Language: Python
Label: vulnerable
CWE: CWE-78 \u2014 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

Code:
    def _find_working_git(self):
        test_cmd = 'version'

        if app.GIT_PATH:
            main_git = '"' + app.GIT_PATH + '"'
        else:
            main_git = 'git'

        log.debug(u'Checking if we can use git commands: {0} {1}', main_git, test_cmd)
        _, _, exit_status = self._run_git(main_git, test_cmd)

        if exit_status == 0:
            log.debug(u'Using: {0}', main_git)
            return main_git
        else:
            log.debug(u'Not using: {0}', main_git)

        # trying alternatives
        alternative_git = []

        # osx people who start sr from launchd have a broken path, so try a hail-mary attempt for them
        if platform.system().lower() == 'darwin':
            alternative_git.append('/usr/local/git/bin/git')

        if platform.system().lower() == 'windows':
            if main_git != main_git.lower():
                alternative_git.append(main_git.lower())

        if alternative_git:
            log.debug(u'Trying known alternative git locations')

            for cur_git in alternative_git:
                log.debug(u'Checking if we can use git commands: {0} {1}', cur_git, test_cmd)
                _, _, exit_status = self._run_git(cur_git, test_cmd)

                if exit_status == 0:
                    log.debug(u'Using: {0}', cur_git)
                    return cur_git
                else:
                    log.debug(u'Not using: {0}', cur_git)