git_connect: avoid full shell when executing git-upload-pack

When the `git-upload-pack` program is supposed to be called, we do not
actually need to run this through a shell... This reduces the security
surface of running Git on servers a bit.

Signed-off-by: Johannes Schindelin <johannes.schindelin@gmx.de>

Author: dscho

connect.c

@@ -1459,7 +1459,6 @@ struct child_process *git_connect(int fd[2], const char *url,
 		conn = git_connect_git(fd, hostandport, path, prog, version, flags);
 		conn->trace2_child_class = "transport/git";
 	} else {
-		struct strbuf cmd = STRBUF_INIT;
 		const char *const *var;
 
 		conn = xmalloc(sizeof(*conn));
@@ -1468,15 +1467,22 @@ struct child_process *git_connect(int fd[2], const char *url,
 		if (looks_like_command_line_option(path))
 			die(_("strange pathname '%s' blocked"), path);
 
-		strbuf_addstr(&cmd, prog);
-		strbuf_addch(&cmd, ' ');
-		sq_quote_buf(&cmd, path);
+		if (conn->args.nr == 0 && !does_cmd_require_shell(prog))
+			/* Trivial case: avoid running through shell */
+			strvec_pushl(&conn->args, prog, path, NULL);
+		else {
+			struct strbuf cmd = STRBUF_INIT;
+			strbuf_addstr(&cmd, prog);
+			strbuf_addch(&cmd, ' ');
+			sq_quote_buf(&cmd, path);
+			strvec_push_nodup(&conn->args, strbuf_detach(&cmd, NULL));
+			conn->use_shell = 1;
+		}
 
 		/* remove repo-local variables from the environment */
 		for (var = local_repo_env; *var; var++)
 			strvec_push(&conn->env, *var);
 
-		conn->use_shell = 1;
 		conn->in = conn->out = -1;
 		if (protocol == PROTO_SSH) {
 			char *ssh_host = hostandport;
@@ -1498,7 +1504,7 @@ struct child_process *git_connect(int fd[2], const char *url,
 				free(path);
 				child_process_clear(conn);
 				free(conn);
-				strbuf_release(&cmd);
+				strvec_clear(&conn->args);
 				return NULL;
 			}
 			conn->trace2_child_class = "transport/ssh";
@@ -1512,14 +1518,12 @@ struct child_process *git_connect(int fd[2], const char *url,
 					     version);
 			}
 		}
-		strvec_push(&conn->args, cmd.buf);
 
 		if (start_command(conn))
 			die(_("unable to fork"));
 
 		fd[0] = conn->out; /* read from child's stdout */
 		fd[1] = conn->in;  /* write to child's stdin */
-		strbuf_release(&cmd);
 	}
 	free(hostandport);
 	free(path);