diff options
| author | Michael Muré <batolettre@gmail.com> | 2021-03-21 22:37:19 +0100 |
|---|---|---|
| committer | Michael Muré <batolettre@gmail.com> | 2021-03-21 22:37:19 +0100 |
| commit | 9434d2ea5c6da5e856d0bbb02046a5886dfaa600 (patch) | |
| tree | e4e34fab94fbad2fc54290d1da490b84a4ba9932 /repository | |
| parent | 52df5a1f1199d085b2bb10fb7ed5599dcb8307c4 (diff) | |
| download | git-bug-9434d2ea5c6da5e856d0bbb02046a5886dfaa600.tar.gz | |
repo: fix security issue that could lead to arbitrary code execution
see https://blog.golang.org/path-security for details
Diffstat (limited to 'repository')
| -rw-r--r-- | repository/git_cli.go | 5 | ||||
| -rw-r--r-- | repository/gogit.go | 4 |
2 files changed, 5 insertions, 4 deletions
diff --git a/repository/git_cli.go b/repository/git_cli.go index 085b1cda..21cc40e2 100644 --- a/repository/git_cli.go +++ b/repository/git_cli.go @@ -4,8 +4,9 @@ import ( "bytes" "fmt" "io" - "os/exec" "strings" + + "golang.org/x/sys/execabs" ) // gitCli is a helper to launch CLI git commands @@ -21,7 +22,7 @@ func (cli gitCli) runGitCommandWithIO(stdin io.Reader, stdout, stderr io.Writer, // fmt.Printf("[%s] Running git %s\n", path, strings.Join(args, " ")) - cmd := exec.Command("git", args...) + cmd := execabs.Command("git", args...) cmd.Dir = path cmd.Stdin = stdin cmd.Stdout = stdout diff --git a/repository/gogit.go b/repository/gogit.go index bdac259d..f2d2b57e 100644 --- a/repository/gogit.go +++ b/repository/gogit.go @@ -5,7 +5,6 @@ import ( "fmt" "io/ioutil" "os" - "os/exec" "path/filepath" "sort" "strings" @@ -20,6 +19,7 @@ import ( "github.com/go-git/go-git/v5/plumbing" "github.com/go-git/go-git/v5/plumbing/filemode" "github.com/go-git/go-git/v5/plumbing/object" + "golang.org/x/sys/execabs" "github.com/MichaelMure/git-bug/util/lamport" ) @@ -261,7 +261,7 @@ func (repo *GoGitRepo) GetCoreEditor() (string, error) { } for _, cmd := range priorities { - if _, err = exec.LookPath(cmd); err == nil { + if _, err = execabs.LookPath(cmd); err == nil { return cmd, nil } |