Merge pull request #9827 from pradyunsg/fix-git-improper-tag-handling

Don't split git references on unicode separators
pypa · Apr 24, 2021 · e46bdda · e46bdda
2 parents 1320bac + 0e4938d
commit e46bdda
Show file tree

Hide file tree

Showing 2 changed files with 11 additions and 2 deletions.
diff --git a/news/9827.bugfix.rst b/news/9827.bugfix.rst
@@ -0,0 +1,3 @@
+**SECURITY**: Stop splitting on unicode separators in git references,
+which could be maliciously used to install a different revision on the
+repository.
diff --git a/src/pip/_internal/vcs/git.py b/src/pip/_internal/vcs/git.py
@@ -131,9 +131,15 @@ def get_revision_sha(cls, dest, rev):
             on_returncode='ignore',
         )
         refs = {}
-        for line in output.strip().splitlines():
+        # NOTE: We do not use splitlines here since that would split on other
+        #       unicode separators, which can be maliciously used to install a
+        #       different revision.
+        for line in output.strip().split("\n"):
+            line = line.rstrip("\r")
+            if not line:
+                continue
             try:
-                ref_sha, ref_name = line.split()
+                ref_sha, ref_name = line.split(" ", maxsplit=2)
             except ValueError:
                 # Include the offending line to simplify troubleshooting if
                 # this error ever occurs.