)}]
+setenv_loaded_module [list gcc $evilmod] [list /fake/gcc /fake/evilmod]
+
+completion_fish_start
+
+## two candidates here (gcc and evilmod) means a real pager listing, which
+## completion_fish_list runs through completion_fish_strip_descriptions to
+## drop each candidate's "(description)" suffix -- the injected
+## '(touch>...)' substring is indistinguishable from that convention and
+## gets stripped the same way, so the surviving candidate is the text up to
+## its own first '(', not the full raw string (still proven never executed
+## by completion_assert_no_exec above)
+set got [completion_fish_list {module unload }]
+completion_assert_no_exec $marker
+completion_assert_contains $got [list [completion_fish_strip_descriptions $evilmod]]
+
+completion_fish_close
+unsetenv_loaded_module
+
+file delete -force $marker
+
+
 #
 #  Cleanup
 #

testsuite/completion.00-init/051-tcsh.exp

@@ -78,6 +78,18 @@
 #			   worked around here, since 'help' otherwise dispatches
 #			   exactly like 'show'/'display'/'test'/... which all
 #			   already carry that macro)
+#
+#			Also checks, like 021-bash.exp/031-zsh.exp, that a
+#			candidate word built from untrusted text (a module
+#			name, LOADEDMODULES, MODULEPATH) cannot reach a shell
+#			expansion step: init/tcsh_completion.in only ever hands
+#			such text to a plain 'n/.../`...`/' backtick rule, where
+#			each output line becomes a literal candidate string, so
+#			this is expected to already be safe -- these cases guard
+#			against a regression, not a known vulnerability. The
+#			MODULEPATH case uses a bare 'module unuse ' (no typed
+#			prefix), same restriction as this file's own 'unuse'
+#			section above
 #		}C%
 #
 ##############################################################################
@@ -455,6 +467,83 @@ completion_tcsh_close
 unsetenv_loaded_module
 
 
+#
+# candidate words built from untrusted text cannot reach a shell expansion
+# step (see this file's header, and the security fix for the bash-completion
+# command injection this guards against a regression of)
+#
+
+# each case below spawns a fresh tcsh session and, unlike every other
+# section in this file, its Ctrl-D listing goes through _module_loaded/
+# _module_avail/_module_modulepath cold (no completion call already primed
+# the pty/subprocess pipeline): comfortably inside the default 10s
+# 'timeout' most of the time, but occasionally not under a loaded machine,
+# so it is raised for just this section rather than risking a false
+# UNRESOLVED
+set old_timeout $timeout
+set timeout 30
+
+set marker "$env(TESTSUITEDIR)/completion-injection-marker"
+file delete -force $marker
+
+# module avail: malicious module name read off disk
+
+# the marker path is passed through as an env var rather than embedded
+# directly in the filename, since a filename cannot itself contain '/'
+setenv_var INJMARKER $marker
+set evilname {evil$(touch>$INJMARKER)}
+file mkdir $injectdir
+set fd [open "$injectdir/$evilname" w]
+puts $fd {#%Module1.0}
+close $fd
+
+setenv_path_var MODULEPATH $injectdir
+
+completion_tcsh_start
+
+set got [completion_tcsh_list {module load }]
+completion_assert_no_exec $marker
+completion_assert_contains $got [list $evilname]
+
+completion_tcsh_close
+unsetenv_path_var MODULEPATH
+unsetenv_var INJMARKER
+file delete -force $injectdir
+
+# LOADEDMODULES: malicious already-loaded module name
+
+set evilmod [string map [list MARKERPATH $marker] {python$(touch>MARKERPATH)}]
+setenv_loaded_module [list gcc $evilmod] [list /fake/gcc /fake/evilmod]
+
+completion_tcsh_start
+
+set got [completion_tcsh_list {module unload }]
+completion_assert_no_exec $marker
+completion_assert_contains $got [list $evilmod]
+
+completion_tcsh_close
+unsetenv_loaded_module
+
+# MODULEPATH: malicious path entry (module unuse); like this file's own
+# 'unuse' section above, only a bare, empty word reaches the modulepath
+# listing at all (see this file's header)
+
+set evilpath [string map [list MARKERPATH $marker] {/opt$(touch>MARKERPATH)}]
+setenv_path_var MODULEPATH /tmp $evilpath
+
+completion_tcsh_start
+
+set got [completion_tcsh_list {module unuse }]
+completion_assert_no_exec $marker
+completion_assert_contains $got [list $evilpath]
+
+completion_tcsh_close
+unsetenv_path_var MODULEPATH
+
+set timeout $old_timeout
+file delete -force $marker
+
+
 #
 #  Cleanup
 #