SG-073: Dangerous git env-var injection
Severity: HIGH
Setting GIT_EXTERNAL_DIFF / GIT_PAGER / GIT_EDITOR / GIT_SEQUENCE_EDITOR / GIT_SSH_COMMAND turns a benign git command into arbitrary RCE.
Fires when
- A git external-binary env var (GIT_EXTERNAL_DIFF, GIT_PAGER, GIT_EDITOR, GIT_SEQUENCE_EDITOR, GIT_SSH_COMMAND, GIT_SSH) is assigned a value, redirecting a benign git command into code execution.
- Escalates to CRITICAL when the value points into /tmp, /var/tmp, /dev, a URL, or contains $()/backtick/exec/bash/sh.
Remediation
No safe remediation: a file that triggers this rule should be rejected, not patched. Read the flagged lines in the source before deciding.