From c2e8904258544f3d79dc4e96d1269c0ad8124db3 Mon Sep 17 00:00:00 2001
From: Johannes Sixt <j6t@kdbg.org>
Date: Mon, 21 Apr 2025 17:07:10 +0200
Subject: git-gui: treat file names beginning with "|" as relative paths

The Tcl 'open' function has a very wide interface. It can open files as
well as pipes to external processes. The difference is made only by the
first character of the file name: if it is "|", a process is spawned.

We have a number of calls of Tcl 'open' that take a file name from the
environment in which Git GUI is running. Be prepared that insane values
are injected. In particular, when we intend to open a file, do not take
a file name that happens to begin with "|" as a request to run a process.

Signed-off-by: Johannes Sixt <j6t@kdbg.org>

Signed-off-by: Taylor Blau <me@ttaylorr.com>
---
 lib/diff.tcl | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

(limited to 'lib/diff.tcl')

diff --git a/lib/diff.tcl b/lib/diff.tcl
index 871ad488c2..f089fdc46b 100644
--- a/lib/diff.tcl
+++ b/lib/diff.tcl
@@ -202,7 +202,7 @@ proc show_other_diff {path w m cont_info} {
 					set sz [string length $content]
 				}
 				file {
-					set fd [open $path r]
+					set fd [safe_open_file $path r]
 					fconfigure $fd \
 						-eofchar {} \
 						-encoding [get_path_encoding $path]
-- 
cgit v1.3


From 4f3e0a4bcef2c6caff68f96137d9914c5f2f98c2 Mon Sep 17 00:00:00 2001
From: Johannes Sixt <j6t@kdbg.org>
Date: Mon, 21 Apr 2025 18:14:54 +0200
Subject: git-gui: sanitize 'exec' arguments: simple cases

Tcl 'exec' assigns special meaning to its argument when they begin with
redirection, pipe or background operator. There are a number of
invocations of 'exec' which construct arguments that are taken from the
Git repository or a user input. However, when file names or ref names
are taken from the repository, it is possible to find names that have
these special forms. They must not be interpreted by 'exec' lest it
redirects input or output, or attempts to build a pipeline using a
command name controlled by the repository.

Introduce a helper function that identifies such arguments and prepends
"./" to force such a name to be regarded as a relative file name.

Convert those 'exec' calls where the arguments can simply be packed
into a list.

Note that most commands containing the word 'exec' route through
console::exec or console::chain, which we will treat in another commit.

Signed-off-by: Johannes Sixt <j6t@kdbg.org>

Signed-off-by: Taylor Blau <me@ttaylorr.com>
---
 git-gui.sh       | 42 ++++++++++++++++++++++++++++++++++++------
 lib/diff.tcl     |  2 +-
 lib/shortcut.tcl |  8 ++++----
 lib/win32.tcl    |  9 +++++----
 4 files changed, 46 insertions(+), 15 deletions(-)

(limited to 'lib/diff.tcl')

diff --git a/git-gui.sh b/git-gui.sh
index 52b463c45f..a6be30e295 100755
--- a/git-gui.sh
+++ b/git-gui.sh
@@ -170,7 +170,35 @@ proc open {args} {
 	uplevel 1 real_open $args
 }
 
-# Wrap open to sanitize arguments
+# Wrap exec/open to sanitize arguments
+
+# unsafe arguments begin with redirections or the pipe or background operators
+proc is_arg_unsafe {arg} {
+	regexp {^([<|>&]|2>)} $arg
+}
+
+proc make_arg_safe {arg} {
+	if {[is_arg_unsafe $arg]} {
+		set arg [file join . $arg]
+	}
+	return $arg
+}
+
+proc make_arglist_safe {arglist} {
+	set res {}
+	foreach arg $arglist {
+		lappend res [make_arg_safe $arg]
+	}
+	return $res
+}
+
+# executes one command
+# no redirections or pipelines are possible
+# cmd is a list that specifies the command and its arguments
+# calls `exec` and returns its value
+proc safe_exec {cmd} {
+	eval exec [make_arglist_safe $cmd]
+}
 
 proc safe_open_file {filename flags} {
 	# a file name starting with "|" would attempt to run a process
@@ -182,6 +210,8 @@ proc safe_open_file {filename flags} {
 	open $filename $flags
 }
 
