git/list[1] front-page[2] threads[3] people[4] search[5] about
 

Re: [PATCH] git-quiltimport: fix security risk because of un-sanitized $level.

From
Pierre Habouzit <madcoder@debian.org>
Date
Mar 12, 2008, 22:29 UTC
Message-ID
<20080312222906.GA12800@artemis.madism.org>
In-Reply-To
<7v63vr64rn.fsf@gitster.siamese.dyndns.org>
On Wed, Mar 12, 2008 at 08:55:56PM +0000, Junio C Hamano wrote:
Show 17 quoted lines
> Pierre Habouzit <madcoder@debian.org> writes:
> 
> > Signed-off-by: Pierre Habouzit <madcoder@debian.org>
> > ---
> >
> >   I assume that nobody will have a series with -p1000 in it :)
> >   sorry for this gross mistake in the first place.
> >
> >   [ for the inattentive readers $level was used without quoting, for
> >     good reasons as it's sometime empty and then we don't want to pass
> >     an empty argument to git-apply, though someone could use that to run
> >     arbitrary commands, not nice ]
> 
> A traditional way to deal with that situation in shell scripts is to use
> this idiom:
> 
> 	${var_that_may_not_be_set+"$var_that_may_not_be_set"}
  Oh this is nicer than what I used indeed. My shell scripting skills
are quite limited :)
  Anyways, I happened to notice this stupid mistake when I re-read the
patch you merged. You probably want to use that trick instead (rather
than my poor sanitizing thing), and let git-apply sort out the rest.
-- 
·O·  Pierre Habouzit
··O                                                madcoder@debian.org
OOO                                                http://www.madism.org
Previous: Junio C Hamano
Message 3 of 3 in “git-quiltimport: fix security risk because of un-sanitized $level.”
  1. git-quiltimport: fix security risk because of un-sanitized $level.Pierre Habouzit, Mar 12, 2008
  2. Junio C HamanoMar 12, 2008
  3. Pierre HabouzitMar 12, 2008

Read the whole thread, see it on lore, or plain text.

$ cat FOOTERMessages come from the public archive at lore.kernel.org/git, fetched every hour. The front page is chosen and written each morning by an AI editor and can be wrong; the threads themselves are the record. About and API. For agents: an MCP server at https://gitlist.dev/mcp, and any thread, story or person page as Markdown by adding .md to its URL (or sending Accept: text/markdown). Details in /llms.txt.