|
 |
8d6432 |
From 4f0099156245ed2873d6945d5e58db741e15836d Mon Sep 17 00:00:00 2001
|
|
|
8d6432 |
From: Lumir Balhar <lbalhar@redhat.com>
|
|
|
8d6432 |
Date: Tue, 8 Jun 2021 09:51:47 +0200
|
|
|
8d6432 |
Subject: [PATCH] CVE-2021-3572
|
|
|
8d6432 |
|
|
|
8d6432 |
---
|
|
|
8d6432 |
src/pip/_internal/vcs/git.py | 10 ++++++++--
|
|
|
8d6432 |
1 file changed, 8 insertions(+), 2 deletions(-)
|
|
|
8d6432 |
|
|
|
8d6432 |
diff --git a/src/pip/_internal/vcs/git.py b/src/pip/_internal/vcs/git.py
|
|
|
8d6432 |
index 92b8457..7b3cc4a 100644
|
|
|
8d6432 |
--- a/src/pip/_internal/vcs/git.py
|
|
|
8d6432 |
+++ b/src/pip/_internal/vcs/git.py
|
|
|
8d6432 |
@@ -120,9 +120,15 @@ class Git(VersionControl):
|
|
|
8d6432 |
output = cls.run_command(['show-ref', rev], cwd=dest,
|
|
|
8d6432 |
show_stdout=False, on_returncode='ignore')
|
|
|
8d6432 |
refs = {}
|
|
|
8d6432 |
- for line in output.strip().splitlines():
|
|
|
8d6432 |
+ # NOTE: We do not use splitlines here since that would split on other
|
|
|
8d6432 |
+ # unicode separators, which can be maliciously used to install a
|
|
|
8d6432 |
+ # different revision.
|
|
|
8d6432 |
+ for line in output.strip().split("\n"):
|
|
|
8d6432 |
+ line = line.rstrip("\r")
|
|
|
8d6432 |
+ if not line:
|
|
|
8d6432 |
+ continue
|
|
|
8d6432 |
try:
|
|
|
8d6432 |
- sha, ref = line.split()
|
|
|
8d6432 |
+ sha, ref = line.split(" ", maxsplit=2)
|
|
|
8d6432 |
except ValueError:
|
|
|
8d6432 |
# Include the offending line to simplify troubleshooting if
|
|
|
8d6432 |
# this error ever occurs.
|
|
|
8d6432 |
--
|
|
|
8d6432 |
2.31.1
|
|
|
8d6432 |
|