3 ms·
I think this is slightly less of a Cursor bug than a bit of a Windows quirk: Windows searches the current working directory for executables before resorting to
by bragr 3mo ago
I think this is slightly less of a Cursor bug than a bit of a Windows quirk: Windows searches the current working directory for executables before resorting to the path variable. I imagine a lot of stuff is vulnerable to such an "attack" on Windows.
- shitter 3mo agoYeah, but you can easily mitigate it by searching for the real git in known system locations and using whatever you find there (or allowing the user to configure the path). I believe that's how VSCode does it
- Chu4eeno 3mo agoYes, but it's an old known security gotcha people developing for Wintendo have to guard against.
- whateveracct 3mo agothat sounds like Cursor has a bug and vuln on Windows to me
- ncruces 3mo agoStuff that cares about security fixes this, though: https://go.dev/blog/path-security https://go.dev/blog/path-security The functions Command and LookPath look for a program in the directories listed in the current path, following the conventions of the host operating system. Operating systems have for decades included the current directory in this search, sometimes implicitly and sometimes configured explicitly that way by default. Modern practice is that including the current directory is usually unexpected and often leads to security problems. https://pkg.go.dev/os/exec#hdr-Executables_in_the_current_directory https://pkg.go.dev/os/exec#hdr-Executables_in_the_current_di...
- deleted 3mo ago[deleted]