+# End exec/open wrappers
+
 ######################################################################
 ##
 ## locate our library
@@ -282,11 +312,11 @@ unset oguimsg
 
 if {[tk windowingsystem] eq "aqua"} {
 	catch {
-		exec osascript -e [format {
+		safe_exec [list osascript -e [format {
 			tell application "System Events"
 				set frontmost of processes whose unix id is %d to true
 			end tell
-		} [pid]]
+		} [pid]]]
 	}
 }
 
@@ -571,7 +601,7 @@ proc _lappend_nice {cmd_var} {
 
 	if {![info exists _nice]} {
 		set _nice [_which nice]
-		if {[catch {exec $_nice git version}]} {
+		if {[catch {safe_exec [list $_nice git version]}]} {
 			set _nice {}
 		} elseif {[is_Windows] && [file dirname $_nice] ne [file dirname $::_git]} {
 			set _nice {}
@@ -667,9 +697,9 @@ proc kill_file_process {fd} {
 
 	catch {
 		if {[is_Windows]} {
-			exec taskkill /pid $process
+			safe_exec [list taskkill /pid $process]
 		} else {
-			exec kill $process
+			safe_exec [list kill $process]
 		}
 	}
 }
diff --git a/lib/diff.tcl b/lib/diff.tcl
index f089fdc46b..cfa8a414d3 100644
--- a/lib/diff.tcl
+++ b/lib/diff.tcl
@@ -226,7 +226,7 @@ proc show_other_diff {path w m cont_info} {
 			$ui_diff insert end \
 				"* [mc "Git Repository (subproject)"]\n" \
 				d_info
-		} elseif {![catch {set type [exec file $path]}]} {
+		} elseif {![catch {set type [safe_exec [list file $path]]}]} {
 			set n [string length $path]
 			if {[string equal -length $n $path $type]} {
 				set type [string range $type $n end]
diff --git a/lib/shortcut.tcl b/lib/shortcut.tcl
index 9be79b2e89..d437ea6933 100644
--- a/lib/shortcut.tcl
+++ b/lib/shortcut.tcl
@@ -30,8 +30,8 @@ proc do_cygwin_shortcut {} {
 	global argv0 _gitworktree oguilib
 
 	if {[catch {
-		set desktop [exec cygpath \
-			--desktop]
+		set desktop [safe_exec [list cygpath \
+			--desktop]]
 		}]} {
 			set desktop .
 	}
@@ -50,14 +50,14 @@ proc do_cygwin_shortcut {} {
 					"CHERE_INVOKING=1 \
 					source /etc/profile; \
 					git gui"}
-				exec /bin/mkshortcut.exe \
+				safe_exec [list /bin/mkshortcut.exe \
 					--arguments $shargs \
 					--desc "git-gui on $repodir" \
 					--icon $oguilib/git-gui.ico \
 					--name $fn \
 					--show min \
 					--workingdir $repodir \
-					/bin/sh.exe
+					/bin/sh.exe]
 			} err]} {
 			error_popup [strcat [mc "Cannot write shortcut:"] "\n\n$err"]
 		}
diff --git a/lib/win32.tcl b/lib/win32.tcl
index db91ab84a5..3aedae2f13 100644
--- a/lib/win32.tcl
+++ b/lib/win32.tcl
@@ -2,11 +2,11 @@
 # Copyright (C) 2007 Shawn Pearce
 
 proc win32_read_lnk {lnk_path} {
-	return [exec cscript.exe \
+	return [safe_exec [list cscript.exe \
 		/E:jscript \
 		/nologo \
 		[file join $::oguilib win32_shortcut.js] \
-		$lnk_path]
+		$lnk_path]]
 }
 
 proc win32_create_lnk {lnk_path lnk_exec lnk_dir} {
@@ -15,12 +15,13 @@ proc win32_create_lnk {lnk_path lnk_exec lnk_dir} {
 	set lnk_args [lrange $lnk_exec 1 end]
 	set lnk_exec [lindex $lnk_exec 0]
 
-	eval [list exec wscript.exe \
+	set cmd [list wscript.exe \
 		/E:jscript \
 		/nologo \
 		[file nativename [file join $oguilib win32_shortcut.js]] \
 		$lnk_path \
 		[file nativename [file join $oguilib git-gui.ico]] \
 		$lnk_dir \
-		$lnk_exec] $lnk_args
+		$lnk_exec]
+	safe_exec [concat $cmd $lnk_args]
 }
-- 
cgit v1.3


From aa42e87ef4ee9d84bd2fdb5e56de2ac2b61575d9 Mon Sep 17 00:00:00 2001
From: Johannes Sixt <j6t@kdbg.org>
Date: Sat, 3 May 2025 13:11:21 +0200
Subject: git-gui: break out a separate function git_read_nice

There are two callers of git_read that request special treatment using
option --nice. Rewrite them to call a new function git_read_nice that
does the special treatment. Now we can remove all option treatment from
git_read.

git_write has the same capability, but there are no callers that
request --nice. Remove the feature without substitution.

