@matheusbsbs / matheus-bagliano / commits / 44e3935d53

git-gui: do not mistake command arguments as redirection operators

Tcl 'open' assigns special meaning to its argument when they begin with redirection, pipe or background operator. There are many calls of the 'open' variant that runs a process which construct arguments that are taken from the Git repository or are user input. However, when file names or ref names are taken from the repository, it is possible to find names that have these special forms. They must not be interpreted by 'open' lest it redirects input or output, or attempts to build a pipeline using a command name controlled by the repository. Use the helper function make_arglist_safe, which identifies such arguments and prepends "./" to force such a name to be regarded as a relative file name. After this change the following 'open' calls that start a process do not apply the argument processing: git-gui.sh:4095: || [catch {set spell_fd [open $spell_cmd r+]} spell_err]} { lib/spellcheck.tcl:47: set pipe_fd [open [list | $s_prog -v] r] lib/spellcheck.tcl:133: _connect $this [open $spell_cmd r+] lib/spellcheck.tcl:405: set fd [open [list | aspell dump dicts] r] In all cases, the command arguments are constant strings (or begin with a constant string) that are of a form that would not be affected by the processing anyway. Signed-off-by: Johannes Sixt <j6t@kdbg.org> Signed-off-by: Taylor Blau <me@ttaylorr.com>

Johannes Sixt committed May 4, 2025 at 21:59 UTC 44e3935d53e3c0b00ff35bea4fcf8e1731ee4f9b
1 file changed +3
git-gui.sh
+3
@@ -600,6 +600,7 @@ proc open_cmd_pipe {cmd path} {
600 } else {
601 set run [list [shellpath] -c "$cmd \"\$0\"" $path]
602 }
603 + set run [make_arglist_safe $run]
604 return [open |$run r]
605 }
606
@@ -636,6 +637,7 @@ proc git_redir {cmd redir} {
637 }
638
639 proc safe_open_command {cmd {redir {}}} {
640 + set cmd [make_arglist_safe $cmd]
641 _trace_exec [concat $cmd $redir]
642 if {[catch {
643 set fd [open [concat [list | ] $cmd $redir] r]
@@ -665,6 +667,7 @@ proc git_read_nice {cmd} {
667 }
668
669 proc git_write {cmd} {
670 + set cmd [make_arglist_safe $cmd]
671 set cmdp [_git_cmd [lindex $cmd 0]]
672 set cmd [lrange $cmd 1 end]
673