sgerrand / git_hoox / 31518650958

98%

push

github

fix(hooks): block filename argument injection via -- terminator (#19)

* fix(hooks): terminate mix argv with -- to block filename injection

Built-in Format, Credo, and Test hooks appended git-supplied filenames
to the mix argv with no options terminator. A staged/pulled file whose
name begins with `-` reached mix as an option, not a path. For Format
this is RCE: a file named `--dot-formatter=payload.exs` (plus a sibling
payload) makes `mix format` eval the payload via Code.eval_file.

Insert `--` before the file list in all three hooks so mix treats every
following token as a path. Credo moves from `--files-included <files>` to
positional paths after `--`; verified this still restricts analysis to
the changed files.

Adds regression tests asserting a dash-leading name lands after `--`.

* docs: note -- separator in hook argument order

Reflect the new argv shape for the Format, Credo, and Test hooks in the
README so the documented order matches what the hooks now emit.

* fix(hooks): terminate Mix append_files argv with --

GitHoox.Hooks.Mix appended git-supplied paths straight after the user
args when append_files: true, so a file whose name begins with `-`
reached the invoked task as an option rather than a path. This was the
last built-in hook missing the terminator added in e225a21.

Insert `--` before the file list. The invoked task must parse `--` as an
options terminator; anything built on OptionParser does. A task reading
System.argv/0 raw now sees a literal "--" in its path list — use
GitHoox.Hooks.Shell with {files} for those. Documented in the moduledoc
and README.

Also corrects the README argument-order summary for GitHoox.Hooks.Test,
which omitted the optional --stale flag.

* test(support): drop inherited GIT_* vars in the git fixture

GitFixture.sh/2 set four hermetic env vars but left the rest of the
environment alone. Git exports GIT_DIR, GIT_INDEX_FILE and GIT_PREFIX
into every hook it runs, so `mix test` invoked from a pre-push ho... (continued)

5 of 5 new or added lines in 4 files covered. (100.0%)

590 of 600 relevant lines covered (98.33%)

28.58 hits per line