4 ms·
On Windows, if your shell was in a malicious repo's directory and you ran any "git" command, wouldn't the behavior be the same? Binaries in the current director
by varenc 3mo ago
On Windows, if your shell was in a malicious repo's directory and you ran any "git" command, wouldn't the behavior be the same? Binaries in the current directory are considered before PATH. This seems like a broader issue.
That said, Cursor should at least have some "trust this directory?" dialogue.
- psd1 3mo agoNot in powershell, no, because . is not in PATH (unless you put it there). If you tab-complete `git` it will resolve to `.\git.exe` but it you merely hit enter then it will search PATH and not the CD.
- varenc 3mo agogreat point! Though what about the default windows APIs for 'calling out to shell'. Like using `subprocess.run(...)` in Python. My suspicion is that works like cmd.exe? edit: answered myself. Seems like subprocess.run works like PowerShell, unless you pass in 'shell=True', then it passes it directly to CMD.exe. And I'm guessing that's what Cursor is doing.