GV

GeezerVison

The World Wide Web, restored to 800 pixels of glory.

Home|About|Gaming cabinet|Archives|How it works|Starter sites

On this site

  • Sign in
  • ActionsCI/CD and automation
  • CodespacesCloud development environments
  • All Features
  • Documentation
  • Training
  • Certifications
  • Build with Copilot
  • Customize Copilot
  • Integrations
  • Trending repos
  • GitHub Sponsors
  • Developer articles
  • Enterprises

This view

  • Original page
  • New address

GeezerVison is showing github.com — CVE-2023-40590 fix capitalized all environment variables on Windows · Issue #1646 · gitpython-developers/GitPython

CVE-2023-40590 fix capitalized all environment variables on Windows #1646

New issue
Copy link
New issue
Copy link
Closed
#1650
Closed
CVE-2023-40590 fix capitalized all environment variables on Windows#1646
#1650
Copy link
Labels
acknowledgedhelp wanted

Description

@irwand
irwand
opened on Sep 6, 2023
Issue body actions

This fix:
6029211
capitalized all environment variables on Windows. It can be illustrated by this short program:

import subprocess

print(subprocess.check_output(
    "set | findstr /c:SystemRoot /i", shell=True, universal_newlines=True
))

import git

print(subprocess.check_output(
    "set | findstr /c:SystemRoot /i", shell=True, universal_newlines=True
))

The output is:

SystemRoot=C:\Windows

SYSTEMROOT=C:\Windows

This side effect breaks our use case currently. We use gnu make in cygwin for our build, in which all environment variables are case sensitive.

The core problem was unittest.mock.patch.dict(os.environ, {"NoDefaultCurrentDirectoryInExePath": "1"}) -- in which it will try to treat os.environ as a dictionary, but os.environ is not just a simple dictionary. It actually remembers the original casing of the environment variable. Unfortunately when reading it as dictionary it capitalize all letters.

We can also observe the same side effect with this code below:

import os
import subprocess
import unittest.mock

print(subprocess.check_output(
    "set | findstr /c:SystemRoot /i", shell=True, universal_newlines=True
))

with unittest.mock.patch.dict(os.environ, {"NoDefaultCurrentDirectoryInExePath": "1"}):
    pass

print(subprocess.check_output(
    "set | findstr /c:SystemRoot /i", shell=True, universal_newlines=True
))

The side effect is the same as above.

Activity

  1. Byron
    added
    acknowledged
    on Sep 7, 2023
  2. Byron commented on Sep 7, 2023

    @Byron
    Byron
    on Sep 7, 2023
    Member
    More actions

    Thanks for reporting!

    It's an unexpected side-effect for sure :/. Maybe there are other ways to solve the original problem instead of affecting the callers os.environ like that.

    CC @EliahKagan

  3. Byron
    added
    help wanted
    on Sep 7, 2023
  4. Byron
    closed this as completedin #1650on Sep 7, 2023
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

No one assigned

    Labels

    acknowledgedhelp wanted

    Type

    No type

    Projects

    No projects

      Milestone

      No milestone

      Relationships

      None yet

      Development

      No branches or pull requests

      Issue actions

      You are visitor 01402503 — GeezerVison does not store the pages you look up.
      Best viewed with Netscape Navigator 4.7 or Internet Explorer 6 at 800×600. No cookies required.