This is a preparation for a later change where we want to make git_read
and friends non-variadic. Then it cannot have optional arguments.

Signed-off-by: Johannes Sixt <j6t@kdbg.org>

Signed-off-by: Taylor Blau <me@ttaylorr.com>
---
 git-gui.sh    | 41 +++++++++--------------------------------
 lib/blame.tcl |  2 +-
 lib/diff.tcl  |  2 +-
 3 files changed, 11 insertions(+), 34 deletions(-)

(limited to 'lib/diff.tcl')

diff --git a/git-gui.sh b/git-gui.sh
index 890a172fc4..28113220af 100755
--- a/git-gui.sh
+++ b/git-gui.sh
@@ -643,22 +643,16 @@ proc _open_stdout_stderr {cmd} {
 }
 
 proc git_read {args} {
-	set opt [list]
-
-	while {1} {
-		switch -- [lindex $args 0] {
-		--nice {
-			_lappend_nice opt
-		}
+	set cmdp [_git_cmd [lindex $args 0]]
+	set args [lrange $args 1 end]
 
-		default {
-			break
-		}
+	return [_open_stdout_stderr [concat $cmdp $args]]
+}
 
-		}
+proc git_read_nice {args} {
+	set opt [list]
 
-		set args [lrange $args 1 end]
-	}
+	_lappend_nice opt
 
 	set cmdp [_git_cmd [lindex $args 0]]
 	set args [lrange $args 1 end]
@@ -667,28 +661,11 @@ proc git_read {args} {
 }
 
 proc git_write {args} {
-	set opt [list]
-
-	while {1} {
-		switch -- [lindex $args 0] {
-		--nice {
-			_lappend_nice opt
-		}
-
-		default {
-			break
-		}
-
-		}
-
-		set args [lrange $args 1 end]
-	}
-
 	set cmdp [_git_cmd [lindex $args 0]]
 	set args [lrange $args 1 end]
 
-	_trace_exec [concat $opt $cmdp $args]
-	return [open [concat [list | ] $opt $cmdp $args] w]
+	_trace_exec [concat $cmdp $args]
+	return [open [concat [list | ] $cmdp $args] w]
 }
 
 proc githook_read {hook_name args} {
diff --git a/lib/blame.tcl b/lib/blame.tcl
index e70a079fa7..ceb2330266 100644
--- a/lib/blame.tcl
+++ b/lib/blame.tcl
@@ -617,7 +617,7 @@ method _exec_blame {cur_w cur_d options cur_s} {
 	}
 
 	lappend options -- $path
-	set fd [eval git_read --nice blame $options]
+	set fd [eval git_read_nice blame $options]
 	fconfigure $fd -blocking 0 -translation lf -encoding utf-8
 	fileevent $fd readable [cb _read_blame $fd $cur_w $cur_d]
 	set current_fd $fd
diff --git a/lib/diff.tcl b/lib/diff.tcl
index cfa8a414d3..ce1bad6900 100644
--- a/lib/diff.tcl
+++ b/lib/diff.tcl
@@ -338,7 +338,7 @@ proc start_show_diff {cont_info {add_opts {}}} {
 		}
 	}
 
-	if {[catch {set fd [eval git_read --nice $cmd]} err]} {
+	if {[catch {set fd [eval git_read_nice $cmd]} err]} {
 		set diff_active 0
 		unlock_index
 		ui_status [mc "Unable to display %s" [escape_path $path]]
-- 
cgit v1.3


From dc9ecb1aab1a3438fceeb44db67ddf8e8d938324 Mon Sep 17 00:00:00 2001
From: Johannes Sixt <j6t@kdbg.org>
Date: Sat, 3 May 2025 13:24:48 +0200
Subject: git-gui: convert git_read*, git_write to be non-variadic

We are going to treat command arguments and redirections differently to
avoid passing arguments that look like redirections to the command
accidentally. To do so, it will be necessary to know which arguments
are intentional redirections. As a preparation, convert git_read,
git_read_nice, and git_write to take just a single argument that is
the command in a list. Adjust all call sites accordingly.

In the future, this argument will be the regular command arguments and
a second argument will be the redirection operations.

