Movatterモバイル変換

[0]ホーム
URL:

Skip to content

Navigation Menu

Sign in
Appearance settings

Search code, repositories, users, issues, pull requests...

Provide feedback

We read every piece of feedback, and take your input very seriously.

Saved searches

Use saved searches to filter your results more quickly

 Sign up
Appearance settings

Commitfbf9c7e

Browse files
committed
Fix command injection
Add `--` in some commands that receive user inputand if interpreted as options could lead to remotecode execution (RCE).There may be more commands that could benefit from `--`so the input is never interpreted as an option,but most of those aren't dangerous.Fixed commands:- push- pull- fetch- clone/clone_from and friends- archive (not sure if this one can be exploited, but it doesn't hurt adding `--` :))For anyone using GitPython and exposing any of the GitPython methods to users,make sure to always validate the input (like if starts with `--`).And for anyone allowing users to pass arbitrary options, be awarethat some options may lead fo RCE, like `--exc`, `--upload-pack`,`--receive-pack`, `--config` (#1516).Ref#1517
1 parent17ff263 commitfbf9c7e

File tree

2 files changed

+5
-3
lines changed

2 files changed

+5
-3
lines changed

‎git/remote.py

Lines changed: 3 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -964,7 +964,7 @@ def fetch(
964964
args= [refspec]
965965

966966
proc=self.repo.git.fetch(
967-
self,*args,as_process=True,with_stdout=False,universal_newlines=True,v=verbose,**kwargs
967+
"--",self,*args,as_process=True,with_stdout=False,universal_newlines=True,v=verbose,**kwargs
968968
)
969969
res=self._get_fetch_info_from_stderr(proc,progress,kill_after_timeout=kill_after_timeout)
970970
ifhasattr(self.repo.odb,"update_cache"):
@@ -991,7 +991,7 @@ def pull(
991991
self._assert_refspec()
992992
kwargs=add_progress(kwargs,self.repo.git,progress)
993993
proc=self.repo.git.pull(
994-
self,refspec,with_stdout=False,as_process=True,universal_newlines=True,v=True,**kwargs
994+
"--",self,refspec,with_stdout=False,as_process=True,universal_newlines=True,v=True,**kwargs
995995
)
996996
res=self._get_fetch_info_from_stderr(proc,progress,kill_after_timeout=kill_after_timeout)
997997
ifhasattr(self.repo.odb,"update_cache"):
@@ -1034,6 +1034,7 @@ def push(
10341034
be 0."""
10351035
kwargs=add_progress(kwargs,self.repo.git,progress)
10361036
proc=self.repo.git.push(
1037+
"--",
10371038
self,
10381039
refspec,
10391040
porcelain=True,

‎git/repo/base.py

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1169,6 +1169,7 @@ def _clone(
11691169
multi=shlex.split(" ".join(multi_options))
11701170
proc=git.clone(
11711171
multi,
1172+
"--",
11721173
Git.polish_url(str(url)),
11731174
clone_path,
11741175
with_extended_output=True,
@@ -1305,7 +1306,7 @@ def archive(
13051306
ifnotisinstance(path, (tuple,list)):
13061307
path= [path]
13071308
# end assure paths is list
1308-
self.git.archive(treeish,*path,**kwargs)
1309+
self.git.archive("--",treeish,*path,**kwargs)
13091310
returnself
13101311

13111312
defhas_separate_working_tree(self)->bool:

0 commit comments

Comments
 (0)
[8]ページ先頭
©2009-2025 Movatter.jp