Commit54709d9

committed

Fix leaking environment variables

1 parentcf8dc25 commit54709d9Copy full SHA for 54709d9

File tree

1 file changed

+18

-6

lines changed

git/repo
- base.py

1 file changed

+18

-6

lines changed

`‎git/repo/base.py`

Lines changed: 18 additions & 6 deletions

Original file line number	Diff line number	Diff line change
`@@ -9,6 +9,7 @@`
`9`	`9`	`importos`
`10`	`10`	`importre`
`11`	`11`	`importsys`
	`12`	`+importwarnings`
`12`	`13`
`13`	`14`	`fromgit.cmdimport (`
`14`	`15`	`Git,`
`@@ -50,8 +51,11 @@`
`50`	`51`	`__all__= ('Repo',)`
`51`	`52`
`52`	`53`
`53`		`-def_expand_path(p):`
`54`		`-returnosp.normpath(osp.abspath(osp.expandvars(osp.expanduser(p))))`
	`54`	`+def_expand_path(p,unsafe=True):`
	`55`	`+ifunsafe:`
	`56`	`+returnosp.normpath(osp.abspath(osp.expandvars(osp.expanduser(p))))`
	`57`	`+else:`
	`58`	`+returnosp.normpath(osp.abspath(osp.expanduser(p)))`
`55`	`59`
`56`	`60`
`57`	`61`	`classRepo(object):`
`@@ -90,7 +94,7 @@ class Repo(object):`
`90`	`94`	`# Subclasses may easily bring in their own custom types by placing a constructor or type here`
`91`	`95`	`GitCommandWrapperType=Git`
`92`	`96`
`93`		`-def__init__(self,path=None,odbt=DefaultDBType,search_parent_directories=False):`
	`97`	`+def__init__(self,path=None,odbt=DefaultDBType,search_parent_directories=False,unsafe=True):`
`94`	`98`	`"""Create a new Repo instance`
`95`	`99`
`96`	`100`	`:param path:`
`@@ -121,7 +125,10 @@ def __init__(self, path=None, odbt=DefaultDBType, search_parent_directories=Fals`
`121`	`125`	`epath=os.getcwd()`
`122`	`126`	`ifGit.is_cygwin():`
`123`	`127`	`epath=decygpath(epath)`
`124`		`-epath=_expand_path(epathorpathoros.getcwd())`
	`128`	`+ifunsafeand ("%"inepathor"$"inepath):`
	`129`	`+warnings.warn("The use of environment variables in paths is deprecated"`
	`130`	`++"\nfor security reasons and may be removed in the future!!")`
	`131`	`+epath=_expand_path(epathorpathoros.getcwd(),unsafe)`
`125`	`132`	`ifnotos.path.exists(epath):`
`126`	`133`	`raiseNoSuchPathError(epath)`
`127`	`134`
`@@ -148,7 +155,7 @@ def __init__(self, path=None, odbt=DefaultDBType, search_parent_directories=Fals`
`148`	`155`	`sm_gitpath=find_worktree_git_dir(dotgit)`
`149`	`156`
`150`	`157`	`ifsm_gitpathisnotNone:`
`151`		`-self.git_dir=_expand_path(sm_gitpath)`
	`158`	`+self.git_dir=_expand_path(sm_gitpath,unsafe)`
`152`	`159`	`self._working_tree_dir=curpath`
`153`	`160`	`break`
`154`	`161`
`@@ -862,12 +869,17 @@ def init(cls, path=None, mkdir=True, odbt=DefaultDBType, **kwargs):`
`862`	`869`	`the directory containing the database objects, i.e. .git/objects.`
`863`	`870`	`It will be used to access all object data`
`864`	`871`
	`872`	`+ :param unsafe:`
	`873`	`+ if specified, environment variables will not be escaped. This`
	`874`	`+ can lead to information disclosure, allowing attackers to`
	`875`	`+ access the contents of environment variables`
	`876`	`+`
`865`	`877`	`:parm kwargs:`
`866`	`878`	`keyword arguments serving as additional options to the git-init command`
`867`	`879`
`868`	`880`	:return: ``git.Repo`` (the newly created repo)"""
`869`	`881`	`ifpath:`
`870`		`-path=_expand_path(path)`
	`882`	`+path=_expand_path(path,unsafe)`
`871`	`883`	`ifmkdirandpathandnotosp.exists(path):`
`872`	`884`	`os.makedirs(path,0o755)`
`873`	`885`

0 commit comments

Comments

(0)

Movatterモバイル変換

Navigation Menu

Search code, repositories, users, issues, pull requests...

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

Uh oh!

Commit54709d9

File tree

1 file changed

1 file changed

`‎git/repo/base.py`

0 commit comments