René's URL Explorer Experiment

Title: fix(security): prevent command injection via shell=True (CWE-78) by bearomorphism · Pull Request #1941 · commitizen-tools/commitizen · GitHub

Open Graph Title: fix(security): prevent command injection via shell=True (CWE-78) by bearomorphism · Pull Request #1941 · commitizen-tools/commitizen

X Title: fix(security): prevent command injection via shell=True (CWE-78) by bearomorphism · Pull Request #1941 · commitizen-tools/commitizen

Description: Description Fix command injection vulnerability (CWE-78) where shell=True in cmd.run() allowed arbitrary command execution via user-controlled values interpolated into git commands (e.g., annotated_tag_message in pyproject.toml). Closes #1918 Changes Split cmd.run() into two explicit APIs: cmd.run(Sequence[str]) -- executes commands with shell=False (safe, no injection) cmd.run(str) -- deprecated, emits DeprecationWarning, still uses shell=True for backward compat cmd.run_shell(str) -- explicit opt-in for shell=True (only used by user-defined hooks) Converted all git operations to list-based execution (shell=False): git.tag(), git.add(), git.commit(), git.get_commits(), git.get_tags() git.get_filenames_in_commit(), git.tag_exist(), git.is_signed_tag() git.get_tag_message(), git.get_tag_names(), git.find_git_project_root() git.is_staging_clean(), git.is_git_project(), git.get_core_editor() git._get_log_as_str_list(), git.get_default_branch() Eliminated args string splitting (list->string->list round-trip): git.commit(args=...) and git.get_commits(args=...) now accept Sequence[str] instead of str cli.py passes extra_cli_args as a list directly from argparse (no " ".join()) bump._get_commit_args() returns list[str] instead of joined string This preserves arguments with spaces that were previously broken by naive .split() Other improvements: git.commit() uses env={"GIT_COMMITTER_DATE": ...} instead of OS-specific shell tricks (cmd /v /c on Windows, env prefix on Unix) Removed _create_commit_cmd_string() helper (no longer needed) Removed shell quoting artifacts from get_tags() and get_tag_message() format strings (fixes a Windows bug where literal quotes appeared in output) hooks.py uses cmd.run_shell() -- intentionally shell-based for user-defined hooks with pipes/redirects Checklist I have read the contributing guidelines Was generative AI tooling used to co-author this PR? Yes (please specify the tool below) Generated-by: GitHub Copilot CLI following the guidelines Code Changes Add test cases to all the changes you introduce Run uv run poe all locally to ensure this change passes linter check and tests Manually test the changes: Verify the feature/bug fix works as expected in real-world scenarios Test edge cases and error conditions Ensure backward compatibility is maintained Document any manual testing steps performed Update the documentation for the changes Documentation Changes N/A - Internal implementation change only, no user-facing behavior or CLI changes. Expected Behavior User-controlled values (tag names, messages, file paths) are passed as literal arguments to git commands without shell interpretation, preventing command injection attacks in CI/CD pipelines. Steps to Test This Pull Request Create a pyproject.toml with a malicious annotated_tag_message: [tool.commitizen] name = "cz_conventional_commits" version = "0.1.0" tag_format = "$version" annotated_tag = true annotated_tag_message = 'Release" && echo INJECTED && echo "' Run cz bump --yes Verify that INJECTED is NOT printed (command not executed) Verify the tag is created with the literal message string Verification: All Attack Vectors from #1918 Addressed Affected code (from issue) Fix applied cmd.run(f'git tag {option} {tag} -m "{msg or tag}"') cmd.run(["git", "tag", option, tag, "-m", msg or tag]) (line 177) cmd.run(f"git tag {tag}") cmd.run(["git", "tag", tag]) (line 171) cmd.run(f"git add {' '.join(args)}") cmd.run(["git", "add", *args]) (line 181) subprocess.Popen(cmd, shell=True) shell=False for all list-based cmd.run() calls Manual validation result: Running cz bump with a malicious annotated_tag_message = 'Release" && echo INJECTED && echo "' -- the injected command was NOT executed, and the tag was created with the literal string as its message. Backward Compatibility cmd.run() accepts both str (deprecated, emits DeprecationWarning, uses shell=True) and Sequence[str] (safe, shell=False). External plugins calling cmd.run("git ...") will continue to work but receive a deprecation warning guiding them to migrate. Additional Context Related: CWE-78 (OS Command Injection) The attack vector requires a poisoned pyproject.toml (e.g., via malicious PR) that gets executed in CI/CD running cz bump. With shell=True, values like annotated_tag_message were interpolated into shell command strings, allowing arbitrary command execution. With shell=False + list args, each value is a literal argv entry -- shell metacharacters (&&, ;, |, backticks) have no special meaning.

Open Graph Description: Description Fix command injection vulnerability (CWE-78) where shell=True in cmd.run() allowed arbitrary command execution via user-controlled values interpolated into git commands (e.g., annotated...

X Description: Description Fix command injection vulnerability (CWE-78) where shell=True in cmd.run() allowed arbitrary command execution via user-controlled values interpolated into git commands (e.g., annotated...

Opengraph URL: https://github.com/commitizen-tools/commitizen/pull/1941

X: @github

direct link

Domain: github.com

Links:

Viewport: width=device-width