From: Thomas Guyot <tguyot@gmail.com>
To: "J. Paul Reed" <preed@sigkill.com>
Cc: git@vger.kernel.org
Subject: Re: Odd git-config behavior
Date: Wed, 9 Nov 2022 02:02:25 -0500 [thread overview]
Message-ID: <536bcbc6-df12-e3b8-f995-35adfd311a84@gmail.com> (raw)
In-Reply-To: <Y2rhfTYDEGQ7EhaS@sigkill.com>
On 2022-11-08 18:08, J. Paul Reed wrote:
> This does beg the question: does running "git fsck" on an untrusted
> repository as another user present a [security] problem?
>
> If so, should it?
Probably not, but I can't say for sure. Even some seemingly safe
commands can be dangerous in this context; for example "git gc --auto"
invokes a hook which could execute arbitrary code if run on an untrusted
repo.
I haven't read the CVE but did notice the change - the primary issue if
I'm not mistaken is when git behaves differently when there is a .git
dir that could have been placed by a malicious user. I believe a safe
approach has been taken where we have to explicitly whitelist repos or
paths where the repos are trusted
>> What was the return code for the git config command? If it was zero when
>> it didn't parse/output the config option you asked for that is
>> definitively a bug. If you failed to check the return code of git-config
>> then you should fix your script/tool instead.
> underworld # ~preed/src/git/git --version
> git version 2.30.2.4.g8959555cee
> underworld # GIT_PAGER=cat ~preed/src/git/git-config -l
> underworld # echo $?
> 0
We should test with the latest version... If git ignores the config it
should warn (like other commands do) and not return 0.
Since git normally uses the global config when not a repo, it appears it
keeps looking for the global config after it decides the local one is no
good. What you see with this command is your global config not your
repo's config.
Regards,
--
Thomas
prev parent reply other threads:[~2022-11-09 7:02 UTC|newest]
Thread overview: 4+ messages / expand[flat|nested] mbox.gz Atom feed top
2022-10-31 20:51 Odd git-config behavior J. Paul Reed
2022-11-04 11:47 ` Thomas Guyot
2022-11-08 23:08 ` J. Paul Reed
2022-11-09 7:02 ` Thomas Guyot [this message]
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=536bcbc6-df12-e3b8-f995-35adfd311a84@gmail.com \
--to=tguyot@gmail.com \
--cc=git@vger.kernel.org \
--cc=preed@sigkill.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for read-only IMAP folder(s) and NNTP newsgroup(s).