Open colin-kiegel opened 8 years ago
I just hit this issue here: https://github.com/commercialhaskell/stack/pull/2305/commits/675f834b2ea46963206d48cd84ec19efa833040a
I tried to make a commit message saying
Save Stripe `acct_` keys in database
And, git-control
, in the console showed: /bin/sh: acct_: command not found
.
The commit then had a message of:
Save Stripe keys in database
so far all examples were harmless, but it is easy to imagine commit messages, where this bug would really eat your laundry!
Just consider
sanitize input like
rm *`` <-- don't try this or say goodbye to your repository! ;-)
`...`
is often used for code fragments in markdownIf you use this style inside a commit message on linux, it will be interpreted by the shell. While this is to be expected by git running on the command line, it is a bit surprising for a GUI wrapper like atom-git-control. Entering commit message
`ping www.google.de -c 2`
results in this commit message
The behaviour will probably differ for other OS. I think a GUI-wrapper should try to escape this or not execute git in the usual shell context.