aosp/repo
1
0
Fork 0
mirror of https://git.codelinaro.org/clo/tools/repo.git synced 2025-05-20 05:46:16 +08:00
Code Issues Packages Projects Releases Wiki Activity

Set GIT_ALLOW_PROTOCOL to limit dangerous protocols

Browse Source 
See git commit 33cfccbbf35a -- some protocols allow arbitrary command
execution as part of the URL. Instead of blindly allowing those,
whitelist the allowed URL protocols unless the user has already done so.

Bug: Issue 210
Change-Id: I6bd8e721aa5e3dab53ef28cfdc8fde33eb74ef76
This commit is contained in:
Dan Willemsen
2015-11-25 13:26:39 -08:00
committed by David Pursehouse
parent e1e0bd1f75
commit 466b8c4ea2
1 changed files with 3 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

3
git_command.py
View File

@ -168,6 +168,9 @@ class GitCommand(object):
if p is not None:
s = p + ' ' + s
_setenv(env, 'GIT_CONFIG_PARAMETERS', s)
if 'GIT_ALLOW_PROTOCOL' not in env:
_setenv(env, 'GIT_ALLOW_PROTOCOL',
'file:git:http:https:ssh:persistent-http:persistent-https:sso')
if project:
if not cwd: