This fixes the path search bug where the current directory is included on Windows, by settingNoDefaultCurrentDirectoryInExePath for the caller. (Setting for the callee env would not work.)

This sets it only on Windows, only for the duration of thePopen call, and then automatically unsets it or restores its old value.

NoDefaultCurrentDirectoryInExePath is documented inNeedCurrentDirectoryForExePathW function (processenv.h). See alsothis SO post by Mofi.

It automatically affects the behavior ofsubprocess.Popen on Windows, due to the wayPopen uses the Windows API. (In contrast, it does not, at least currently on CPython, affect the behavior ofshutil.which. Butshutil.which is not being used to findgit.exe.[Edit: To avoid misleading people who find this by searching, I should mention that,starting in Python 3.12,shutil.which nowchecks this as well.])

I have tested this by naming a hello world programgit.exe and placing it in the current directory, verifying thatimport git produces an expected error (my hello world program does not provide Git operations), then applying this change and verifying thatimport git works as it should.

This comment was marked as resolved.

EliahKagan force-pushed thecve-2023-40590 branch 2 times, most recently from5e77467 to9f1b4bcCompare

August 30, 2023 13:43

FixCVE-2023-40590

6029211

This fixes the path search bug where the current directory isincluded on Windows, by setting NoDefaultCurrentDirectoryInExePathfor the caller. (Setting for the callee env would not work.)This sets it only on Windows, only for the duration of the Popencall, and then automatically unsets it or restores its old value.NoDefaultCurrentDirectoryInExePath is documented at:https://learn.microsoft.com/en-us/windows/win32/api/processenv/nf-processenv-needcurrentdirectoryforexepathwIt automatically affects the behavior of subprocess.Popen onWindows, due to the way Popen uses the Windows API. (In contrast,it does not, at least currently on CPython, affect the behavior ofshutil.which. But shutil.which is not being used to find git.exe.)

EliahKagan force-pushed thecve-2023-40590 branch from9f1b4bc to6029211Compare

August 30, 2023 14:01

Copy link

Member

Byron commentedAug 30, 2023

Thanks a lot!

Could we also have a test for this?

I could imagine that a test could be as simple as dropping agit.exe file into a freshly initialized git repository. When invoking anyrepo.git(…) command, this should fail on windows as it picks up and tries to execute the dummy file. With the fix, it should not fail. For good measure, on linux one can probably create an executable file calledgit instead, which shouldn't be picked up by default.

What do you think?

Copy link

MemberAuthor

EliahKagan commentedAug 30, 2023•
edited
Loading

@Byron Yes, I will add a test.

I think the test could be even simpler. The existing testtest_it_executes_git_to_shell_and_returns_result callsgit.execute directly, and does not have to be run in a git repository. I wouldn't change that test, but a new one like it could be added that temporarily changes directory into a temporary directory with a dummygit.exe (or executablegit on non-Windows systems).

Would that be reasonable, or would you prefer a higher levelrepo.git test?

The other thing that occurs to me is that the test might be considered slightly more robust if it uses a binary file asgit.exe that is actually executable. I'm not sure if this is worthwhile or not. (On Windows,hostname.exe could be copied from the System32 directory asgit.exe to serve this purpose.)

Copy link

MemberAuthor

EliahKagan commentedAug 30, 2023•
edited
Loading

I've added a test, which I've verified locally fails before the fix and passes afterwards, on Windows.~~I have not yet run it on other operating systems, so there may be bugs in my test on that code path that I will have to fix.~~ I have also run it on Ubuntu, where it passes.

I've taken the approach I suggested above. But I'm willing to make any requested changes, including to the specific way you have suggested if you would prefer that.

Add a unit test forCVE-2023-40590

94e0fb0

This adds test_it_executes_git_not_from_cwd to verify that theexecute method does not use "git.exe" in the current directory onWindows, nor "git" in the current directory on Unix-like systems,when those files are executable.It adds a _chdir helper context manager to support this, becausecontextlib.chdir is only available on Python 3.11 and later.

