diff --git a/hgext/convert/common.py b/hgext/convert/common.py

index e27346b..842ae71 100644

--- a/hgext/convert/common.py

+++ b/hgext/convert/common.py

@@ -295,6 +295,9 @@ class commandline(object):

     def _run2(self, cmd, *args, **kwargs):

         return self._dorun(util.popen2, cmd, *args, **kwargs)

+    def _run3(self, cmd, *args, **kwargs):

+        return self._dorun(util.popen3, cmd, *args, **kwargs)

+

     def _dorun(self, openfunc, cmd,  *args, **kwargs):

         cmdline = self._cmdline(cmd, *args, **kwargs)

         self.ui.debug('running: %s\n' % (cmdline,))

diff --git a/hgext/convert/git.py b/hgext/convert/git.py

index 3fd0884..8123b55 100644

--- a/hgext/convert/git.py

+++ b/hgext/convert/git.py

@@ -7,11 +7,11 @@

 import os

 import subprocess

-from mercurial import util, config

+from mercurial import util, config, error

 from mercurial.node import hex, nullid

 from mercurial.i18n import _

-from common import NoRepo, commit, converter_source, checktool

+from common import NoRepo, commit, converter_source, checktool, commandline

 class submodule(object):

     def __init__(self, path, node, url):

@@ -25,54 +25,32 @@ class submodule(object):

     def hgsubstate(self):

         return "%s %s" % (self.node, self.path)

-class convert_git(converter_source):

+class convert_git(converter_source, commandline):

     # Windows does not support GIT_DIR= construct while other systems

     # cannot remove environment variable. Just assume none have

     # both issues.

-    if util.safehasattr(os, 'unsetenv'):

-        def gitopen(self, s, err=None):

-            prevgitdir = os.environ.get('GIT_DIR')

-            os.environ['GIT_DIR'] = self.path

-            try:

-                if err == subprocess.PIPE:

-                    (stdin, stdout, stderr) = util.popen3(s)

-                    return stdout

-                elif err == subprocess.STDOUT:

-                    return self.popen_with_stderr(s)

-                else:

-                    return util.popen(s, 'rb')

-            finally:

-                if prevgitdir is None:

-                    del os.environ['GIT_DIR']

-                else:

-                    os.environ['GIT_DIR'] = prevgitdir

-    else:

-        def gitopen(self, s, err=None):

-            if err == subprocess.PIPE:

-                (sin, so, se) = util.popen3('GIT_DIR=%s %s' % (self.path, s))

-                return so

-            elif err == subprocess.STDOUT:

-                    return self.popen_with_stderr(s)

-            else:

-                return util.popen('GIT_DIR=%s %s' % (self.path, s), 'rb')

-

-    def popen_with_stderr(self, s):

-        p = subprocess.Popen(s, shell=True, bufsize=-1,

-                             close_fds=util.closefds,

-                             stdin=subprocess.PIPE,

-                             stdout=subprocess.PIPE,

-                             stderr=subprocess.STDOUT,

-                             universal_newlines=False,

-                             env=None)

-        return p.stdout

-

-    def gitread(self, s):

-        fh = self.gitopen(s)

-        data = fh.read()

-        return data, fh.close()

+

+    def _gitcmd(self, cmd, *args, **kwargs):

+        return cmd('--git-dir=%s' % self.path, *args, **kwargs)

+

+    def gitrun0(self, *args, **kwargs):

+        return self._gitcmd(self.run0, *args, **kwargs)

+

+    def gitrun(self, *args, **kwargs):

+        return self._gitcmd(self.run, *args, **kwargs)

+

+    def gitrunlines0(self, *args, **kwargs):

+        return self._gitcmd(self.runlines0, *args, **kwargs)

+

+    def gitrunlines(self, *args, **kwargs):

+        return self._gitcmd(self.runlines, *args, **kwargs)

+

+    def gitpipe(self, *args, **kwargs):

