3 ms·
The "official" git prompt[1] is safe on Bash; the script doesn't run. [1]: https://github.com/git/git/blob/master/contrib/completion/git-prompt.sh https://gith
by rahiel 10y ago
The "official" git prompt[1] is safe on Bash; the script doesn't run.
[1]: https://github.com/git/git/blob/master/contrib/completion/git-prompt.sh https://github.com/git/git/blob/master/contrib/completion/gi...
- artursapek 10y agoNothing gets past Linus
- graton 10y agoThat code appears to be written by someone named Richard Hansen. I don't even see Linus in the git blame output of that file.
- caf 10y agoIn particular see the long comment at line 324.
- adito 10y ago> If the shell would expand the contents of PS1 when drawing the prompt, a raw ref name must not be included in PS1. This protects the user from arbitrary code execution via specially crafted ref names. For example, a ref named 'refs/heads/$(IFS=_;cmd=sudo_rm_-rf_/;$cmd)' might cause the shell to execute 'sudo rm -rf /' when the prompt is drawn. [1]: https://github.com/git/git/blob/9d77b0405ce6b471cb5ce3a904368fc25e55643d/contrib/completion/git-prompt.sh#L331-L336 https://github.com/git/git/blob/9d77b0405ce6b471cb5ce3a90436...
- moyix 10y agoIt looks like it used to, but was fixed by this patch: https://github.com/git/git/commit/8976500cbbb13270398d3b3e07a17b8cc7bff43f https://github.com/git/git/commit/8976500cbbb13270398d3b3e07...