EliahKagan force-pushed thecve-2023-40590 branch fromfd892df to94e0fb0Compare

August 30, 2023 16:08

Byron requested changes

Aug 30, 2023

View reviewed changes

Copy link

Member

Byron left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others.Learn more.

Thanks for the test!

Even though I am a bit uneasy about changing the directory of the test-process, I understand that tests aren't run in parallel so it should be fine for the foreseeable future.

Besides one small nit that hopefully prevents this test to fail with unexpected git versions, this PR is ready to be merged.

Thanks again for your help with this.

test/test_git.py OutdatedShow resolvedHide resolved

Don't check form of version number

7611cd9

This changes the regex in test_it_executes_git_not_from_cwd sothat (unlike test_it_executes_git_to_shell_and_returns_result) itonly checks that the output starts with the words "git version",and not the form of whatever follows those words.

Copy link

xesf commentedAug 31, 2023

Any idea when a patch release can be made with this fix?

Copy link

MemberAuthor

EliahKagan commentedAug 31, 2023

@Byron Is this ready to go?

EliahKagan mentioned this pull request

Aug 31, 2023

CVE-2023-41040: Blind local file inclusion#1638

Closed

Byron merged commit8b75434 intogitpython-developers:main

Sep 1, 2023

Byron added this to thev3.1.33 - Bugfixes milestone

Sep 1, 2023

EliahKagan deleted the cve-2023-40590 branch

September 1, 2023 06:46

Copy link

xesf commentedSep 1, 2023

Thanks guys, I appreciate the promptness.

renovatebot referenced this pull request in allenporter/flux-local

Sep 4, 2023

Update dependency GitPython to v3.1.34 (#320)

