Re: [SECURITY PATCH] git-prompt.sh: don't put unsanitized branch names in $PS1

From: Junio C Hamano <gitster@pobox.com>
Date: Apr 21, 2014, 22:33 UTC
Message-ID: <xmqq1twq8g91.fsf@gitster.dls.corp.google.com>
In-Reply-To: <xmqq61m28gqj.fsf@gitster.dls.corp.google.com>

Junio C Hamano <gitster@pobox.com> writes:

Show 20 quoted lines

> Richard Hansen <rhansen@bbn.com> writes:
>
>> Both bash and zsh subject the value of PS1 to parameter expansion,
>> command substitution, and arithmetic expansion.  Rather than include
>> the raw, unescaped branch name in PS1 when running in two- or
>> three-argument mode, construct PS1 to reference a variable that holds
>> the branch name.  Because the shells do not recursively expand, this
>> avoids arbitrary code execution by specially-crafted branch names such
>> as '$(IFS=_;cmd=sudo_rm_-rf_/;$cmd)'.
>>
>> Signed-off-by: Richard Hansen <rhansen@bbn.com>
>
> I'd like to see this patch eyeballed by those who have been involved
> in the script (shortlog and blame tells me they are SZEDER and
> Simon, CC'ed), so that we can hopefully merge it by the time -rc1 is
> tagged.
>
> Will queue so that I won't lose it in the meantime.
>
> Thanks.

Sadly, this does not seem to pass t9903.41 for me.

    $ bash t9903-*.sh -i -v

ends with this:

    --- expected    2014-04-21 22:31:46.000000000 +0000
    +++ .../t/trash directory.t9903-bash-prompt/actual  ...
    @@ -1 +1 @@
    -BEFORE: (master):AFTER
    \ No newline at end of file
    +BEFORE: (${__git_ps1_branch_name}):AFTER
    \ No newline at end of file
    not ok 41 - prompt - pc mode