Skip to content

Commit 2e8fd94

Browse files
authored
Update commandsAndMenu.tsx to replace "`" in file path for Open Git Repository since it leads to Command Injection Vulnerability (#1196)
When a repo is created with the backtick character around it and Initialized as a repo and then opened in Terminal, the linux command is resolved or executed on a running instance. For example if a folder with the name "whoami" is created, initialized as a repo and then opened in terminal using 'Open Git repository in Terminal' you will see that whoami is resolved to the current user which is a vector of command injection.
1 parent 0c768d1 commit 2e8fd94

File tree

1 file changed

+5
-1
lines changed

1 file changed

+5
-1
lines changed

src/commandsAndMenu.tsx

Lines changed: 5 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -160,7 +160,11 @@ export function addCommands(
160160
terminal.session.send({
161161
type: 'stdin',
162162
content: [
163-
`cd "${gitModel.pathRepository.split('"').join('\\"')}"\n`
163+
`cd "${gitModel.pathRepository
164+
.split('"')
165+
.join('\\"')
166+
.split('`')
167+
.join('\\`')}"\n`
164168
]
165169
});
166170
}

0 commit comments

Comments
 (0)