René's URL Explorer Experiment

{"@context":"https://schema.org","@type":"DiscussionForumPosting","headline":"CVE-2023-40590 fix capitalized all environment variables on Windows","articleBody":"This fix:\r\nhttps://github.com/gitpython-developers/GitPython/commit/6029211d729a0dd81e08fcc9c1a3ab7fe9af85c9\r\ncapitalized all environment variables on Windows. It can be illustrated by this short program:\r\n```\r\nimport subprocess\r\n\r\nprint(subprocess.check_output(\r\n    \"set | findstr /c:SystemRoot /i\", shell=True, universal_newlines=True\r\n))\r\n\r\nimport git\r\n\r\nprint(subprocess.check_output(\r\n    \"set | findstr /c:SystemRoot /i\", shell=True, universal_newlines=True\r\n))\r\n```\r\n\r\nThe output is:\r\n```\r\nSystemRoot=C:\\Windows\r\n\r\nSYSTEMROOT=C:\\Windows\r\n```\r\n\r\nThis side effect breaks our use case currently. We use gnu make in cygwin for our build, in which all environment variables are case sensitive.\r\n\r\nThe core problem was `unittest.mock.patch.dict(os.environ, {\"NoDefaultCurrentDirectoryInExePath\": \"1\"})` -- in which it will try to treat `os.environ` as a dictionary, but `os.environ` is not just a simple dictionary. It actually remembers the original casing of the environment variable. Unfortunately when reading it as dictionary it capitalize all letters.\r\n\r\nWe can also observe the same side effect with this code below:\r\n```\r\nimport os\r\nimport subprocess\r\nimport unittest.mock\r\n\r\nprint(subprocess.check_output(\r\n    \"set | findstr /c:SystemRoot /i\", shell=True, universal_newlines=True\r\n))\r\n\r\nwith unittest.mock.patch.dict(os.environ, {\"NoDefaultCurrentDirectoryInExePath\": \"1\"}):\r\n    pass\r\n\r\nprint(subprocess.check_output(\r\n    \"set | findstr /c:SystemRoot /i\", shell=True, universal_newlines=True\r\n))\r\n```\r\n\r\nThe side effect is the same as above.","author":{"url":"https://github.com/irwand","@type":"Person","name":"irwand"},"datePublished":"2023-09-06T21:21:24.000Z","interactionStatistic":{"@type":"InteractionCounter","interactionType":"https://schema.org/CommentAction","userInteractionCount":1},"url":"https://github.com/1646/GitPython/issues/1646"}