Revision 6d8684161ee9c03bed5cb69ae76dfdddb85a0003 authored by Johannes Schindelin on 13 September 2019, 14:32:43 UTC, committed by Johannes Schindelin on 05 December 2019, 14:36:51 UTC
We need to be careful to follow proper quoting rules. For example, if an argument contains spaces, we have to quote them. Double-quotes need to be escaped. Backslashes need to be escaped, but only if they are followed by a double-quote character. We need to be _extra_ careful to consider the case where an argument ends in a backslash _and_ needs to be quoted: in this case, we append a double-quote character, i.e. the backslash now has to be escaped! The current code, however, fails to recognize that, and therefore can turn an argument that ends in a single backslash into a quoted argument that now ends in an escaped double-quote character. This allows subsequent command-line parameters to be split and part of them being mistaken for command-line options, e.g. through a maliciously-crafted submodule URL during a recursive clone. Technically, we would not need to quote _all_ arguments which end in a backslash _unless_ the argument needs to be quoted anyway. For example, `test\` would not need to be quoted, while `test \` would need to be. To keep the code simple, however, and therefore easier to reason about and ensure its correctness, we now _always_ quote an argument that ends in a backslash. This addresses CVE-2019-1350. Signed-off-by: Johannes Schindelin <johannes.schindelin@gmx.de>
1 parent a8dee3c
File | Mode | Size |
---|---|---|
expect.beginning-of-file | -rw-r--r-- | 795 bytes |
expect.end-of-file | -rw-r--r-- | 1.1 KB |
expect.move-support-f | -rw-r--r-- | 1.2 KB |
expect.multiple | -rw-r--r-- | 1.6 KB |
expect.multiple-overlapping | -rw-r--r-- | 2.5 KB |
expect.multiple-superset | -rw-r--r-- | 2.5 KB |
expect.parallel-change-f-to-main | -rw-r--r-- | 2.2 KB |
expect.simple-f | -rw-r--r-- | 887 bytes |
expect.simple-f-to-main | -rw-r--r-- | 1.3 KB |
expect.simple-main | -rw-r--r-- | 1.2 KB |
expect.simple-main-to-end | -rw-r--r-- | 1.2 KB |
expect.two-ranges | -rw-r--r-- | 1.6 KB |
expect.vanishes-early | -rw-r--r-- | 773 bytes |
history.export | -rw-r--r-- | 5.1 KB |
![swh spinner](/static/img/swh-spinner.gif)
Computing file changes ...