[PR #4266] [CLOSED] Remove environment variable parsing from SSH server #17309

New Issue

GiteaMirror · 2025-11-02T12:32:15-06:00

GiteaMirror commented

2025-11-02 12:32:15 -06:00

📋 Pull Request Information

Original PR: https://github.com/go-gitea/gitea/pull/4266
Author: @hlandau
Created: 6/17/2018
Status: ❌ Closed

Base: master ← Head: fix-ssh

📝 Commits (3)

4a6466c Remove environment variable parsing from SSH server
fdd9308 Merge branch 'master' into fix-ssh
e0b336c Merge branch 'master' into fix-ssh

📊 Changes

1 file changed (+0 additions, -12 deletions)

View changed files

📝 modules/ssh/ssh.go (+0 -12)

📄 Description

This removes the environment variable parsing code from the SSH server,
which never worked in the first place. Since environment variable
passing doesn't appear to be necessary for the built-in SSH server to
work properly, it's removed to reduce attack surface rather than fixing
it.

The current code processes (untrusted) input in a buggy manner and
passes it to a process invocation which doesn't actually do anything. I
don't think this is an exploitable vulnerability but I haven't looked
at it in detail, and it wouldn't really surprise me if it was.

Closes #1935, an alternative proposal which which partially fixes the
environment variable handling but ultimately still leaves it broken.

Signed-off-by: Hugo Landau hlandau@devever.net

_{🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.}

## 📋 Pull Request Information **Original PR:** https://github.com/go-gitea/gitea/pull/4266 **Author:** [@hlandau](https://github.com/hlandau) **Created:** 6/17/2018 **Status:** ❌ Closed **Base:** `master` ← **Head:** `fix-ssh` --- ### 📝 Commits (3) - [`4a6466c`](https://github.com/go-gitea/gitea/commit/4a6466cca5e05e658da8236cbb0d0e5954b35a28) Remove environment variable parsing from SSH server - [`fdd9308`](https://github.com/go-gitea/gitea/commit/fdd93083770e9128e394ea0099d457b75a4a6b87) Merge branch 'master' into fix-ssh - [`e0b336c`](https://github.com/go-gitea/gitea/commit/e0b336cfc57fe8ad44eea481035483d5022fc0cd) Merge branch 'master' into fix-ssh ### 📊 Changes **1 file changed** (+0 additions, -12 deletions) <details> <summary>View changed files</summary> 📝 `modules/ssh/ssh.go` (+0 -12) </details> ### 📄 Description This removes the environment variable parsing code from the SSH server, which never worked in the first place. Since environment variable passing doesn't appear to be necessary for the built-in SSH server to work properly, it's removed to reduce attack surface rather than fixing it. The current code processes (untrusted) input in a buggy manner and passes it to a process invocation which doesn't actually do anything. I don't *think* this is an exploitable vulnerability but I haven't looked at it in detail, and it wouldn't really surprise me if it was. Closes #1935, an alternative proposal which which partially fixes the environment variable handling but ultimately still leaves it broken. Signed-off-by: Hugo Landau <hlandau@devever.net> --- <sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>

GiteaMirror added the pull-request label 2025-11-02 12:32:15 -06:00

GiteaMirror closed this issue

2025-11-02 12:32:16 -06:00

Sign in to join this conversation.

Branches Tags

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: github-starred/gitea#17309