Signed-off-by: Johannes Sixt <j6t@kdbg.org>

Signed-off-by: Taylor Blau <me@ttaylorr.com>
---
 git-gui.sh                   | 48 ++++++++++++++++++++++----------------------
 lib/blame.tcl                | 10 ++++-----
 lib/branch.tcl               |  6 +++---
 lib/browser.tcl              |  2 +-
 lib/checkout_op.tcl          | 10 ++++-----
 lib/choose_repository.tcl    |  8 ++++----
 lib/choose_rev.tcl           |  6 +++---
 lib/commit.tcl               |  6 +++---
 lib/console.tcl              |  2 +-
 lib/database.tcl             |  2 +-
 lib/diff.tcl                 |  8 ++++----
 lib/index.tcl                |  8 ++++----
 lib/merge.tcl                |  2 +-
 lib/mergetool.tcl            |  2 +-
 lib/remote.tcl               |  2 +-
 lib/remote_branch_delete.tcl |  2 +-
 16 files changed, 62 insertions(+), 62 deletions(-)

(limited to 'lib/diff.tcl')

diff --git a/git-gui.sh b/git-gui.sh
index e10bf2a039..301c7647ec 100755
--- a/git-gui.sh
+++ b/git-gui.sh
@@ -621,7 +621,7 @@ proc _lappend_nice {cmd_var} {
 }
 
 proc git {args} {
-	set fd [eval [list git_read] $args]
+	set fd [git_read $args]
 	fconfigure $fd -translation binary -encoding utf-8
 	set result [string trimright [read $fd] "\n"]
 	close $fd
@@ -642,34 +642,34 @@ proc _open_stdout_stderr {cmd} {
 	return $fd
 }
 
-proc git_read {args} {
-	set cmdp [_git_cmd [lindex $args 0]]
-	set args [lrange $args 1 end]
+proc git_read {cmd} {
+	set cmdp [_git_cmd [lindex $cmd 0]]
+	set cmd [lrange $cmd 1 end]
 
-	return [_open_stdout_stderr [concat $cmdp $args]]
+	return [_open_stdout_stderr [concat $cmdp $cmd]]
 }
 
-proc git_read_nice {args} {
+proc git_read_nice {cmd} {
 	set opt [list]
 
 	_lappend_nice opt
 
-	set cmdp [_git_cmd [lindex $args 0]]
-	set args [lrange $args 1 end]
+	set cmdp [_git_cmd [lindex $cmd 0]]
+	set cmd [lrange $cmd 1 end]
 
-	return [_open_stdout_stderr [concat $opt $cmdp $args]]
+	return [_open_stdout_stderr [concat $opt $cmdp $cmd]]
 }
 
-proc git_write {args} {
-	set cmdp [_git_cmd [lindex $args 0]]
-	set args [lrange $args 1 end]
+proc git_write {cmd} {
+	set cmdp [_git_cmd [lindex $cmd 0]]
+	set cmd [lrange $cmd 1 end]
 
-	_trace_exec [concat $cmdp $args]
-	return [open [concat [list | ] $cmdp $args] w]
+	_trace_exec [concat $cmdp $cmd]
+	return [open [concat [list | ] $cmdp $cmd] w]
 }
 
 proc githook_read {hook_name args} {
-	git_read hook run --ignore-missing $hook_name -- $args 2>@1
+	git_read [concat [list hook run --ignore-missing $hook_name --] $args 2>@1]
 }
 
 proc kill_file_process {fd} {
@@ -1110,10 +1110,10 @@ proc _parse_config {arr_name args} {
 	array unset arr
 	set buf {}
 	catch {
-		set fd_rc [eval \
-			[list git_read config] \
+		set fd_rc [git_read \
+			[concat config \
 			$args \
-			[list --null --list]]
+			--null --list]]
 		fconfigure $fd_rc -translation binary -encoding utf-8
 		set buf [read $fd_rc]
 		close $fd_rc
@@ -1482,12 +1482,12 @@ proc rescan {after {honor_trustmtime 1}} {
 	} else {
 		set rescan_active 1
 		ui_status [mc "Refreshing file status..."]
-		set fd_rf [git_read update-index \
+		set fd_rf [git_read [list update-index \
 			-q \
 			--unmerged \
 			--ignore-missing \
 			--refresh \
-			]
+			]]
 		fconfigure $fd_rf -blocking 0 -translation binary
 		fileevent $fd_rf readable \
 			[list rescan_stage2 $fd_rf $after]
@@ -1527,11 +1527,11 @@ proc rescan_stage2 {fd after} {
 	set rescan_active 2
 	ui_status [mc "Scanning for modified files ..."]
 	if {[git-version >= "1.7.2"]} {
-		set fd_di [git_read diff-index --cached --ignore-submodules=dirty -z [PARENT]]
+		set fd_di [git_read [list diff-index --cached --ignore-submodules=dirty -z [PARENT]]]
 	} else {
-		set fd_di [git_read diff-index --cached -z [PARENT]]
+		set fd_di [git_read [list diff-index --cached -z [PARENT]]]
 	}
-	set fd_df [git_read diff-files -z]
+	set fd_df [git_read [list diff-files -z]]
 
