If a command setting like diff-command is accidentally set to an empty string, fossil accepts this, and will execute command lines based on this.

For e.g. diff-command, this means fossil attemps to execute a temporary file.

I'd see two types of events where this might happen:

1. Someone clears the string value in the /setup_settings interface.
2. Someone thinks an empty value causes the setting to be unset or ignored.

Afaict, there currently is no way to unset the value from /setup_settings.

I have a local patch that addresses this, but no check-in rights (still pending, after I sent waiver in forumpost/a80cbc79ff).

I have not looked into the effect of having empty string values for e.g. log names, some of the email-xxx settings, etc. I imagine having set these in the ui, then clearing the field, could affect other commands in unexpected ways.

If anybody wants to look at this, below is a mangled version that uses no sensible variables and have a couple of small obfuscations and coding style deviations that would probably need adressing if applied. Don't know if that is sufficient for others to work with it easily.

Index: src/db.c
==================================================================
--- src/db.c
+++ src/db.c
@@ -5114,10 +5114,14 @@
       }
       if( unsetFlag ){
         db_unset(pSetting->name/*works-like:"x"*/, globalFlag);
       }else{
         db_protect_only(PROTECT_NONE);
+        ( (!g.argv[3][0]) && 
+          strrchr(pSetting->name, '-') != NULL &&
+          fossil_stricmp(strrchr(pSetting->name, '-'), "-COMMAND") == 0)
+        ? db_unset(pSetting->name/*works-like:"x"*/, globalFlag) :
         db_set(pSetting->name/*works-like:"x"*/, g.argv[3], globalFlag);
         db_protect_pop();
       }
       if( isManifest && g.localOpen ){
         manifest_to_disk(db_lget_int("checkout", 0));

Index: src/setup.c
==================================================================
--- src/setup.c
+++ src/setup.c
@@ -240,10 +240,14 @@
   const char *zQ = P(zQParm);
   if( zQ && fossil_strcmp(zQ,zVal)!=0 && cgi_csrf_safe(2) ){
     const int nZQ = (int)strlen(zQ);
     setup_incr_cfgcnt();
     db_protect_only(PROTECT_NONE);
+    ( (!zQ[0]) && 
+      strrchr(zVar, '-') != NULL &&
+      fossil_stricmp(strrchr(zVar, '-'), "-COMMAND") == 0)
+    ? db_unset(zVar/*works-like:"x"*/, 0) :
     db_set(zVar/*works-like:"x"*/, zQ, 0);
     db_protect_pop();
     admin_log("Set entry_attribute %Q to: %.*s%s",
               zVar, 20, zQ, (nZQ>20 ? "..." : ""));
     zVal = zQ;