Re: [PATCH] gitk: add user-defined custom commands

From: Junio C Hamano <gitster@pobox.com>
Date: Aug 7, 2026, 22:16 UTC
Message-ID: <xmqq7bm1d1au.fsf@gitster.g>
In-Reply-To: <pull.2371.git.git.1785879839766.gitgitgadget@gmail.com>

"Tim Wiederhake via GitGitGadget" <gitgitgadget@gmail.com> writes:

Show 32 quoted lines

> +    set len [string length $cmd_template]
> +    for {set i 0} {$i < $len} {incr i} {
> +        if {[string index $cmd_template $i] eq "%" && $i + 1 < $len} {
> +            set next [string index $cmd_template [expr {$i + 1}]]
> +            if {!$blame_computed && ($next eq "b" || $next eq "l")} {
> +                set blame [get_blame_origin]
> +                set blame_id [lindex $blame 0]
> +                set blame_line [lindex $blame 1]
> +                set blame_computed 1
> +            }
> +            switch -- $next {
> +                "%" { append cmd "%" }
> +                "i" { append cmd $id }
> +                "t" { append cmd [lindex $commitinfo($id) 0] }
> +                "a" { append cmd [lindex $commitinfo($id) 1] }
> +                "d" { append cmd [lindex $commitinfo($id) 2] }
> +                "c" { append cmd [lindex $commitinfo($id) 3] }
> +                "D" { append cmd [lindex $commitinfo($id) 4] }
> +                "m" { append cmd [lindex $commitinfo($id) 5] }
> +                "M" { if {[info exists markedid]} { append cmd $markedid } }
> +                "b" { append cmd $blame_id }
> +                "f" { append cmd [get_diff_file] }
> +                "l" { append cmd $blame_line }
> +                default { append cmd "%" $next }
> +            }
> +            incr i
> +        } else {
> +            append cmd [string index $cmd_template $i]
> +        }
> +    }
> +
> +    if {[catch {exec sh -c $cmd 2>@1} output]} {

What do various members of $commitinfo field have? I presume that title and message are pretty much free text under control of anybody who can write to the repository and entice you to run this command, so running with "sh -c $cmd" would require $cmd to be quoting the payload properly, or you'd be opening yourself to be an arbitrary command execution, no? With template "echo '%t'" you thought you are just printing the title but if the title has "title?'; echo no'" in it, wouldn't cmd end up being

	echo 'title?'; echo no''

and a more creative type can use something other than "echo no", to have a process run under your name and do more interesting things, right?

Note that I no longer speak Tcl (even though I admit I used to), so if there is some "magic" that makes use of $cmd in {exec sh -c $cmd} safe, the above may be missing the mark by a mile.