From: Johannes Sixt <j.sixt@eudaptics.com>
Date: Wed, 18 Apr 2007 10:36:29 GMT
Subject: Re: [PATCH 1/2] Custom low-level merge driver support.
Message-ID: <4625F4AD.5CDDC502@eudaptics.com>
In-Reply-To: <1176888062865-git-send-email-junkio@cox.net>

Junio C Hamano wrote:
> +       interpolate(cmdbuf, sizeof(cmdbuf), cmd, table, 3);
> +
> +       memset(&child, 0, sizeof(child));
> +       child.argv = args;
> +       args[0] = "sh";
> +       args[1] = "-c";
> +       args[2] = cmdbuf;
> +       args[3] = NULL;

If I read the code correctly, there does not happen any shell quoting
anywhere; hence, this shell invocation is dangerous.

-- Hannes