+        return self._gitcmd(self._run3, *args, **kwargs)

     def __init__(self, ui, path, rev=None):

         super(convert_git, self).__init__(ui, path, rev=rev)

+        commandline.__init__(self, ui, 'git')

         if os.path.isdir(path + "/.git"):

             path += "/.git"

@@ -86,11 +64,11 @@ class convert_git(converter_source):

     def getheads(self):

         if not self.rev:

-            heads, ret = self.gitread('git rev-parse --branches --remotes')

-            heads = heads.splitlines()

+            output, ret = self.gitrun('rev-parse', '--branches', '--remotes')

+            heads = output.splitlines()

         else:

-            heads, ret = self.gitread("git rev-parse --verify %s" % self.rev)

-            heads = [heads[:-1]]

+            rawhead, ret = self.gitrun('rev-parse', '--verify', self.rev)

+            heads = [rawhead[:-1]]

         if ret:

             raise util.Abort(_('cannot retrieve git heads'))

         return heads

@@ -98,7 +76,7 @@ class convert_git(converter_source):

     def catfile(self, rev, type):

         if rev == hex(nullid):

             raise IOError

-        data, ret = self.gitread("git cat-file %s %s" % (type, rev))

+        data, ret = self.gitrun('cat-file', type, rev)

         if ret:

             raise util.Abort(_('cannot read %r object at %s') % (type, rev))

         return data

@@ -137,25 +115,28 @@ class convert_git(converter_source):

                 self.submodules.append(submodule(s['path'], '', s['url']))

     def retrievegitmodules(self, version):

-        modules, ret = self.gitread("git show %s:%s" % (version, '.gitmodules'))

+        modules, ret = self.gitrun('show', '%s:%s' % (version, '.gitmodules'))

         if ret:

             raise util.Abort(_('cannot read submodules config file in %s') %

                              version)

         self.parsegitmodules(modules)

         for m in self.submodules:

-            node, ret = self.gitread("git rev-parse %s:%s" % (version, m.path))

+            node, ret = self.gitrun('rev-parse', '%s:%s' % (version, m.path))

             if ret:

                 continue

             m.node = node.strip()

     def getchanges(self, version):

         self.modecache = {}

-        fh = self.gitopen("git diff-tree -z --root -m -r %s" % version)

+        cmd = ['diff-tree','-z', '--root', '-m', '-r'] + [version]

+        output, status = self.gitrun(*cmd)

+        if status:

+            raise error.Abort(_('cannot read changes in %s') % version)

         changes = []

         seen = set()

         entry = None

         subexists = False

-        for l in fh.read().split('\x00'):

+        for l in output.split('\x00'):

             if not entry:

                 if not l.startswith(':'):

                     continue

@@ -178,8 +159,6 @@ class convert_git(converter_source):

                     self.modecache[(f, h)] = (p and "x") or (s and "l") or ""

                     changes.append((f, h))

             entry = None

-        if fh.close():

-            raise util.Abort(_('cannot read changes in %s') % version)

         if subexists:

             self.retrievegitmodules(version)

@@ -224,12 +203,14 @@ class convert_git(converter_source):

     def gettags(self):

         tags = {}

         alltags = {}

-        fh = self.gitopen('git ls-remote --tags "%s"' % self.path,

-                          err=subprocess.STDOUT)

+        output, status = self.gitrunlines('ls-remote', '--tags', self.path)

+

+        if status:

+            raise error.Abort(_('cannot read tags from %s') % self.path)

         prefix = 'refs/tags/'

         # Build complete list of tags, both annotated and bare ones

-        for line in fh:

+        for line in output:

             line = line.strip()

             if line.startswith("error:") or line.startswith("fatal:"):

                 raise util.Abort(_('cannot read tags from %s') % self.path)

@@ -237,8 +218,6 @@ class convert_git(converter_source):

             if not tag.startswith(prefix):

                 continue

             alltags[tag[len(prefix):]] = node

-        if fh.close():

-            raise util.Abort(_('cannot read tags from %s') % self.path)

