git@vger.kernel.org mailing list mirror (one of many)
 help / color / mirror / code / Atom feed
* Gitview Shell Injection Vulnerability
@ 2016-12-27  8:29 Javantea
  2016-12-27 18:45 ` Stefan Beller
  0 siblings, 1 reply; 8+ messages in thread
From: Javantea @ 2016-12-27  8:29 UTC (permalink / raw)
  To: git

[-- Attachment #1: Type: text/plain, Size: 1570 bytes --]

I have found a shell injection vulnerability in contrib/gitview/gitview.

Gitview Shell Injection Vulnerability

Versions affected: 8cb711c8a5-1d1bdafd64 (<=2.11.0)

Gitview executes shell commands using string concatenation with user supplied data, filenames and branch names. Running Gitview and interacting with the user interface with a malicious filename or branch name in the current repository results in malicious commands being executed as the current user.

AnnotateWindow.add_file_data(self, filename, commit_sha1, line_num):
    fp = os.popen("git cat-file blob " + commit_sha1 +":"+filename)

AnnotateWindow.annotate(self, filename, commit_sha1, line_num):
    fp = os.popen("git ls-tree "+ commit_sha1 + " -- " + filename)
    fp = os.popen("git blame --incremental -C -C -- " + filename + " " + commit_sha1)

GitView.set_branch(self, args):
    fp = os.popen("git rev-parse --sq --default HEAD " + list_to_string(args, 1))
    fp = os.popen("git rev-list  --header --topo-order --parents " + git_rev_list_cmd)

The program also has other uses of os.popen but none use values that the user can manipulate. However, the fix should definitely replace these instances so that the code might one day pass pylint and manual code review easier.

The function os.popen has been replaced by safer functions in the subprocess module. The code can be improved easily because it requires very little change to convert the code to work with arrays of strings instead of strings.

If you have any questions or would like a patch, please let me know.

Regards,
Javantea

^ permalink raw reply	[flat|nested] 8+ messages in thread

end of thread, other threads:[~2017-01-02  6:46 UTC | newest]

Thread overview: 8+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2016-12-27  8:29 Gitview Shell Injection Vulnerability Javantea
2016-12-27 18:45 ` Stefan Beller
2016-12-28  6:42   ` Jeff King
2016-12-28 17:28     ` [PATCH] contrib: remove gitview Stefan Beller
2016-12-29  1:59       ` Jeff King
2017-01-01  0:55         ` Junio C Hamano
2017-01-02  6:46         ` Aneesh Kumar K.V
2016-12-28 19:28     ` Javantea

Code repositories for project(s) associated with this public inbox

	https://80x24.org/mirrors/git.git

This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for read-only IMAP folder(s) and NNTP newsgroup(s).