6a0c4f9

[![MendRenovate](https://app.renovatebot.com/images/banner.svg)](https://renovatebot.com)This PR contains the following updates:| Package | Change | Age | Adoption | Passing | Confidence ||---|---|---|---|---|---|| [GitPython](https://togithub.com/gitpython-developers/GitPython) |`==3.1.32` -> `==3.1.34` |[![age](https://developer.mend.io/api/mc/badges/age/pypi/GitPython/3.1.34?slim=true)](https://docs.renovatebot.com/merge-confidence/)|[![adoption](https://developer.mend.io/api/mc/badges/adoption/pypi/GitPython/3.1.34?slim=true)](https://docs.renovatebot.com/merge-confidence/)|[![passing](https://developer.mend.io/api/mc/badges/compatibility/pypi/GitPython/3.1.32/3.1.34?slim=true)](https://docs.renovatebot.com/merge-confidence/)|[![confidence](https://developer.mend.io/api/mc/badges/confidence/pypi/GitPython/3.1.32/3.1.34?slim=true)](https://docs.renovatebot.com/merge-confidence/)|---### Release Notes<details><summary>gitpython-developers/GitPython (GitPython)</summary>###[`v3.1.34`](https://togithub.com/gitpython-developers/GitPython/releases/tag/3.1.34):- fix resource leaking[CompareSource](https://togithub.com/gitpython-developers/GitPython/compare/3.1.33...3.1.34)##### What's Changed- util: close lockfile after opening successfully by[@&#8203;skshetry](https://togithub.com/skshetry) in[https://github.com/gitpython-developers/GitPython/pull/1639](https://togithub.com/gitpython-developers/GitPython/pull/1639)##### New Contributors- [@&#8203;skshetry](https://togithub.com/skshetry) made their firstcontribution in[https://github.com/gitpython-developers/GitPython/pull/1639](https://togithub.com/gitpython-developers/GitPython/pull/1639)**Full Changelog**:gitpython-developers/GitPython@3.1.33...3.1.34###[`v3.1.33`](https://togithub.com/gitpython-developers/GitPython/releases/tag/3.1.33):- with security fix[CompareSource](https://togithub.com/gitpython-developers/GitPython/compare/3.1.32...3.1.33)##### What's Changed- WIP Quick doc by [@&#8203;LeoDaCoda](https://togithub.com/LeoDaCoda)in[https://github.com/gitpython-developers/GitPython/pull/1608](https://togithub.com/gitpython-developers/GitPython/pull/1608)- Partial clean up wrt mypy and black by[@&#8203;bodograumann](https://togithub.com/bodograumann) in[https://github.com/gitpython-developers/GitPython/pull/1617](https://togithub.com/gitpython-developers/GitPython/pull/1617)- Disable merge_includes in config writers by[@&#8203;bodograumann](https://togithub.com/bodograumann) in[https://github.com/gitpython-developers/GitPython/pull/1618](https://togithub.com/gitpython-developers/GitPython/pull/1618)- feat: full typing for "progress" parameter in Repo class by[@&#8203;madebylydia](https://togithub.com/madebylydia) in[https://github.com/gitpython-developers/GitPython/pull/1634](https://togithub.com/gitpython-developers/GitPython/pull/1634)- FixCVE-2023-40590 by[@&#8203;EliahKagan](https://togithub.com/EliahKagan) in[https://github.com/gitpython-developers/GitPython/pull/1636](https://togithub.com/gitpython-developers/GitPython/pull/1636)-[#&#8203;1566](https://togithub.com/gitpython-developers/GitPython/issues/1566)Creating a lock now uses python built-in "open()" method to work arou…by [@&#8203;HageMaster3108](https://togithub.com/HageMaster3108) in[https://github.com/gitpython-developers/GitPython/pull/1619](https://togithub.com/gitpython-developers/GitPython/pull/1619)##### New Contributors- [@&#8203;LeoDaCoda](https://togithub.com/LeoDaCoda) made their firstcontribution in[https://github.com/gitpython-developers/GitPython/pull/1608](https://togithub.com/gitpython-developers/GitPython/pull/1608)- [@&#8203;bodograumann](https://togithub.com/bodograumann) made theirfirst contribution in[https://github.com/gitpython-developers/GitPython/pull/1617](https://togithub.com/gitpython-developers/GitPython/pull/1617)- [@&#8203;EliahKagan](https://togithub.com/EliahKagan) made their firstcontribution in[https://github.com/gitpython-developers/GitPython/pull/1636](https://togithub.com/gitpython-developers/GitPython/pull/1636)- [@&#8203;HageMaster3108](https://togithub.com/HageMaster3108) madetheir first contribution in[https://github.com/gitpython-developers/GitPython/pull/1619](https://togithub.com/gitpython-developers/GitPython/pull/1619)**Full Changelog**:gitpython-developers/GitPython@3.1.32...3.1.33</details>---### Configuration📅 **Schedule**: Branch creation - At any time (no schedule defined),Automerge - At any time (no schedule defined).🚦 **Automerge**: Enabled.♻ **Rebasing**: Whenever PR becomes conflicted, or you tick therebase/retry checkbox.🔕 **Ignore**: Close this PR and you won't be reminded about this updateagain.---- [ ] <!-- rebase-check -->If you want to rebase/retry this PR, checkthis box---This PR has been generated by [MendRenovate](https://www.mend.io/free-developer-tools/renovate/). Viewrepository job log[here](https://developer.mend.io/github/allenporter/flux-local).<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiIzNi43OC44IiwidXBkYXRlZEluVmVyIjoiMzYuNzguOCIsInRhcmdldEJyYW5jaCI6Im1haW4ifQ==-->Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>

roskakori mentioned this pull request

Sep 6, 2023

Address CVE-2023-40590roskakori/pygount#126

Closed

1 task

Copy link

xesf commentedSep 7, 2023

Looks like this issue is still present in the 3.1.34 version and has been reported overnight
GHSA-cwvm-v4w8-q58c

Copy link

MemberAuthor

EliahKagan commentedSep 7, 2023

@xesf That's a separate vulnerability,CVE-2023-41040 (#1638,#1644). This PR only fixedCVE-2023-40590 (#1635).

Copy link

xesf commentedSep 7, 2023

Thanks@EliahKagan for the details.

