Visitar URL original
Fix CVE-2023-40590 by 0xMorph · Pull Request #1 · cantina-forks/GitPython-fix-review-demo · GitHub
Skip to content

Fix CVE-2023-40590 - #1

Open
0xMorph wants to merge 3 commits into
mainfrom
apex/incomplete-cve-2023-40590-fix
Open

0xMorph wants to merge 3 commits into
mainfrom
apex/incomplete-cve-2023-40590-fix

Conversation

@0xMorph

@0xMorph 0xMorph commented Apr 28, 2026

Copy link
Copy Markdown

Replay of gitpython-developers/GitPython#1636 for Apex fix-review testing. This intentionally applies the incomplete fix so fix review should identify the remaining shell=True and bash.exe hook paths.

This fixes the path search bug where the current directory is
included on Windows, by setting NoDefaultCurrentDirectoryInExePath
for the caller. (Setting for the callee env would not work.)

This sets it only on Windows, only for the duration of the Popen
call, and then automatically unsets it or restores its old value.

NoDefaultCurrentDirectoryInExePath is documented at:
https://learn.microsoft.com/en-us/windows/win32/api/processenv/nf-processenv-needcurrentdirectoryforexepathw

It automatically affects the behavior of subprocess.Popen on
Windows, due to the way Popen uses the Windows API. (In contrast,
it does not, at least currently on CPython, affect the behavior of
shutil.which. But shutil.which is not being used to find git.exe.)
This adds test_it_executes_git_not_from_cwd to verify that the
execute method does not use "git.exe" in the current directory on
Windows, nor "git" in the current directory on Unix-like systems,
when those files are executable.

It adds a _chdir helper context manager to support this, because
contextlib.chdir is only available on Python 3.11 and later.
This changes the regex in test_it_executes_git_not_from_cwd so
that (unlike test_it_executes_git_to_shell_and_returns_result) it
only checks that the output starts with the words "git version",
and not the form of whatever follows those words.
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants