* [gitk] bad quoting of user input for command line injection, with possible unintended side effects
@ 2020-09-01 20:07 Lyndon Brown
0 siblings, 0 replies; only message in thread
From: Lyndon Brown @ 2020-09-01 20:07 UTC (permalink / raw)
To: git
Hi,
So I pasted the following line (without quotes) into the 'find' textbox
of gitk, whilst in 'touching paths' mode, intending to switch to
add/remove afterwards.
"*pp_es = (i_es > 0) ? calloc( i_es, sizeof(**pp_es) ) : NULL;"
This results in an error dialog stating the following:
----
can't read output from command: standard output was redirected
can't read output from command: standard output was redirected
while executing
"open $cmd r+"
(procedure "do_file_hl" line 28)
invoked from within
"do_file_hl 46"
("after" script)
----
What prompted me to report this at this time (I've encountered and
ignored this previously) is that subsequently I switched back to git-
gui and refreshed, and was surprised to find that a new empty file had
been created called "0)".
Clearly the text has made it into some commandline execution without
proper quoting, thus the "> 0)" portion of the text has resulted in
creation of the file.
I'm using version 1:2.28.0-1 on Debian.
^ permalink raw reply [flat|nested] only message in thread
only message in thread, other threads:[~2020-09-01 20:07 UTC | newest]
Thread overview: (only message) (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2020-09-01 20:07 [gitk] bad quoting of user input for command line injection, with possible unintended side effects Lyndon Brown
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).