EliahKagan mentioned this pull request

Sep 7, 2023

Fix Windows environment variable upcasing bug#1650

Merged

otc-zuulbot pushed a commit to opentelekomcloud-infra/eyes_on_docs that referenced this pull request

Sep 11, 2023

Bump gitpython from 3.1.32 to 3.1.35 (#32)

0eef04a

Bump gitpython from 3.1.32 to 3.1.35Bumps gitpython from 3.1.32 to 3.1.35.Release notesSourced from gitpython's releases.3.1.35 - a fix forCVE-2023-41040What's ChangedBump actions/checkout from 3 to 4 by @dependabot ingitpython-developers/GitPython#1643Fix 'Tree' object has no attribute '_name' when submodule path is normal path by @CosmosAtlas ingitpython-developers/GitPython#1645FixCVE-2023-41040 by @facutuesca ingitpython-developers/GitPython#1644Only make config more permissive in tests that need it by @EliahKagan ingitpython-developers/GitPython#1648Added test for PR #1645 submodule path by @CosmosAtlas ingitpython-developers/GitPython#1647Fix Windows environment variable upcasing bug by @EliahKagan ingitpython-developers/GitPython#1650New Contributors@CosmosAtlas made their first contribution ingitpython-developers/GitPython#1645@facutuesca made their first contribution ingitpython-developers/GitPython#1644Full Changelog: gitpython-developers/GitPython@3.1.34...3.1.353.1.34 - fix resource leakingWhat's Changedutil: close lockfile after opening successfully by @skshetry ingitpython-developers/GitPython#1639New Contributors@skshetry made their first contribution ingitpython-developers/GitPython#1639Full Changelog: gitpython-developers/GitPython@3.1.33...3.1.34v3.1.33 - with security fixWhat's ChangedWIP Quick doc by @LeoDaCoda ingitpython-developers/GitPython#1608Partial clean up wrt mypy and black by @bodograumann ingitpython-developers/GitPython#1617Disable merge_includes in config writers by @bodograumann ingitpython-developers/GitPython#1618feat: full typing for "progress" parameter in Repo class by @madebylydia ingitpython-developers/GitPython#1634FixCVE-2023-40590 by @EliahKagan ingitpython-developers/GitPython#1636#1566 Creating a lock now uses python built-in "open()" method to work arou… by @HageMaster3108 ingitpython-developers/GitPython#1619New Contributors@LeoDaCoda made their first contribution ingitpython-developers/GitPython#1608@bodograumann made their first contribution ingitpython-developers/GitPython#1617@EliahKagan made their first contribution ingitpython-developers/GitPython#1636@HageMaster3108 made their first contribution ingitpython-developers/GitPython#1619Full Changelog: gitpython-developers/GitPython@3.1.32...3.1.33Commitsc8e303f prepare next release09e1b3d Merge pull request #1650 from EliahKagan/envcase8017421 Merge pull request #1647 from CosmosAtlas/masterfafb4f6 updated docs to better describe testing procedure with new repo9da24d4 add test for submodule path not owned by submodule caseeebdb25 Eliminate duplication of git.util.cwd logicc7fad20 Fix Windows env var upcasing regression7296e5c Make test helper script a file, for readabilityd88372a Add test for Windows env var upcasing regression11839ab Merge pull request #1648 from EliahKagan/file-protocolAdditional commits viewable in compare viewDependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting@dependabot rebase.Dependabot commands and optionsYou can trigger Dependabot actions by commenting on this PR:@dependabot rebase will rebase this PR@dependabot recreate will recreate this PR, overwriting any edits that have been made to it@dependabot merge will merge this PR after your CI passes on it@dependabot squash and merge will squash and merge this PR after your CI passes on it@dependabot cancel merge will cancel a previously requested merge and block automerging@dependabot reopen will reopen this PR if it is closed@dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually@dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency@dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)You can disable automated security fix PRs for this repo from the Security Alerts page.Reviewed-by: Vladimir Vshivkov