 	fconfigure $fd_di -blocking 0 -translation binary -encoding binary
 	fconfigure $fd_df -blocking 0 -translation binary -encoding binary
@@ -1540,7 +1540,7 @@ proc rescan_stage2 {fd after} {
 	fileevent $fd_df readable [list read_diff_files $fd_df $after]
 
 	if {[is_config_true gui.displayuntracked]} {
-		set fd_lo [eval git_read ls-files --others -z $ls_others]
+		set fd_lo [git_read [concat ls-files --others -z $ls_others]]
 		fconfigure $fd_lo -blocking 0 -translation binary -encoding binary
 		fileevent $fd_lo readable [list read_ls_others $fd_lo $after]
 		incr rescan_active
diff --git a/lib/blame.tcl b/lib/blame.tcl
index ceb2330266..d6fd8bea91 100644
--- a/lib/blame.tcl
+++ b/lib/blame.tcl
@@ -486,9 +486,9 @@ method _load {jump} {
 		fconfigure $fd -eofchar {}
 	} else {
 		if {$do_textconv ne 0} {
-			set fd [git_read cat-file --textconv "$commit:$path"]
+			set fd [git_read [list cat-file --textconv "$commit:$path"]]
 		} else {
-			set fd [git_read cat-file blob "$commit:$path"]
+			set fd [git_read [list cat-file blob "$commit:$path"]]
 		}
 	}
 	fconfigure $fd \
@@ -617,7 +617,7 @@ method _exec_blame {cur_w cur_d options cur_s} {
 	}
 
 	lappend options -- $path
-	set fd [eval git_read_nice blame $options]
+	set fd [git_read_nice [concat blame $options]]
 	fconfigure $fd -blocking 0 -translation lf -encoding utf-8
 	fileevent $fd readable [cb _read_blame $fd $cur_w $cur_d]
 	set current_fd $fd
@@ -986,7 +986,7 @@ method _showcommit {cur_w lno} {
 		if {[catch {set msg $header($cmit,message)}]} {
 			set msg {}
 			catch {
-				set fd [git_read cat-file commit $cmit]
+				set fd [git_read [list cat-file commit $cmit]]
 				fconfigure $fd -encoding binary -translation lf
 				# By default commits are assumed to be in utf-8
 				set enc utf-8
@@ -1134,7 +1134,7 @@ method _blameparent {} {
 		} else {
 			set diffcmd [list diff-tree --unified=0 $cparent $cmit -- $new_path]
 		}
-		if {[catch {set fd [eval git_read $diffcmd]} err]} {
+		if {[catch {set fd [git_read $diffcmd]} err]} {
 			$status_operation stop [mc "Unable to display parent"]
 			error_popup [strcat [mc "Error loading diff:"] "\n\n$err"]
 			return
diff --git a/lib/branch.tcl b/lib/branch.tcl
index 8b0c485889..39e0f2dc98 100644
--- a/lib/branch.tcl
+++ b/lib/branch.tcl
@@ -7,7 +7,7 @@ proc load_all_heads {} {
 	set rh refs/heads
 	set rh_len [expr {[string length $rh] + 1}]
 	set all_heads [list]
-	set fd [git_read for-each-ref --format=%(refname) $rh]
+	set fd [git_read [list for-each-ref --format=%(refname) $rh]]
 	fconfigure $fd -translation binary -encoding utf-8
 	while {[gets $fd line] > 0} {
 		if {!$some_heads_tracking || ![is_tracking_branch $line]} {
@@ -21,10 +21,10 @@ proc load_all_heads {} {
 
 proc load_all_tags {} {
 	set all_tags [list]
-	set fd [git_read for-each-ref \
+	set fd [git_read [list for-each-ref \
 		--sort=-taggerdate \
 		--format=%(refname) \
-		refs/tags]
+		refs/tags]]
 	fconfigure $fd -translation binary -encoding utf-8
 	while {[gets $fd line] > 0} {
 		if {![regsub ^refs/tags/ $line {} name]} continue
diff --git a/lib/browser.tcl b/lib/browser.tcl
index a982983667..6fc8d4d637 100644
--- a/lib/browser.tcl
+++ b/lib/browser.tcl
@@ -196,7 +196,7 @@ method _ls {tree_id {name {}}} {
 	lappend browser_stack [list $tree_id $name]
 	$w conf -state disabled
 
