From a4d66d01c2c46334986f97b5c97413c1e027dd1c Mon Sep 17 00:00:00 2001 From: Wong Hoi Sing Edison Date: Sat, 20 Oct 2012 17:06:20 +0800 Subject: [PATCH 1/2] Issue #1471178 by sun and hswong3i: Increases security by escaping shell arguments. --- git_deploy.module | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/git_deploy.module b/git_deploy.module index e35ff7c..f73ad03 100644 --- a/git_deploy.module +++ b/git_deploy.module @@ -29,7 +29,7 @@ function git_deploy_system_info_alter(&$info, $file, $type = NULL) { $git_dir = "$directory/.git"; // Theoretically /.git could exist. if ($directory && file_exists($git_dir)) { - $git = "git --git-dir $git_dir"; + $git = "git --git-dir " . escapeshellarg($git_dir); // Find first the project name based on fetch URL. // Eat error messages. >& is valid on Windows, too. Also, $output does // not need initialization because it's taken by reference. @@ -58,7 +58,7 @@ function git_deploy_system_info_alter(&$info, $file, $type = NULL) { // Now try to find a tag. exec("$git rev-list --topo-order --max-count=1 HEAD 2>&1", $last_tag_hash); if ($last_tag_hash) { - exec("$git describe --tags $last_tag_hash[0] 2>&1", $last_tag); + exec("$git describe --tags " . escapeshellarg($last_tag_hash[0]) . " 2>&1", $last_tag); if ($last_tag) { $last_tag = $last_tag[0]; // Make sure the tag starts as Drupal formatted (for eg. @@ -77,7 +77,7 @@ function git_deploy_system_info_alter(&$info, $file, $type = NULL) { // The git log -1 command always succeeds and if we are not on a // tag this will happen to return the time of the last commit which // is exactly what we wanted. - exec("$git log -1 --pretty=format:%at $last_tag 2>&1", $datestamp); + exec("$git log -1 --pretty=format:%at " . escapeshellarg($last_tag) . " 2>&1", $datestamp); if ($datestamp && is_numeric($datestamp[0])) { $info['datestamp'] = $datestamp[0]; } -- 1.7.9.5 From f3b6e024f2043752866f56c5e84d3cb2057f398d Mon Sep 17 00:00:00 2001 From: Wong Hoi Sing Edison Date: Sun, 21 Oct 2012 09:15:22 +0800 Subject: [PATCH 2/2] Issue #1471178 by sun and hswong3i: Increases security by escaping shell arguments (Part 2). --- git_deploy.module | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/git_deploy.module b/git_deploy.module index f73ad03..95c91f6 100644 --- a/git_deploy.module +++ b/git_deploy.module @@ -76,7 +76,8 @@ function git_deploy_system_info_alter(&$info, $file, $type = NULL) { } // The git log -1 command always succeeds and if we are not on a // tag this will happen to return the time of the last commit which - // is exactly what we wanted. + // is exactly what we wanted. Do not use escapeshellarg() for + // --pretty, since that would strip the % on Windows. exec("$git log -1 --pretty=format:%at " . escapeshellarg($last_tag) . " 2>&1", $datestamp); if ($datestamp && is_numeric($datestamp[0])) { $info['datestamp'] = $datestamp[0]; -- 1.7.9.5