Movatterモバイル変換

[0]ホーム
URL:

Skip to content

Navigation Menu

Sign in
Appearance settings

Search code, repositories, users, issues, pull requests...

Provide feedback

We read every piece of feedback, and take your input very seriously.

Saved searches

Use saved searches to filter your results more quickly

 Sign up
Appearance settings

Commit94e0fb0

Browse files
committed
Add a unit test forCVE-2023-40590
This adds test_it_executes_git_not_from_cwd to verify that theexecute method does not use "git.exe" in the current directory onWindows, nor "git" in the current directory on Unix-like systems,when those files are executable.It adds a _chdir helper context manager to support this, becausecontextlib.chdir is only available on Python 3.11 and later.
1 parent6029211 commit94e0fb0

File tree

1 file changed

+31
-1
lines changed

1 file changed

+31
-1
lines changed

‎test/test_git.py

Lines changed: 31 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -4,10 +4,12 @@
44
#
55
# This module is part of GitPython and is released under
66
# the BSD License: http://www.opensource.org/licenses/bsd-license.php
7+
importcontextlib
78
importos
9+
importshutil
810
importsubprocess
911
importsys
10-
fromtempfileimportTemporaryFile
12+
fromtempfileimportTemporaryDirectory,TemporaryFile
1113
fromunittestimportmock
1214

1315
fromgitimportGit,refresh,GitCommandError,GitCommandNotFound,Repo,cmd
@@ -20,6 +22,17 @@
2022
fromgit.compatimportis_win
2123

2224

25+
@contextlib.contextmanager
26+
def_chdir(new_dir):
27+
"""Context manager to temporarily change directory. Not reentrant."""
28+
old_dir=os.getcwd()
29+
os.chdir(new_dir)
30+
try:
31+
yield
32+
finally:
33+
os.chdir(old_dir)
34+
35+
2336
classTestGit(TestBase):
2437
@classmethod
2538
defsetUpClass(cls):
@@ -75,6 +88,23 @@ def test_it_transforms_kwargs_into_git_command_arguments(self):
7588
deftest_it_executes_git_to_shell_and_returns_result(self):
7689
self.assertRegex(self.git.execute(["git","version"]),r"^git version [\d\.]{2}.*$")
7790

91+
deftest_it_executes_git_not_from_cwd(self):
92+
withTemporaryDirectory()astmpdir:
93+
ifis_win:
94+
# Copy an actual binary executable that is not git.
95+
other_exe_path=os.path.join(os.getenv("WINDIR"),"system32","hostname.exe")
96+
impostor_path=os.path.join(tmpdir,"git.exe")
97+
shutil.copy(other_exe_path,impostor_path)
98+
else:
99+
# Create a shell script that doesn't do anything.
100+
impostor_path=os.path.join(tmpdir,"git")
101+
withopen(impostor_path,mode="w",encoding="utf-8")asfile:
102+
print("#!/bin/sh",file=file)
103+
os.chmod(impostor_path,0o755)
104+
105+
with_chdir(tmpdir):
106+
self.assertRegex(self.git.execute(["git","version"]),r"^git version [\d\.]{2}.*$")
107+
78108
deftest_it_accepts_stdin(self):
79109
filename=fixture_path("cat_file_blob")
80110
withopen(filename,"r")asfh:

0 commit comments

Comments
 (0)
[8]ページ先頭
©2009-2025 Movatter.jp