-	set fd [git_read ls-tree -z $tree_id]
+	set fd [git_read [list ls-tree -z $tree_id]]
 	fconfigure $fd -blocking 0 -translation binary -encoding utf-8
 	fileevent $fd readable [cb _read $fd]
 }
diff --git a/lib/checkout_op.tcl b/lib/checkout_op.tcl
index 31992f461b..48fd1a3cac 100644
--- a/lib/checkout_op.tcl
+++ b/lib/checkout_op.tcl
@@ -304,12 +304,12 @@ The rescan will be automatically started now.
 		_readtree $this
 	} else {
 		ui_status [mc "Refreshing file status..."]
-		set fd [git_read update-index \
+		set fd [git_read [list update-index \
 			-q \
 			--unmerged \
 			--ignore-missing \
 			--refresh \
-			]
+			]]
 		fconfigure $fd -blocking 0 -translation binary
 		fileevent $fd readable [cb _refresh_wait $fd]
 	}
@@ -345,7 +345,7 @@ method _readtree {} {
 		[mc "Updating working directory to '%s'..." [_name $this]] \
 		[mc "files checked out"]]
 
-	set fd [git_read read-tree \
+	set fd [git_read [list read-tree \
 		-m \
 		-u \
 		-v \
@@ -353,7 +353,7 @@ method _readtree {} {
 		$HEAD \
 		$new_hash \
 		2>@1 \
-		]
+		]]
 	fconfigure $fd -blocking 0 -translation binary
 	fileevent $fd readable [cb _readtree_wait $fd $status_bar_operation]
 }
@@ -573,7 +573,7 @@ method _confirm_reset {cur} {
 	pack $w.buttons.cancel -side right -padx 5
 	pack $w.buttons -side bottom -fill x -pady 10 -padx 10
 
-	set fd [git_read rev-list --pretty=oneline $cur ^$new_hash]
+	set fd [git_read [list rev-list --pretty=oneline $cur ^$new_hash]]
 	while {[gets $fd line] > 0} {
 		set abbr [string range $line 0 7]
 		set subj [string range $line 41 end]
diff --git a/lib/choose_repository.tcl b/lib/choose_repository.tcl
index 7bd738e51e..7b64a11239 100644
--- a/lib/choose_repository.tcl
+++ b/lib/choose_repository.tcl
@@ -818,9 +818,9 @@ method _clone_refs {} {
 		error_popup [mc "Not a Git repository: %s" [file tail $origin_url]]
 		return 0
 	}
-	set fd_in [git_read for-each-ref \
+	set fd_in [git_read [list for-each-ref \
 		--tcl \
-		{--format=list %(refname) %(objectname) %(*objectname)}]
+		{--format=list %(refname) %(objectname) %(*objectname)}]]
 	cd $pwd
 
 	set fd [safe_open_file [gitdir packed-refs] w]
@@ -953,14 +953,14 @@ method _do_clone_checkout {HEAD} {
 		[mc "files"]]
 
 	set readtree_err {}
-	set fd [git_read read-tree \
+	set fd [git_read [list read-tree \
 		-m \
 		-u \
 		-v \
 		HEAD \
 		HEAD \
 		2>@1 \
-		]
+		]]
 	fconfigure $fd -blocking 0 -translation binary
 	fileevent $fd readable [cb _readtree_wait $fd]
 }
diff --git a/lib/choose_rev.tcl b/lib/choose_rev.tcl
index 7cf9e160fa..8ae7e8a5c4 100644
--- a/lib/choose_rev.tcl
+++ b/lib/choose_rev.tcl
@@ -146,14 +146,14 @@ constructor _new {path unmerged_only title} {
 	append fmt { %(*subject)}
 	append fmt {]}
 	set all_refn [list]
-	set fr_fd [git_read for-each-ref \
+	set fr_fd [git_read [list for-each-ref \
 		--tcl \
 		--sort=-taggerdate \
 		--format=$fmt \
 		refs/heads \
 		refs/remotes \
 		refs/tags \
-		]
+		]]
 	fconfigure $fr_fd -translation lf -encoding utf-8
 	while {[gets $fr_fd line] > 0} {
 		set line [eval $line]
@@ -176,7 +176,7 @@ constructor _new {path unmerged_only title} {
 	close $fr_fd
 
