Similarly to git (CVE-2017-1000117), Subversion (CVE-2017-9800), and
Mercurial (CVE-2017-1000116), options for scp/ssh/etc. can be smuggled
in a darcs repository URL. For example:
darcs get 'ssh://-oProxyCommand=xdg-open https:example.com/'
I believe darcs offers no obvious way (such as git submodules) to
deliver such an "evil" URL to an unsuspecting user, but I think this is
still an unexpected security hazard.
|