Skip to content

Commit

Permalink
Don't split git references on unicode separators
Browse files Browse the repository at this point in the history
Previously, maliciously formatted tags could be used to hijack a
commit-based pin. Using the fact that the split here allowed for
all of unicode's whitespace characters as separators -- which git allows
as a part of a tag name -- it is possible to force a different revision
to be installed; if an attacker gains access to the repository.

This change stops splitting the string on unicode characters, by forcing
the splits to happen on newlines and ASCII spaces.
  • Loading branch information
pradyunsg committed Apr 24, 2021
1 parent 1320bac commit ca832b2
Showing 1 changed file with 8 additions and 2 deletions.
10 changes: 8 additions & 2 deletions src/pip/_internal/vcs/git.py
Original file line number Diff line number Diff line change
Expand Up @@ -131,9 +131,15 @@ def get_revision_sha(cls, dest, rev):
on_returncode='ignore',
)
refs = {}
for line in output.strip().splitlines():
# NOTE: We do not use splitlines here since that would split on other
# unicode separators, which can be maliciously used to install a
# different revision.
for line in output.strip().split("\n"):
line = line.rstrip("\r")
if not line:
continue
try:
ref_sha, ref_name = line.split()
ref_sha, ref_name = line.split(" ", maxsplit=2)
except ValueError:
# Include the offending line to simplify troubleshooting if
# this error ever occurs.
Expand Down

0 comments on commit ca832b2

Please sign in to comment.