{"thread":{"id":"49332","subject":"Starting subshells via tags","startedAt":"2018-09-12T17:34:55Z","lastAt":"2018-09-12T17:34:55Z","messageCount":1,"participants":["Dave Marotti"],"isPatch":false,"patchVersion":null,"patchTotal":null},"messages":[{"id":"357985","messageId":"CA+5phNzsn8wS39aSLZJDNahxYoBuK3QZX81KWpaSKavssVLREw@mail.gmail.com","threadId":"49332","inReplyTo":null,"subject":"Starting subshells via tags","fromName":"Dave Marotti","fromEmail":"landshark666@gmail.com","sentAt":"2018-09-12T17:34:52Z","receivedAt":"2018-09-12T17:34:55Z","isPatch":false,"sender":{"key":"landshark666@gmail.com","avatar":null},"body":"Hello -\n\nThis is not a git bug or issue. It's just something I stumbled across\nand didn't see any google results for. I thought others would benefit\nfrom being aware of it.\n\nI saw a makefile which included of \"git describe --tags --dirty\" to\ndefine version information for a binary's --version command line\nparameter. The commit/tag information was passed to g++ in a Makefile\nvia:\n\nCXXFLAGS += -DBUILD_COMMIT=\"\\\"$(shell git describe --tags --dirty)\\\"\"\n\nFor fun (on Linux) I made simple c++ program and Makefile with the\nabove CXXFLAGS, and a tag (backticks work too): git tag\n'$(echo>/tmp/test.txt)'\n\nThen built. Make executes the git command via a shell and the shell\nexecutes the subshell. /tmp/test.txt was created.\n\nThe tags themselves don't allow spaces so the complexity of the\ncommand is limited, though I didn't explore what I could do with\nchaining shells or escape characters. It's easy enough to add a script\nto the repository where the tag is located and execute that script\nfrom the tag's subshell with a tag, such as $(./test.sh).\n\nAgain, this is not at all a git issue, git is just used as the\ntransport. As with every other shell attack, it comes down to \"always\nsanitize what you pass through to a shell\". Or don't pass it to the\nshell at all, use another mechanism.\n"}]}