Fix #2944

This is part of the "Enhanced default settings" by Clink and a very useful feature

.github/workflows/branches.yml

@@ -19,7 +19,7 @@ jobs:
     # Steps represent a sequence of tasks that will be executed as part of the job
     steps:
       # Checks-out the repository under $GITHUB_WORKSPACE, so the job can access it
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@v4
         with:
           fetch-depth: 0 # fetch all history for all branches and tags
 

.github/workflows/build.yml

@@ -11,7 +11,7 @@ on:
     tags:
       - "v*"
   pull_request:
-    branches: [ "master" ]
+    branches: [ "master", "development" ]
 
 #---------------------------------#
 #    environment configuration    #
@@ -30,15 +30,17 @@ jobs:
   build:
     name: Build Project
     runs-on: windows-latest
-
+    permissions:
+      contents: write
+      discussions: write
     steps:
     - name: Check out repository code (Action from GitHub)
-      uses: actions/checkout@v3
+      uses: actions/checkout@v4
       with:
         fetch-depth: 0
 
     - name: Add MSBuild to PATH
-      uses: microsoft/setup-msbuild@v1
+      uses: microsoft/setup-msbuild@v2
 
     - name: Build Cmder Launcher
       shell: pwsh
@@ -51,32 +53,32 @@ jobs:
       run: .\pack.ps1 -verbose
 
     - name: Upload artifact (cmder.zip)
-      uses: actions/upload-artifact@v3
+      uses: actions/upload-artifact@v4
       with:
         path: build/cmder.zip
         name: cmder.zip
         if-no-files-found: error
 
     - name: Upload artifact (cmder.7z)
-      uses: actions/upload-artifact@v3
+      uses: actions/upload-artifact@v4
       with:
         path: build/cmder.7z
         name: cmder.7z
 
     - name: Upload artifact (cmder_mini.zip)
-      uses: actions/upload-artifact@v3
+      uses: actions/upload-artifact@v4
       with:
         path: build/cmder_mini.zip
         name: cmder_mini.zip
 
     - name: Upload artifact (hashes.txt)
-      uses: actions/upload-artifact@v3
+      uses: actions/upload-artifact@v4
       with:
         path: build/hashes.txt
         name: hashes.txt
 
     - name: Create Release
-      uses: softprops/action-gh-release@v1
+      uses: softprops/action-gh-release@v2
       with:
         files: |
           build/cmder.zip

.github/workflows/codeql.yml

@@ -3,20 +3,25 @@
 #
 # You may wish to alter this file to override the set of languages analyzed,
 # or to provide custom queries or build logic.
-#
-# ******** NOTE ********
-# We have attempted to detect the languages in your repository. Please check
-# the `language` matrix defined below to confirm you have the correct set of
-# supported CodeQL languages.
-#
+
 name: "CodeQL"
 
 on:
   push:
-    branches: [ "master" ]
+    branches: [ "master", "development" ]
+    paths-ignore:
+      - '**/*.md'
+      - '**/*.txt'
+      - '.github/**'
+      - '**/.gitignore'
   pull_request:
     # The branches below must be a subset of the branches above
-    branches: [ "master" ]
+    branches: [ "master", "development" ]
+    paths-ignore:
+      - '**/*.md'
+      - '**/*.txt'
+      - '.github/**'
+      - '**/.gitignore'
   schedule:
     - cron: '30 19 * * 0'
 
@@ -40,11 +45,11 @@ jobs:
 
     steps:
     - name: Checkout repository
-      uses: actions/checkout@v3
+      uses: actions/checkout@v4
 
     # Initializes the CodeQL tools for scanning.
     - name: Initialize CodeQL
-      uses: github/codeql-action/init@v2
+      uses: github/codeql-action/init@v3
       with:
         languages: ${{ matrix.language }}
         # If you wish to specify custom queries, you can do so here or in a config file.
@@ -55,7 +60,7 @@ jobs:
         # queries: security-extended,security-and-quality
 
     - name: Add MSBuild to PATH
-      uses: microsoft/setup-msbuild@v1
+      uses: microsoft/setup-msbuild@v2
 
