Re: [PATCH] git-quiltimport: fix security risk because of un-sanitized $level.

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

 



On Wed, Mar 12, 2008 at 08:55:56PM +0000, Junio C Hamano wrote:
> Pierre Habouzit <madcoder@xxxxxxxxxx> writes:
> 
> > Signed-off-by: Pierre Habouzit <madcoder@xxxxxxxxxx>
> > ---
> >
> >   I assume that nobody will have a series with -p1000 in it :)
> >   sorry for this gross mistake in the first place.
> >
> >   [ for the inattentive readers $level was used without quoting, for
> >     good reasons as it's sometime empty and then we don't want to pass
> >     an empty argument to git-apply, though someone could use that to run
> >     arbitrary commands, not nice ]
> 
> A traditional way to deal with that situation in shell scripts is to use
> this idiom:
> 
> 	${var_that_may_not_be_set+"$var_that_may_not_be_set"}

  Oh this is nicer than what I used indeed. My shell scripting skills
are quite limited :)

  Anyways, I happened to notice this stupid mistake when I re-read the
patch you merged. You probably want to use that trick instead (rather
than my poor sanitizing thing), and let git-apply sort out the rest.
-- 
·O·  Pierre Habouzit
··O                                                madcoder@xxxxxxxxxx
OOO                                                http://www.madism.org

Attachment: pgpgLQsmqrva9.pgp
Description: PGP signature


[Index of Archives]     [Linux Kernel Development]     [Gcc Help]     [IETF Annouce]     [DCCP]     [Netdev]     [Networking]     [Security]     [V4L]     [Bugtraq]     [Yosemite]     [MIPS Linux]     [ARM Linux]     [Linux Security]     [Linux RAID]     [Linux SCSI]     [Fedora Users]

  Powered by Linux