Fix CVE-2023-40590 · gitpython-developers/GitPython@6029211
@@ -5,7 +5,7 @@
55# the BSD License: http://www.opensource.org/licenses/bsd-license.php
66from __future__ import annotations
77import re
8-from contextlib import contextmanager
8+import contextlib
99import io
1010import logging
1111import os
@@ -14,6 +14,7 @@
1414import subprocess
1515import threading
1616from textwrap import dedent
17+import unittest.mock
17181819from git.compat import (
1920defenc,
@@ -963,8 +964,11 @@ def execute(
963964redacted_command,
964965'"kill_after_timeout" feature is not supported on Windows.',
965966 )
967+# Only search PATH, not CWD. This must be in the *caller* environment. The "1" can be any value.
968+patch_caller_env = unittest.mock.patch.dict(os.environ, {"NoDefaultCurrentDirectoryInExePath": "1"})
966969else:
967970cmd_not_found_exception = FileNotFoundError # NOQA # exists, flake8 unknown @UndefinedVariable
971+patch_caller_env = contextlib.nullcontext()
968972# end handle
969973970974stdout_sink = PIPE if with_stdout else getattr(subprocess, "DEVNULL", None) or open(os.devnull, "wb")
@@ -980,21 +984,21 @@ def execute(
980984istream_ok,
981985 )
982986try:
983-proc = Popen(
984-command,
985-env=env,
986-cwd=cwd,
987-bufsize=-1,
988-stdin=istream or DEVNULL,
989-stderr=PIPE,
990-stdout=stdout_sink,
991-shell=shell is not None and shell or self.USE_SHELL,
992-close_fds=is_posix, # unsupported on windows
993-universal_newlines=universal_newlines,
994-creationflags=PROC_CREATIONFLAGS,
995-**subprocess_kwargs,
996-)
997-987+with patch_caller_env:
988+proc = Popen(
989+ command,
990+ env=env,
991+ cwd=cwd,
992+ bufsize=-1,
993+ stdin=istream or DEVNULL,
994+ stderr=PIPE,
995+ stdout=stdout_sink,
996+ shell=shell is not None and shell or self.USE_SHELL,
997+ close_fds=is_posix, # unsupported on windows
998+ universal_newlines=universal_newlines,
999+ creationflags=PROC_CREATIONFLAGS,
1000+ **subprocess_kwargs,
1001+ )
9981002except cmd_not_found_exception as err:
9991003raise GitCommandNotFound(redacted_command, err) from err
10001004else:
@@ -1144,7 +1148,7 @@ def update_environment(self, **kwargs: Any) -> Dict[str, Union[str, None]]:
11441148del self._environment[key]
11451149return old_env
114611501147-@contextmanager
1151+@contextlib.contextmanager
11481152def custom_environment(self, **kwargs: Any) -> Iterator[None]:
11491153"""
11501154 A context manager around the above ``update_environment`` method to restore the