 	if {$unmerged_only} {
-		set fr_fd [git_read rev-list --all ^$::HEAD]
+		set fr_fd [git_read [list rev-list --all ^$::HEAD]]
 		while {[gets $fr_fd sha1] > 0} {
 			if {[catch {set rlst $cmt_refn($sha1)}]} continue
 			foreach refn $rlst {
diff --git a/lib/commit.tcl b/lib/commit.tcl
index 8d135845a5..b27e37d385 100644
--- a/lib/commit.tcl
+++ b/lib/commit.tcl
@@ -27,7 +27,7 @@ You are currently in the middle of a merge that has not been fully completed.  Y
 	if {[catch {
 			set name ""
 			set email ""
-			set fd [git_read cat-file commit $curHEAD]
+			set fd [git_read [list cat-file commit $curHEAD]]
 			fconfigure $fd -encoding binary -translation lf
 			# By default commits are assumed to be in utf-8
 			set enc utf-8
@@ -325,7 +325,7 @@ proc commit_commitmsg_wait {fd_ph curHEAD msg_p} {
 
 proc commit_writetree {curHEAD msg_p} {
 	ui_status [mc "Committing changes..."]
-	set fd_wt [git_read write-tree]
+	set fd_wt [git_read [list write-tree]]
 	fileevent $fd_wt readable \
 		[list commit_committree $fd_wt $curHEAD $msg_p]
 }
@@ -350,7 +350,7 @@ proc commit_committree {fd_wt curHEAD msg_p} {
 	# -- Verify this wasn't an empty change.
 	#
 	if {$commit_type eq {normal}} {
-		set fd_ot [git_read cat-file commit $PARENT]
+		set fd_ot [git_read [list cat-file commit $PARENT]]
 		fconfigure $fd_ot -encoding binary -translation lf
 		set old_tree [gets $fd_ot]
 		close $fd_ot
diff --git a/lib/console.tcl b/lib/console.tcl
index c7f20b87cb..44dcdf29be 100644
--- a/lib/console.tcl
+++ b/lib/console.tcl
@@ -93,7 +93,7 @@ method _init {} {
 method exec {cmd {after {}}} {
 	lappend cmd 2>@1
 	if {[lindex $cmd 0] eq {git}} {
-		set fd_f [eval git_read [lrange $cmd 1 end]]
+		set fd_f [git_read [lrange $cmd 1 end]]
 	} else {
 		set fd_f [_open_stdout_stderr $cmd]
 	}
diff --git a/lib/database.tcl b/lib/database.tcl
index 85783081e0..1fc0ea00b3 100644
--- a/lib/database.tcl
+++ b/lib/database.tcl
@@ -3,7 +3,7 @@
 
 proc do_stats {} {
 	global use_ttk NS
-	set fd [git_read count-objects -v]
+	set fd [git_read [list count-objects -v]]
 	while {[gets $fd line] > 0} {
 		if {[regexp {^([^:]+): (\d+)$} $line _ name value]} {
 			set stats($name) $value
diff --git a/lib/diff.tcl b/lib/diff.tcl
index ce1bad6900..8ec740eb50 100644
--- a/lib/diff.tcl
+++ b/lib/diff.tcl
@@ -338,7 +338,7 @@ proc start_show_diff {cont_info {add_opts {}}} {
 		}
 	}
 
-	if {[catch {set fd [eval git_read_nice $cmd]} err]} {
+	if {[catch {set fd [git_read_nice $cmd]} err]} {
 		set diff_active 0
 		unlock_index
 		ui_status [mc "Unable to display %s" [escape_path $path]]
@@ -617,7 +617,7 @@ proc apply_or_revert_hunk {x y revert} {
 
 	if {[catch {
 		set enc [get_path_encoding $current_diff_path]
-		set p [eval git_write $apply_cmd]
+		set p [git_write $apply_cmd]
 		fconfigure $p -translation binary -encoding $enc
 		puts -nonewline $p $wholepatch
 		close $p} err]} {
@@ -853,7 +853,7 @@ proc apply_or_revert_range_or_line {x y revert} {
 
 	if {[catch {
 		set enc [get_path_encoding $current_diff_path]
-		set p [eval git_write $apply_cmd]
+		set p [git_write $apply_cmd]
 		fconfigure $p -translation binary -encoding $enc
 		puts -nonewline $p $current_diff_header
 		puts -nonewline $p $wholepatch
@@ -890,7 +890,7 @@ proc undo_last_revert {} {
 
 	if {[catch {
 		set enc $last_revert_enc
-		set p [eval git_write $apply_cmd]
+		set p [git_write $apply_cmd]
 		fconfigure $p -translation binary -encoding $enc
 		puts -nonewline $p $last_revert
 		close $p} err]} {
diff --git a/lib/index.tcl b/lib/index.tcl
index d2ec24bd80..857864ff2b 100644
--- a/lib/index.tcl
+++ b/lib/index.tcl
@@ -75,7 +75,7 @@ proc update_indexinfo {msg path_list after} {
 	if {$batch > 25} {set batch 25}
 
 	set status_bar_operation [$::main_status start $msg [mc "files"]]
-	set fd [git_write update-index -z --index-info]
+	set fd [git_write [list update-index -z --index-info]]
 	fconfigure $fd \
 		-blocking 0 \
 		-buffering full \
@@ -144,7 +144,7 @@ proc update_index {msg path_list after} {
 	if {$batch > 25} {set batch 25}
 
 	set status_bar_operation [$::main_status start $msg [mc "files"]]
-	set fd [git_write update-index --add --remove -z --stdin]
+	set fd [git_write [list update-index --add --remove -z --stdin]]
 	fconfigure $fd \
 		-blocking 0 \
 		-buffering full \
@@ -218,13 +218,13 @@ proc checkout_index {msg path_list after capture_error} {
 	if {$batch > 25} {set batch 25}
 
 	set status_bar_operation [$::main_status start $msg [mc "files"]]
-	set fd [git_write checkout-index \
+	set fd [git_write [list checkout-index \
 		--index \
 		--quiet \
 		--force \
 		-z \
 		--stdin \
-		]
+		]]
 	fconfigure $fd \
 		-blocking 0 \
 		-buffering full \
diff --git a/lib/merge.tcl b/lib/merge.tcl
index e97c91eab6..6317c32127 100644
--- a/lib/merge.tcl
+++ b/lib/merge.tcl
@@ -239,7 +239,7 @@ Continue with resetting the current changes?"]
 	}
 
 	if {[ask_popup $op_question] eq {yes}} {
-		set fd [git_read read-tree --reset -u -v HEAD 2>@1]
+		set fd [git_read [list read-tree --reset -u -v HEAD 2>@1]]
 		fconfigure $fd -blocking 0 -translation binary
 		set status_bar_operation [$::main_status \
 			start \
diff --git a/lib/mergetool.tcl b/lib/mergetool.tcl
index f2fa439305..777d7b323b 100644
--- a/lib/mergetool.tcl
+++ b/lib/mergetool.tcl
@@ -88,7 +88,7 @@ proc merge_load_stages {path cont} {
 	set merge_stages(3) {}
 	set merge_stages_buf {}
 
-	set merge_stages_fd [eval git_read ls-files -u -z -- {$path}]
+	set merge_stages_fd [git_read [list ls-files -u -z -- $path]]
 
 	fconfigure $merge_stages_fd -blocking 0 -translation binary -encoding binary
 	fileevent $merge_stages_fd readable [list read_merge_stages $merge_stages_fd $cont]
diff --git a/lib/remote.tcl b/lib/remote.tcl
index a733a0f36e..cf796d1601 100644
--- a/lib/remote.tcl
+++ b/lib/remote.tcl
@@ -32,7 +32,7 @@ proc all_tracking_branches {} {
 	}
 
 	if {$pat ne {}} {
-		set fd [eval git_read for-each-ref --format=%(refname) $cmd]
+		set fd [git_read [concat for-each-ref --format=%(refname) $cmd]]
 		while {[gets $fd n] > 0} {
 			foreach spec $pat {
 				set dst [string range [lindex $spec 0] 0 end-2]
diff --git a/lib/remote_branch_delete.tcl b/lib/remote_branch_delete.tcl
index 5ba9fcadd1..c8c99b17a8 100644
--- a/lib/remote_branch_delete.tcl
+++ b/lib/remote_branch_delete.tcl
@@ -308,7 +308,7 @@ method _load {cache uri} {
 		set full_list [list]
 		set head_cache($cache) [list]
 		set full_cache($cache) [list]
-		set active_ls [git_read ls-remote $uri]
+		set active_ls [git_read [list ls-remote $uri]]
 		fconfigure $active_ls \
 			-blocking 0 \
 			-translation lf \
-- 
cgit v1.3