git@vger.kernel.org mailing list mirror (one of many)
 help / Atom feed
* Starting subshells via tags
@ 2018-09-12 17:34 Dave Marotti
  0 siblings, 0 replies; 1+ messages in thread
From: Dave Marotti @ 2018-09-12 17:34 UTC (permalink / raw)
  To: git

Hello -

This is not a git bug or issue. It's just something I stumbled across
and didn't see any google results for. I thought others would benefit
from being aware of it.

I saw a makefile which included of "git describe --tags --dirty" to
define version information for a binary's --version command line
parameter. The commit/tag information was passed to g++ in a Makefile
via:

CXXFLAGS += -DBUILD_COMMIT="\"$(shell git describe --tags --dirty)\""

For fun (on Linux) I made simple c++ program and Makefile with the
above CXXFLAGS, and a tag (backticks work too): git tag
'$(echo>/tmp/test.txt)'

Then built. Make executes the git command via a shell and the shell
executes the subshell. /tmp/test.txt was created.

The tags themselves don't allow spaces so the complexity of the
command is limited, though I didn't explore what I could do with
chaining shells or escape characters. It's easy enough to add a script
to the repository where the tag is located and execute that script
from the tag's subshell with a tag, such as $(./test.sh).

Again, this is not at all a git issue, git is just used as the
transport. As with every other shell attack, it comes down to "always
sanitize what you pass through to a shell". Or don't pass it to the
shell at all, use another mechanism.

^ permalink raw reply	[flat|nested] 1+ messages in thread

only message in thread, back to index

Thread overview: (only message) (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2018-09-12 17:34 Starting subshells via tags Dave Marotti

git@vger.kernel.org mailing list mirror (one of many)

Archives are clonable:
	git clone --mirror https://public-inbox.org/git
	git clone --mirror http://ou63pmih66umazou.onion/git
	git clone --mirror http://czquwvybam4bgbro.onion/git
	git clone --mirror http://hjrcffqmbrq6wope.onion/git

Newsgroups are available over NNTP:
	nntp://news.public-inbox.org/inbox.comp.version-control.git
	nntp://ou63pmih66umazou.onion/inbox.comp.version-control.git
	nntp://czquwvybam4bgbro.onion/inbox.comp.version-control.git
	nntp://hjrcffqmbrq6wope.onion/inbox.comp.version-control.git
	nntp://news.gmane.org/gmane.comp.version-control.git

 note: .onion URLs require Tor: https://www.torproject.org/
       or Tor2web: https://www.tor2web.org/

AGPL code for this site: git clone https://public-inbox.org/ public-inbox