PR#5481: Separate options and operands in PagureRepo.log() - pagure

pagure

#5481 Separate options and operands in PagureRepo.log()

Merged 11 months ago by wombelix. Opened 11 months ago by wombelix.

wombelix/pagure fix_security_issue_rhbz2277121_argument_injection into master

Separate options and operands in PagureRepo.log()

Thomas Chauchefoin • 11 months ago

affcebf

pagure/lib/repo.py

file modified

		`@@ -149,6 +149,7 @@`
		`cmd = ["git", "log"]`
		`if log_options:`
		`cmd.extend(log_options)`
		`+ cmd.append("--end-of-options")`
		`if fromref:`
		`cmd.append(fromref)`
		`if target:`

wombelix commented 11 months ago

Prevent the injection of additional options to the Git command-line
by adding the (non-standard) --end-of-option flag before any
user-controlled value. This was reachable from view_history_file().

Fixes: rhbz#2277121, 6a1d002 ("Add a method to run git log using the system's git")
Signed-off-by: Thomas Chauchefoin thomas@chauchefoin.fr