{"thread":{"id":"54172","subject":"[gitk] bad quoting of user input for command line injection, with possible unintended side effects","startedAt":"2020-09-01T20:07:38Z","lastAt":"2020-09-01T20:07:38Z","messageCount":1,"participants":["Lyndon Brown"],"isPatch":false,"patchVersion":null,"patchTotal":null},"messages":[{"id":"404877","messageId":"f3253a90491a76e755f0cd7d2b80032e6ea6ac88.camel@gmail.com","threadId":"54172","inReplyTo":null,"subject":"[gitk] bad quoting of user input for command line injection, with possible unintended side effects","fromName":"Lyndon Brown","fromEmail":"jnqnfe@gmail.com","sentAt":"2020-09-01T20:07:29Z","receivedAt":"2020-09-01T20:07:38Z","isPatch":false,"sender":{"key":"jnqnfe@gmail.com","avatar":null},"body":"Hi,\n\nSo I pasted the following line (without quotes) into the 'find' textbox\nof gitk, whilst in 'touching paths' mode, intending to switch to\nadd/remove afterwards.\n\n\"*pp_es = (i_es > 0) ? calloc( i_es, sizeof(**pp_es) ) : NULL;\"\n\nThis results in an error dialog stating the following:\n\n----\ncan't read output from command: standard output was redirected\ncan't read output from command: standard output was redirected\n    while executing\n\"open $cmd r+\"\n    (procedure \"do_file_hl\" line 28)\n    invoked from within\n\"do_file_hl 46\"\n    (\"after\" script)\n----\n\nWhat prompted me to report this at this time (I've encountered and\nignored this previously) is that subsequently I switched back to git-\ngui and refreshed, and was surprised to find that a new empty file had\nbeen created called \"0)\".\n\nClearly the text has made it into some commandline execution without\nproper quoting, thus the \"> 0)\" portion of the text has resulted in\ncreation of the file.\n\nI'm using version 1:2.28.0-1 on Debian.\n\n"}]}