     - name: Build Cmder Launcher
       shell: pwsh
@@ -63,6 +68,6 @@ jobs:
       run: .\build.ps1 -Compile -verbose
 
     - name: Perform CodeQL Analysis
-      uses: github/codeql-action/analyze@v2
+      uses: github/codeql-action/analyze@v3
       with:
         category: "/language:${{matrix.language}}"

.github/workflows/tests.yml

@@ -4,9 +4,21 @@ on:
   push:
     branches:
       - master
+      - development
+    paths-ignore:
+      - '**/*.md'
+      - '**/*.txt'
+      - '.github/**'
+      - '**/.gitignore'
   pull_request:
     branches:
       - master
+      - development
+    paths-ignore:
+      - '**/*.md'
+      - '**/*.txt'
+      - '.github/**'
+      - '**/.gitignore'
 
 defaults:
   run:
@@ -26,7 +38,7 @@ jobs:
     continue-on-error: false
 
     steps:
-    - uses: actions/checkout@v3
+    - uses: actions/checkout@v4
     - name: Initialize vendors
       shell: pwsh
       working-directory: scripts

.github/workflows/vendor.yml

@@ -24,7 +24,7 @@ jobs:
       pull-requests: write
 
     steps:
-    - uses: actions/checkout@v3
+    - uses: actions/checkout@v4
       with:
         fetch-depth: 0
 
@@ -51,7 +51,7 @@ jobs:
           Set-GHVariable -Name LIST_UPDATED -Value $listUpdated.Trim(', ')
           echo "UPDATE_MESSAGE<<<EOF`n$updateMessage`n<EOF" | Out-File -FilePath $env:GITHUB_ENV -Append -Encoding utf8
 
-    - uses: peter-evans/create-pull-request@v5
+    - uses: peter-evans/create-pull-request@v6
       if: env.COUNT_UPDATED > 0
       with:
         title: 'Updates to `${{ env.COUNT_UPDATED }}` vendored dependencies'

SECURITY.md

@@ -0,0 +1,24 @@
+# Security Policy
+
+## Supported Versions
+
+| Version | Supported          |
+| ------- | ------------------ |
+| 1.3.x   | :white_check_mark: |
+| < 1.3   | ❎ |
+
+## Reporting a Vulnerability
+
+If you discover a security issue in our project, please report it to [MartiUK](https://github.com/MartiUK). We will acknowledge your email within 24 hours and provide a more detailed response within 48 hours. We will try to fix the issue as soon as possible and inform you when a new version is released.
+
+Please include as much of the information listed below as you can to help us better understand and resolve the issue:
+
+- The nature of the issue
+- The affected source file(s) with full paths
+- The location of the vulnerable code (tag/branch/commit or direct URL)
+- Any special configuration needed to reproduce the issue
+- Detailed steps to reproduce the issue
+- Proof-of-concept or exploit code (if possible)
+- The impact of the issue, including how an attacker could exploit it
+
+Please do not disclose the vulnerability publicly until we have resolved it.

launcher/src/CmderLauncher.cpp

@@ -469,9 +469,6 @@ void StartCmder(std::wstring  path = L"", bool is_single_mode = false, std::wstr
 		MessageBox(NULL, _T("Unable to create the ConEmu process!"), _T("Error"), MB_OK);
 		return;
 	}
-
-	LRESULT lr = SendMessageTimeout(HWND_BROADCAST, WM_SETTINGCHANGE, 0, (LPARAM)"Environment", SMTO_ABORTIFHUNG | SMTO_NOTIMEOUTIFNOTHUNG, 5000, NULL);
-	lr = SendMessageTimeout(HWND_BROADCAST, WM_SETTINGCHANGE, 0, (LPARAM)L"Environment", SMTO_ABORTIFHUNG | SMTO_NOTIMEOUTIFNOTHUNG, 5000, NULL); // For Windows >= 8
 }
 
 bool IsUserOnly(std::wstring opt)

launcher/src/version.rc2.sample

@@ -1,7 +1,7 @@
 
 /**
  * WARNING: do NOT modify this file! the content of this file should be
- *          automatically genereted before AppVeyor builds using the
+ *          automatically generated before AppVeyor builds using the
  *          respective .ps1 Powershell scripts.
  *
  */

scripts/build.ps1

@@ -79,7 +79,7 @@ if ($Compile) {
 
     Write-Verbose "Building the launcher..."
 
