fix(themes): fix potential command injection in `pygmalion`, `pygmalion-virtualenv` and `refined`

The pygmalion and pygmalion-virtualenv themes unsafely handle git prompt information
which results in a double evaluation of this information, so a malicious git repository
could trigger a command injection if the user cloned and entered the repository.

A similar method could be used in the refined theme. All themes have been patched against this
vulnerability.

1 files changed, 6 insertions, 5 deletions

diff --git a/themes/pygmalion-virtualenv.zsh-theme b/themes/pygmalion-virtualenv.zsh-theme
index 47b0b4fb1..c2ab7f4e6 100644
--- a/themes/pygmalion-virtualenv.zsh-theme
+++ b/themes/pygmalion-virtualenv.zsh-theme
@@ -35,19 +35,20 @@ prompt_setup_pygmalion(){
 }
 
 prompt_pygmalion_precmd(){
-  setopt localoptions extendedglob
+  setopt localoptions nopromptsubst extendedglob
 
   local gitinfo=$(git_prompt_info)
   local gitinfo_nocolor=${gitinfo//\%\{[^\}]##\}}
-  local exp_nocolor="$(print -P \"$base_prompt_nocolor$gitinfo_nocolor$post_prompt_nocolor\")"
+  local exp_nocolor="$(print -P \"${base_prompt_nocolor}${gitinfo_nocolor}${post_prompt_nocolor}\")"
   local prompt_length=${#exp_nocolor}
 
+  # add new line on prompt longer than 40 characters
   local nl=""
-
   if [[ $prompt_length -gt 40 ]]; then
-    nl=$'\n%{\r%}';
+    nl=$'\n%{\r%}'
   fi
-  PROMPT="$base_prompt$gitinfo$nl$post_prompt"
+
+  PROMPT="${base_prompt}\$(git_prompt_info)${nl}${post_prompt}"
 }
 
 prompt_setup_pygmalion