Repository: sharkdp/bat (language: rust)

Issue:
[Security] Vulnerability report
I would like to report a vulnerability in `bat` but couldn't find proper contact information.
I've checked the GitHub profile of @sharkdp, @eth-p, and @keith-hall, but nobody makes email public.
Where can I report the vulnerability in `bat`?


Discussion / hints:
Please email to mail@david-peter.de. Thank you
If you want to CC me, me@eth-p.dev should work.
Hello @sharkdp, @eth-p,
Thank you for the response!
I've sent an email to the address.

Fix patch:
diff --git a/Cargo.lock b/Cargo.lock
index 37bb2f6c76..64495e27cc 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -1,5 +1,7 @@
 # This file is automatically @generated by Cargo.
 # It is not intended for manual editing.
+version = 3
+
 [[package]]
 name = "adler"
 version = "1.0.2"
@@ -97,6 +99,7 @@ dependencies = [
  "error-chain",
  "git2",
  "globset",
+ "grep-cli",
  "lazy_static",
  "nix",
  "path_abs",
@@ -476,9 +479,9 @@ checksum = "9b919933a397b79c37e33b77bb2aa3dc8eb6e165ad809e58ff75bc7db2e34574"
 
 [[package]]
 name = "globset"
-version = "0.4.6"
+version = "0.4.8"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c152169ef1e421390738366d2f796655fec62621dabbd0fd476f905934061e4a"
+checksum = "10463d9ff00a2a068db14231982f5132edebad0d7660cd956a1c30292dbcbfbd"
 dependencies = [
  "aho-corasick",
  "bstr",
@@ -487,6 +490,23 @@ dependencies = [
  "regex",
 ]
 
+[[package]]
+name = "grep-cli"
+version = "0.1.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2dd110c34bb4460d0de5062413b773e385cbf8a85a63fc535590110a09e79e8a"
+dependencies = [
+ "atty",
+ "bstr",
+ "globset",
+ "lazy_static",
+ "log",
+ "regex",
+ "same-file",
+ "termcolor",
+ "winapi-util",
+]
+
 [[package]]
 name = "hashbrown"
 version = "0.9.1"
@@ -1143,6 +1163,15 @@ dependencies = [
  "winapi",
 ]
 
+[[package]]
+name = "termcolor"
+version = "1.1.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2dfed899f0eb03f32ee8c6a0aabdb8a7949659e3466561fc0adf54e26d88c5f4"
+dependencies = [
+ "winapi-util",
+]
+
 [[package]]
 name = "terminal_size"
 version = "0.1.16"
diff --git a/Cargo.toml b/Cargo.toml
index 42a9f50f32..e9b99b688f 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -51,6 +51,7 @@ path_abs = { version = "0.5", default-features = false }
 clircle = "0.3"
 bugreport = "0.4"
 dirs-next = { version = "2.0.0", optional = true }
+grep-cli = "0.1.6"
 
 [dependencies.git2]
 version = "0.13"
diff --git a/src/bin/bat/main.rs b/src/bin/bat/main.rs
index dadcc673b0..fb407b90d7 100644
--- a/src/bin/bat/main.rs
+++ b/src/bin/bat/main.rs
@@ -231,7 +231,7 @@ fn run() -> Result<bool> {
         let pager = bat::config::get_pager_executable(app.matches.value_of("pager"))
             .unwrap_or_else(|| "less".to_owned()); // FIXME: Avoid non-canonical path to "less".
 
-        bugreport!()
+        let report = bugreport!()
             .info(SoftwareVersion::default())
             .info(OperatingSystem::default())
             .info(CommandLine::default())
@@ -253,9 +253,19 @@ fn run() -> Result<bool> {
                 "MANPAGER",
             ]))
             .info(FileContent::new("Config file", config_file()))
-            .info(CompileTimeInformation::default())
-            .info(CommandOutput::new("Less version", pager, &["--version"]))
-            .print::<Markdown>();
+            .info(CompileTimeInformation::default());
+
+        let mut report = if let Ok(resolved_path) = grep_cli::resolve_binary(pager) {
+            report.info(CommandOutput::new(
+                "Less version",
+                resolved_path,
+                &["--version"],
+            ))
+        } else {
+            report
+        };
+
+        report.print::<Markdown>();
 
         return Ok(true);
     }
diff --git a/src/less.rs b/src/less.rs
index f1adca81a3..2575fe1818 100644
--- a/src/less.rs
+++ b/src/less.rs
@@ -4,7 +4,9 @@ use std::ffi::OsStr;
 use std::process::Command;
 
 pub fn retrieve_less_version(less_path: &dyn AsRef<OsStr>) -> Option<usize> {
-    let cmd = Command::new(less_path).arg("--version").output().ok()?;
+    let resolved_path = grep_cli::resolve_binary(less_path.as_ref()).ok()?;
+
+    let cmd = Command::new(resolved_path).arg("--version").output().ok()?;
     parse_less_version(&cmd.stdout)
 }
 
diff --git a/src/output.rs b/src/output.rs
index 4aff768681..8bc2da0c74 100644
--- a/src/output.rs
+++ b/src/output.rs
@@ -63,7 +63,14 @@ impl OutputType {
             return Err(ErrorKind::InvalidPagerValueBat.into());
         }
 
-        let mut p = Command::new(&pager.bin);
+        let resolved_path = match grep_cli::resolve_binary(&pager.bin) {
+            Ok(path) => path,
+            Err(_) => {
+                return Ok(OutputType::stdout());
+            }
+        };
+
+        let mut p = Command::new(resolved_path);
         let args = pager.args;
 
         if pager.kind == PagerKind::Less {


Test patch: