From c2e8904258544f3d79dc4e96d1269c0ad8124db3 Mon Sep 17 00:00:00 2001 From: Johannes Sixt Date: Mon, 21 Apr 2025 17:07:10 +0200 Subject: git-gui: treat file names beginning with "|" as relative paths The Tcl 'open' function has a very wide interface. It can open files as well as pipes to external processes. The difference is made only by the first character of the file name: if it is "|", a process is spawned. We have a number of calls of Tcl 'open' that take a file name from the environment in which Git GUI is running. Be prepared that insane values are injected. In particular, when we intend to open a file, do not take a file name that happens to begin with "|" as a request to run a process. Signed-off-by: Johannes Sixt Signed-off-by: Taylor Blau --- lib/sshkey.tcl | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) (limited to 'lib/sshkey.tcl') diff --git a/lib/sshkey.tcl b/lib/sshkey.tcl index 589ff8f78a..2e006cb8ca 100644 --- a/lib/sshkey.tcl +++ b/lib/sshkey.tcl @@ -7,7 +7,7 @@ proc find_ssh_key {} { ~/.ssh/id_rsa.pub ~/.ssh/identity.pub } { if {[file exists $name]} { - set fh [open $name r] + set fh [safe_open_file $name r] set cont [read $fh] close $fh return [list $name $cont] -- cgit v1.3