99import os
1010import re
1111import sys
12+ import warnings
1213
1314from git .cmd import (
1415Git ,
@@ -86,7 +87,7 @@ class Repo(object):
8687# Subclasses may easily bring in their own custom types by placing a constructor or type here
8788GitCommandWrapperType = Git
8889
89- def __init__ (self ,path = None ,odbt = DefaultDBType ,search_parent_directories = False ):
90+ def __init__ (self ,path = None ,odbt = DefaultDBType ,search_parent_directories = False , expand_vars = True ):
9091"""Create a new Repo instance
9192
9293 :param path:
@@ -112,12 +113,18 @@ def __init__(self, path=None, odbt=DefaultDBType, search_parent_directories=Fals
112113 :raise InvalidGitRepositoryError:
113114 :raise NoSuchPathError:
114115 :return: git.Repo """
116+
115117epath = path or os .getenv ('GIT_DIR' )
116118if not epath :
117119epath = os .getcwd ()
118120if Git .is_cygwin ():
119121epath = decygpath (epath )
120- epath = expand_path (epath or path or os .getcwd ())
122+
123+ epath = epath or path or os .getcwd ()
124+ if expand_vars and ("%" in epath or "$" in epath ):
125+ warnings .warn ("The use of environment variables in paths is deprecated" +
126+ "\n for security reasons and may be removed in the future!!" )
127+ epath = expand_path (epath ,expand_vars )
121128if not os .path .exists (epath ):
122129raise NoSuchPathError (epath )
123130
@@ -144,7 +151,7 @@ def __init__(self, path=None, odbt=DefaultDBType, search_parent_directories=Fals
144151sm_gitpath = find_worktree_git_dir (dotgit )
145152
146153if sm_gitpath is not None :
147- self .git_dir = expand_path (sm_gitpath )
154+ self .git_dir = expand_path (sm_gitpath , expand_vars )
148155self ._working_tree_dir = curpath
149156break
150157
@@ -840,7 +847,7 @@ def blame(self, rev, file, incremental=False, **kwargs):
840847return blames
841848
842849@classmethod
843- def init (cls ,path = None ,mkdir = True ,odbt = DefaultDBType ,** kwargs ):
850+ def init (cls ,path = None ,mkdir = True ,odbt = DefaultDBType ,expand_vars = True , ** kwargs ):
844851"""Initialize a git repository at the given path if specified
845852
846853 :param path:
@@ -858,12 +865,17 @@ def init(cls, path=None, mkdir=True, odbt=DefaultDBType, **kwargs):
858865 the directory containing the database objects, i.e. .git/objects.
859866 It will be used to access all object data
860867
868+ :param expand_vars:
869+ if specified, environment variables will not be escaped. This
870+ can lead to information disclosure, allowing attackers to
871+ access the contents of environment variables
872+
861873 :parm kwargs:
862874 keyword arguments serving as additional options to the git-init command
863875
864876 :return: ``git.Repo`` (the newly created repo)"""
865877if path :
866- path = expand_path (path )
878+ path = expand_path (path , expand_vars )
867879if mkdir and path and not osp .exists (path ):
868880os .makedirs (path ,0o755 )
869881