# [gitk] bad quoting of user input for command line injection, with possible unintended side effects

1 messages from 2020-09-01 to 2020-09-01. Participants: Lyndon Brown.
Thread: https://gitlist.dev/t/54172

## Lyndon Brown, 2020-09-01 20:07

Subject: [gitk] bad quoting of user input for command line injection, with possible unintended side effects
Message-ID: <f3253a90491a76e755f0cd7d2b80032e6ea6ac88.camel@gmail.com>
URL: https://gitlist.dev/e/f3253a90491a76e755f0cd7d2b80032e6ea6ac88.camel%40gmail.com

```
Hi,

So I pasted the following line (without quotes) into the 'find' textbox
of gitk, whilst in 'touching paths' mode, intending to switch to
add/remove afterwards.

"*pp_es = (i_es > 0) ? calloc( i_es, sizeof(**pp_es) ) : NULL;"

This results in an error dialog stating the following:

----
can't read output from command: standard output was redirected
can't read output from command: standard output was redirected
    while executing
"open $cmd r+"
    (procedure "do_file_hl" line 28)
    invoked from within
"do_file_hl 46"
    ("after" script)
----

What prompted me to report this at this time (I've encountered and
ignored this previously) is that subsequently I switched back to git-
gui and refreshed, and was surprised to find that a new empty file had
been created called "0)".

Clearly the text has made it into some commandline execution without
proper quoting, thus the "> 0)" portion of the text has resulted in
creation of the file.

I'm using version 1:2.28.0-1 on Debian.


```