         # Filter out tag objects for annotated tag refs

         for tag in alltags:

@@ -255,18 +234,20 @@ class convert_git(converter_source):

     def getchangedfiles(self, version, i):

         changes = []

         if i is None:

-            fh = self.gitopen("git diff-tree --root -m -r %s" % version)

-            for l in fh:

+            output, status = self.gitrunlines('diff-tree', '--root', '-m',

+                                              '-r', version)

+            if status:

+                raise error.Abort(_('cannot read changes in %s') % version)

+            for l in output:

                 if "\t" not in l:

                     continue

                 m, f = l[:-1].split("\t")

                 changes.append(f)

         else:

-            fh = self.gitopen('git diff-tree --name-only --root -r %s '

-                              '"%s^%s" --' % (version, version, i + 1))

-            changes = [f.rstrip('\n') for f in fh]

-        if fh.close():

-            raise util.Abort(_('cannot read changes in %s') % version)

+            output, status = self.gitrunlines('diff-tree', '--name-only',

+                                              '--root', '-r', version,

+                                              '%s^%s' % (version, i + 1), '--')

+            changes = [f.rstrip('\n') for f in output]

         return changes

@@ -278,14 +259,14 @@ class convert_git(converter_source):

         prefixlen = len(prefix)

         # factor two commands

-        gitcmd = { 'remote/': 'git ls-remote --heads origin',

-                          '': 'git show-ref'}

+        gitcmd = { 'remote/': ['ls-remote', '--heads origin'],

+                          '': ['show-ref']}

         # Origin heads

         for reftype in gitcmd:

             try:

-                fh = self.gitopen(gitcmd[reftype], err=subprocess.PIPE)

-                for line in fh:

+                output, status = self.gitrunlines(*gitcmd[reftype])

+                for line in output:

                     line = line.strip()

                     rev, name = line.split(None, 1)

                     if not name.startswith(prefix):

diff --git a/tests/test-convert-git.t b/tests/test-convert-git.t

index 21f18d2..7eb068b 100644

--- a/tests/test-convert-git.t

+++ b/tests/test-convert-git.t

@@ -341,7 +341,7 @@ damage git repository by renaming a commit object

   $ COMMIT_OBJ=1c/0ce3c5886f83a1d78a7b517cdff5cf9ca17bdd

   $ mv git-repo4/.git/objects/$COMMIT_OBJ git-repo4/.git/objects/$COMMIT_OBJ.tmp

   $ hg convert git-repo4 git-repo4-broken-hg 2>&1 | grep 'abort:'

-  abort: cannot read tags from git-repo4/.git

+  abort: cannot retrieve number of commits in git-repo4/.git

   $ mv git-repo4/.git/objects/$COMMIT_OBJ.tmp git-repo4/.git/objects/$COMMIT_OBJ

 damage git repository by renaming a blob object

@@ -356,3 +356,20 @@ damage git repository by renaming a tree object

   $ mv git-repo4/.git/objects/$TREE_OBJ git-repo4/.git/objects/$TREE_OBJ.tmp

   $ hg convert git-repo4 git-repo4-broken-hg 2>&1 | grep 'abort:'

   abort: cannot read changes in 1c0ce3c5886f83a1d78a7b517cdff5cf9ca17bdd

+

+test for escaping the repo name (CVE-2016-3069)

+

+  $ git init '`echo pwned >COMMAND-INJECTION`'

+  Initialized empty Git repository in $TESTTMP/`echo pwned >COMMAND-INJECTION`/.git/

+  $ cd '`echo pwned >COMMAND-INJECTION`'

+  $ git commit -q --allow-empty -m 'empty'

+  $ cd ..

+  $ hg convert '`echo pwned >COMMAND-INJECTION`' 'converted'

+  initializing destination converted repository

+  scanning source...

+  sorting...

+  converting...

+  0 empty

+  updating bookmarks

+  $ test -f COMMAND-INJECTION

+  [1]