-    # Referene: https://docs.microsoft.com/visualstudio/msbuild/msbuild-command-line-reference
+    # Reference: https://docs.microsoft.com/visualstudio/msbuild/msbuild-command-line-reference
     msbuild CmderLauncher.vcxproj /t:Clean,Build /p:configuration=Release /m
 
     if ($LastExitCode -ne 0) {

vendor/bin/cmder_shell.cmd

@@ -9,5 +9,5 @@ if "%cmder_init%" == "1" (
 )
 
 pushd "%CMDER_ROOT%"
-call "%CMDER_ROOT%\vendor\init.bat" /f
+call "%CMDER_ROOT%\vendor\init.bat" /f %*
 popd

vendor/clink.lua

@@ -51,11 +51,37 @@ local function get_unknown_color()
 end
 
 ---
--- Makes a string safe to use as the replacement in string.gsub
+-- Escapes special characters in a string.gsub `find` parameter, so that it
+-- can be matched as a literal plain text string, i.e. disable Lua pattern
+-- matching.  See "Patterns" (https://www.lua.org/manual/5.2/manual.html#6.4.1).
+-- @param {string} text Text to escape
+-- @returns {string} Escaped text
 ---
-local function verbatim(s)
-    s = string.gsub(s, "%%", "%%%%")
-    return s
+local function escape_gsub_find_arg(text)
+    return text and text:gsub("([-+*?.%%()%[%]$^])", "%%%1") or ""
+end
+
+---
+-- Escapes special characters in a string.gsub `replace` parameter, so that it
+-- can be replaced as a literal plain text string, i.e. disable Lua pattern
+-- matching.  See "Patterns" (https://www.lua.org/manual/5.2/manual.html#6.4.1).
+-- @param {string} text Text to escape
+-- @returns {string} Escaped text
+---
+local function escape_gsub_replace_arg(text)
+    return text and text:gsub("%%", "%%%%") or ""
+end
+
+---
+-- Perform string.sub, but disable Lua pattern matching and just treat both
+-- the `find` and `replace` parameters as a literal plain text replacement.
+-- @param {string} str Text in which to perform find and replace
+-- @param {string} find Text to find (plain text; not a Lua pattern)
+-- @param {string} replace Replacement text (plain text; not a Lua pattern)
+-- @returns {string} Copy of the input `str` with `find` replaced by `replace`
+---
+local function gsub_plain(str, find, replace)
+    return string.gsub(str, escape_gsub_find_arg(find), escape_gsub_replace_arg(replace))
 end
 
 -- Extracts only the folder name from the input Path
@@ -153,7 +179,7 @@ local function set_prompt_filter()
     end
 
     if prompt_useHomeSymbol and string.find(cwd, clink.get_env("HOME")) then
-        cwd = string.gsub(cwd, clink.get_env("HOME"), prompt_homeSymbol)
+        cwd = gsub_plain(cwd, clink.get_env("HOME"), prompt_homeSymbol)
     end
 
     local uah = ''
@@ -176,14 +202,14 @@ local function set_prompt_filter()
     local version_control = prompt_includeVersionControl and "{git}{hg}{svn}" or ""
 
     local prompt = "{uah}{cwd}" .. version_control .. cr .. get_lamb_color() .. "{env}{lamb}\x1b[0m "
-    prompt = string.gsub(prompt, "{uah}", uah)
-    prompt = string.gsub(prompt, "{cwd}", cwd)
-    prompt = string.gsub(prompt, "{env}", env)
-    clink.prompt.value = string.gsub(prompt, "{lamb}", prompt_lambSymbol)
+    prompt = gsub_plain(prompt, "{uah}", uah)
+    prompt = gsub_plain(prompt, "{cwd}", cwd)
+    prompt = gsub_plain(prompt, "{env}", env)
+    clink.prompt.value = gsub_plain(prompt, "{lamb}", prompt_lambSymbol)
 end
 
 local function percent_prompt_filter()
-    clink.prompt.value = string.gsub(clink.prompt.value, "{percent}", "%%")
+    clink.prompt.value = gsub_plain(clink.prompt.value, "{percent}", "%")
 end
 
