cvsserver: use safe_pipe_capture instead of backticks
This makes the script pass arguments that are derived from end-user input in safer way when invoking subcommands. Reported-by: joernchen <joernchen@phenoelit.de> Signed-off-by: joernchen <joernchen@phenoelit.de> Signed-off-by: Junio C Hamano <gitster@pobox.com>
joernchen committed
Sep 11, 2017 at 14:45 UTC
27dd73871f814062737c327103ee43f1eb7f30d9
1 file changed
+11
-11
git-cvsserver.perl
+11
-11
@@ -841,7 +841,7 @@ sub req_Modified
841
# Save the file data in $state
842
$state->{entries}{$state->{directory}.$data}{modified_filename} = $filename;
843
$state->{entries}{$state->{directory}.$data}{modified_mode} = $mode;
844
- $state->{entries}{$state->{directory}.$data}{modified_hash} = `git hash-object $filename`;
844
+ $state->{entries}{$state->{directory}.$data}{modified_hash} = safe_pipe_capture('git','hash-object',$filename);
845
$state->{entries}{$state->{directory}.$data}{modified_hash} =~ s/\s.*$//s;
846
847
#$log->debug("req_Modified : file=$data mode=$mode size=$size");
@@ -1463,7 +1463,7 @@ sub req_update
1463
# transmit file, format is single integer on a line by itself (file
1464
# size) followed by the file contents
1465
# TODO : we should copy files in blocks
1466
- my $data = `cat $mergedFile`;
1466
+ my $data = safe_pipe_capture('cat', $mergedFile);
1467
$log->debug("File size : " . length($data));
1468
print length($data) . "\n";
1469
print $data;
@@ -1579,7 +1579,7 @@ sub req_ci
1579
$branchRef = "refs/heads/$stickyInfo->{tag}";
1580
}
1581
1582
- $parenthash = `git show-ref -s $branchRef`;
1582
+ $parenthash = safe_pipe_capture('git', 'show-ref', '-s', $branchRef);
1583
chomp $parenthash;
1584
if ($parenthash !~ /^[0-9a-f]{40}$/)
1585
{
@@ -1704,7 +1704,7 @@ sub req_ci
1704
}
1705
close $msg_fh;
1706
1707
- my $commithash = `git commit-tree $treehash -p $parenthash < $msg_filename`;
1707
+ my $commithash = safe_pipe_capture('git', 'commit-tree', $treehash, '-p', $parenthash, '-F', $msg_filename);
1708
chomp($commithash);
1709
$log->info("Commit hash : $commithash");
1710
@@ -2854,12 +2854,12 @@ sub transmitfile
2854
2855
die "Need filehash" unless ( defined ( $filehash ) and $filehash =~ /^[a-zA-Z0-9]{40}$/ );
2856
2857
- my $type = `git cat-file -t $filehash`;
2857
+ my $type = safe_pipe_capture('git', 'cat-file', '-t', $filehash);
2858
chomp $type;
2859
2860
die ( "Invalid type '$type' (expected 'blob')" ) unless ( defined ( $type ) and $type eq "blob" );
2861
2862
- my $size = `git cat-file -s $filehash`;
2862
+ my $size = safe_pipe_capture('git', 'cat-file', '-s', $filehash);
2863
chomp $size;
2864
2865
$log->debug("transmitfile($filehash) size=$size, type=$type");
@@ -3040,7 +3040,7 @@ sub ensureWorkTree
3040
chdir $work->{emptyDir} or
3041
die "Unable to chdir to $work->{emptyDir}\n";
3042
3043
- my $ver = `git show-ref -s refs/heads/$state->{module}`;
3043
+ my $ver = safe_pipe_capture('git', 'show-ref', '-s', "refs/heads/$state->{module}");
3044
chomp $ver;
3045
if ($ver !~ /^[0-9a-f]{40}$/)
3046
{
@@ -3287,7 +3287,7 @@ sub open_blob_or_die
3287
die "Need filehash\n";
3288
}
3289
3290
- my $type = `git cat-file -t $name`;
3290
+ my $type = safe_pipe_capture('git', 'cat-file', '-t', $name);
3291
chomp $type;
3292
3293
unless ( defined ( $type ) and $type eq "blob" )
@@ -3296,7 +3296,7 @@ sub open_blob_or_die
3296
die ( "Invalid type '$type' (expected 'blob')" )
3297
}
3298
3299
- my $size = `git cat-file -s $name`;
3299
+ my $size = safe_pipe_capture('git', 'cat-file', '-s', $name);
3300
chomp $size;
3301
3302
$log->debug("open_blob_or_die($name) size=$size, type=$type");
@@ -3813,10 +3813,10 @@ sub update
3813
# first lets get the commit list
3814
$ENV{GIT_DIR} = $self->{git_path};
3815
3816
- my $commitsha1 = `git rev-parse $self->{module}`;
3816
+ my $commitsha1 = ::safe_pipe_capture('git', 'rev-parse', $self->{module});
3817
chomp $commitsha1;
3818
3819
- my $commitinfo = `git cat-file commit $self->{module} 2>&1`;
3819
+ my $commitinfo = ::safe_pipe_capture('git', 'cat-file', 'commit', $self->{module});
3820
unless ( $commitinfo =~ /tree\s+[a-zA-Z0-9]{40}/ )
3821
{
3822
die("Invalid module '$self->{module}'");