Hacker News new | ask | show | jobs
by varenc 14 days ago
On Windows, if your shell was in a malicious repo's directory and you ran any "git" command, wouldn't the behavior be the same? Binaries in the current directory are considered before PATH. This seems like a broader issue.

That said, Cursor should at least have some "trust this directory?" dialogue.
1 comments
psd1 14 days ago
Not in powershell, no, because . is not in PATH (unless you put it there).

If you tab-complete `git` it will resolve to `.\git.exe` but it you merely hit enter then it will search PATH and not the CD.

link
varenc 13 days ago
great point! Though what about the default windows APIs for 'calling out to shell'. Like using `subprocess.run(...)` in Python. My suspicion is that works like cmd.exe?

edit: answered myself. Seems like subprocess.run works like PowerShell, unless you pass in 'shell=True', then it passes it directly to CMD.exe. And I'm guessing that's what Cursor is doing.

link