 ---
@@ -532,13 +558,13 @@ local function git_prompt_filter()
                 color = colors.conflict
             end
 
-            clink.prompt.value = string.gsub(clink.prompt.value, "{git}", " "..color.."("..verbatim(branch)..")")
+            clink.prompt.value = gsub_plain(clink.prompt.value, "{git}", " "..color.."("..branch..")")
             return false
         end
     end
 
     -- No git present or not in git file
-    clink.prompt.value = string.gsub(clink.prompt.value, "{git}", "")
+    clink.prompt.value = gsub_plain(clink.prompt.value, "{git}", "")
     return false
 end
 
@@ -577,13 +603,13 @@ local function hg_prompt_filter()
             end
 
             local result = color .. "(" .. branch .. ")"
-            clink.prompt.value = string.gsub(clink.prompt.value, "{hg}", " "..verbatim(result))
+            clink.prompt.value = gsub_plain(clink.prompt.value, "{hg}", " "..result)
             return false
         end
     end
 
     -- No hg present or not in hg repo
-    clink.prompt.value = string.gsub(clink.prompt.value, "{hg}", "")
+    clink.prompt.value = gsub_plain(clink.prompt.value, "{hg}", "")
 end
 
 local function svn_prompt_filter()
@@ -636,13 +662,13 @@ local function svn_prompt_filter()
                 color = colors.dirty
             end
 
-            clink.prompt.value = string.gsub(clink.prompt.value, "{svn}", " "..color.."("..verbatim(branch)..")")
+            clink.prompt.value = gsub_plain(clink.prompt.value, "{svn}", " "..color.."("..branch..")")
             return false
         end
     end
 
     -- No svn present or not in svn file
-    clink.prompt.value = string.gsub(clink.prompt.value, "{svn}", "")
+    clink.prompt.value = gsub_plain(clink.prompt.value, "{svn}", "")
     return false
 end
 

vendor/clink_settings.default

@@ -1,6 +1,10 @@
 # For explanation of these and other settings see:
 # https://chrisant996.github.io/clink/clink.html
 
+# name: Expand envvars when completing
+# type: boolean
+match.expand_envvars = True
+
 # name: Sets how command history expansion is applied
 # type: enum
 # options: off,on,not_squoted,not_dquoted,not_quoted

vendor/lib/lib_git.cmd

@@ -55,6 +55,7 @@ exit /b
             set "GIT_VERSION=%%C"
         ) else (
             echo "'git --version' returned an improper version string!"
+            %print_debug% :read_version "returned string: '%%A %%B %%C' by executable path: %git_executable%"
             pause
             exit /b
         )

vendor/sources.json

@@ -1,13 +1,13 @@
 [
   {
     "name": "git-for-windows",
-    "version": "2.41.0.windows.3",
-    "url": "https://github.com/git-for-windows/git/releases/download/v2.41.0.windows.3/PortableGit-2.41.0.3-64-bit.7z.exe"
+    "version": "2.45.1.windows.1",
+    "url": "https://github.com/git-for-windows/git/releases/download/v2.45.1.windows.1/PortableGit-2.45.1-64-bit.7z.exe"
   },
   {
     "name": "clink",
-    "version": "1.5.1",
-    "url": "https://github.com/chrisant996/clink/releases/download/v1.5.1/clink.1.5.1.1e9e51.zip"
+    "version": "1.6.14",
+    "url": "https://github.com/chrisant996/clink/releases/download/v1.6.14/clink.1.6.14.93b83f.zip"
   },
   {
     "name": "conemu-maximus5",
@@ -16,7 +16,7 @@
   },
   {
     "name": "clink-completions",
-    "version": "0.4.10",
-    "url": "https://github.com/vladimir-kotikov/clink-completions/archive/v0.4.10.zip"
+    "version": "0.5.2",
+    "url": "https://github.com/vladimir-kotikov/clink-completions/archive/v0.5.2.zip"
   }
 ]