threads / discuss / 54172

[gitk] bad quoting of user input for command line injection, with possible unintended side effects

Subject: [gitk] bad quoting of user input for command line injection, with possible unintended side effects

## tl;dr

One message between Sep 1, 2020 and Sep 1, 2020.

replies: 0people: 1as markdown or json

Lyndon Brown· Sep 1, 2020, 20:07 UTC · lore
Hi,

So I pasted the following line (without quotes) into the 'find' textbox of gitk, whilst in 'touching paths' mode, intending to switch to add/remove afterwards.

"*pp_es = (i_es > 0) ? calloc( i_es, sizeof(**pp_es) ) : NULL;"
This results in an error dialog stating the following:
----
can't read output from command: standard output was redirected
can't read output from command: standard output was redirected
    while executing
"open $cmd r+"
    (procedure "do_file_hl" line 28)
    invoked from within
"do_file_hl 46"
    ("after" script)
----

What prompted me to report this at this time (I've encountered and ignored this previously) is that subsequently I switched back to git- gui and refreshed, and was surprised to find that a new empty file had been created called "0)".

Clearly the text has made it into some commandline execution without proper quoting, thus the "> 0)" portion of the text has resulted in creation of the file.

I'm using version 1:2.28.0-1 on Debian.

← back to recent threads