mirror of
https://github.com/git/git.git
synced 2025-12-12 20:36:24 +01:00
311d9ada3a
This addresses CVE-2025-46835, Git GUI can create and overwrite a user's files: When a user clones an untrusted repository and is tricked into editing a file located in a maliciously named directory in the repository, then Git GUI can create and overwrite files for which the user has write permission. Signed-off-by: Johannes Sixt <j6t@kdbg.org>
28 lines
631 B
Tcl
28 lines
631 B
Tcl
# git-gui Misc. native Windows 32 support
|
|
# Copyright (C) 2007 Shawn Pearce
|
|
|
|
proc win32_read_lnk {lnk_path} {
|
|
return [safe_exec [list cscript.exe \
|
|
/E:jscript \
|
|
/nologo \
|
|
[file join $::oguilib win32_shortcut.js] \
|
|
$lnk_path]]
|
|
}
|
|
|
|
proc win32_create_lnk {lnk_path lnk_exec lnk_dir} {
|
|
global oguilib
|
|
|
|
set lnk_args [lrange $lnk_exec 1 end]
|
|
set lnk_exec [lindex $lnk_exec 0]
|
|
|
|
set cmd [list wscript.exe \
|
|
/E:jscript \
|
|
/nologo \
|
|
[file nativename [file join $oguilib win32_shortcut.js]] \
|
|
$lnk_path \
|
|
[file nativename [file join $oguilib git-gui.ico]] \
|
|
$lnk_dir \
|
|
$lnk_exec]
|
|
safe_exec [concat $cmd $lnk_args]
|
|
}
|