git/list[1] front-page[2] threads[3] people[4] search[5] about
 

Re: cvsimport and branches with "(" in the name

From
Jeff King <peff@peff.net>
Date
Apr 30, 2008, 03:31 UTC
Message-ID
<20080430033146.GA28373@sigill.intra.peff.net>
In-Reply-To
<118833cc0804291745m2da2a3bdl21a9440e961afb6@mail.gmail.com>
On Tue, Apr 29, 2008 at 08:45:42PM -0400, Morten Welinder wrote:
Show 5 quoted lines
> >  -       system("git-update-ref $remote/$branch $cid") == 0
> >  +       system('git-update-ref', "$remote/$branch", $cid) == 0
> 
> I hope there are no further such system calls left.  This could run arbitrary
> commands if one was tricked into importing an evil repository.

Yes, even if that doesn't fix his problem, it should still be changed. I have confirmed that it's the only such one in git-cvsimport.

-Peff
Previous: Morten Welinder
Message 4 of 4 in “cvsimport and branches with "(" in the name”
  1. Nigel MagnayApr 29, 2008
  2. Jeff KingApr 29, 2008
  3. Morten WelinderApr 30, 2008
  4. Jeff KingApr 30, 2008

Read the whole thread, see it on lore, or plain text.

$ cat FOOTERMessages come from the public archive at lore.kernel.org/git, fetched every hour. The front page is chosen and written each morning by an AI editor and can be wrong; the threads themselves are the record. About and API. For agents: an MCP server at https://gitlist.dev/mcp, and any thread, story or person page as Markdown by adding .md to its URL (or sending Accept: text/markdown). Details in /llms.txt.