-
-
Notifications
You must be signed in to change notification settings - Fork 954
Commit 6029211
committed
Fix CVE-2023-40590
This fixes the path search bug where the current directory is
included on Windows, by setting NoDefaultCurrentDirectoryInExePath
for the caller. (Setting for the callee env would not work.)
This sets it only on Windows, only for the duration of the Popen
call, and then automatically unsets it or restores its old value.
NoDefaultCurrentDirectoryInExePath is documented at:
https://learn.microsoft.com/en-us/windows/win32/api/processenv/nf-processenv-needcurrentdirectoryforexepathw
It automatically affects the behavior of subprocess.Popen on
Windows, due to the way Popen uses the Windows API. (In contrast,
it does not, at least currently on CPython, affect the behavior of
shutil.which. But shutil.which is not being used to find git.exe.)1 parent e19abe7 commit 6029211
1 file changed
+21
-17
lines changedOriginal file line number | Diff line number | Diff line change | |
---|---|---|---|
| |||
5 | 5 |
| |
6 | 6 |
| |
7 | 7 |
| |
8 | - | ||
8 | + | ||
9 | 9 |
| |
10 | 10 |
| |
11 | 11 |
| |
| |||
14 | 14 |
| |
15 | 15 |
| |
16 | 16 |
| |
17 | + | ||
17 | 18 |
| |
18 | 19 |
| |
19 | 20 |
| |
| |||
963 | 964 |
| |
964 | 965 |
| |
965 | 966 |
| |
967 | + | ||
968 | + | ||
966 | 969 |
| |
967 | 970 |
| |
971 | + | ||
968 | 972 |
| |
969 | 973 |
| |
970 | 974 |
| |
| |||
980 | 984 |
| |
981 | 985 |
| |
982 | 986 |
| |
983 | - | ||
984 | - | ||
985 | - | ||
986 | - | ||
987 | - | ||
988 | - | ||
989 | - | ||
990 | - | ||
991 | - | ||
992 | - | ||
993 | - | ||
994 | - | ||
995 | - | ||
996 | - | ||
997 | - | ||
987 | + | ||
988 | + | ||
989 | + | ||
990 | + | ||
991 | + | ||
992 | + | ||
993 | + | ||
994 | + | ||
995 | + | ||
996 | + | ||
997 | + | ||
998 | + | ||
999 | + | ||
1000 | + | ||
1001 | + | ||
998 | 1002 |
| |
999 | 1003 |
| |
1000 | 1004 |
| |
| |||
1144 | 1148 |
| |
1145 | 1149 |
| |
1146 | 1150 |
| |
1147 | - | ||
1151 | + | ||
1148 | 1152 |
| |
1149 | 1153 |
| |
1150 | 1154 |
| |
|
0 commit comments