Merge pull request #325 from ogr3/bash-git-rc

[security] Check the syntax of .bash-git-rc before sourcing it, Fixes #324

gitprompt.sh

@@ -346,8 +346,14 @@ function setGitPrompt() {
   unset GIT_PROMPT_SHOW_UNTRACKED_FILES
 
   if [[ -e "$repo/.bash-git-rc" ]]; then
+    # The config file can only contain variable declarations on the form A_B=0 or G_P=all
+    local CONFIG_SYNTAX="^(FETCH_REMOTE_STATUS|GIT_PROMPT_SHOW_UNTRACKED_FILES|GIT_PROMPT_IGNORE)=[0-9a-z]+$"
+    if egrep -q -v "$CONFIG_SYNTAX" "$repo/.bash-git-rc"; then
+      echo ".bash-git-rc can only contain variable values on the form NAME=value. Ignoring file." >&2
+    else
       source "$repo/.bash-git-rc"
     fi
+  fi
 
   if [ -z "${GIT_PROMPT_SHOW_UNTRACKED_FILES}" ]; then
     GIT_PROMPT_SHOW_UNTRACKED_FILES=${OLD_GIT_PROMPT_SHOW_UNTRACKED_FILES}