]> git.ipfire.org Git - thirdparty/git.git/commit
Merge branch 'js/fix-open-exec'
authorJohannes Sixt <j6t@kdbg.org>
Tue, 20 May 2025 06:56:09 +0000 (08:56 +0200)
committerTaylor Blau <me@ttaylorr.com>
Fri, 23 May 2025 21:04:31 +0000 (17:04 -0400)
commit311d9ada3a7c2c49669d656a0359cc3a9ccfeeef
tree2a415d4e14344093eda9d6e2a0daa026ae564989
parenta7d1716fa648f6557ea9c91e0f04bae2e8738e6a
parenta437f5bc93330a70b42a230e52f3bd036ca1b1da
Merge branch 'js/fix-open-exec'

This addresses CVE-2025-46835, Git GUI can create and overwrite a
user's files:

When a user clones an untrusted repository and is tricked into editing
a file located in a maliciously named directory in the repository, then
Git GUI can create and overwrite files for which the user has write
permission.

Signed-off-by: Johannes Sixt <j6t@kdbg.org>
20 files changed:
git-gui/git-gui.sh
git-gui/lib/blame.tcl
git-gui/lib/branch.tcl
git-gui/lib/browser.tcl
git-gui/lib/checkout_op.tcl
git-gui/lib/choose_repository.tcl
git-gui/lib/choose_rev.tcl
git-gui/lib/commit.tcl
git-gui/lib/console.tcl
git-gui/lib/database.tcl
git-gui/lib/diff.tcl
git-gui/lib/index.tcl
git-gui/lib/merge.tcl
git-gui/lib/mergetool.tcl
git-gui/lib/remote.tcl
git-gui/lib/remote_branch_delete.tcl
git-gui/lib/shortcut.tcl
git-gui/lib/sshkey.tcl
git-gui/lib/tools.tcl
git-gui/lib/win32.tcl