Re:Remote code execution, git, and OS X
by atdt on Monday April 18, 2016 @02:23AM
(#11518018)
It's a bit too precarious to be an adequate solution, in my opinion. It depends on /usr/local/bin always being ahead of /usr/bin in $PATH, and on scripts never invoking the system git via its full path, and on Homebrew never accidentally uninstalling git due to a botched upgrade. Not to mention the fact that Homebrew itself uses the system git to install itself.
[ Parent
| on HN ]
> Not to mention the fact that Homebrew itself uses the system git to install itself.
To me, this is the biggest problem, and it's not just Homebrew. Any source package manager that uses Git will potentially have this problem. With a vulnerable Git on your system, you have to second-guess every build script you ever run that might make use of Git, to make sure it obeys the path you set instead of choosing its own.
When would the order of $PATH vary?
When someone's changed it? Which people do _all the time_.
Mine is changed for Heroku, but it only prepends. I've never seen $PATH be rearranged.
If you prefix it with something already in there then it's effectively rearranged.
You wouldn't do this deliberately, of course, but it happens a lot - people end up with massive PATHs because they blindly prefix when something's gone wrong and it _may_ be the solution.
I was thinking prepending and appending aren't rearranging.
The important part of my above sentence was "with something already there".
If $PATH == 'a:b' and you do `export PATH=b:$PATH, then you've basically rearranged it. It may as well be 'b:a'.