{"thread":{"id":"18814","subject":"[PATCH] git-shell: Add 'git-upload-archive' to allowed commands.","startedAt":"2009-04-09T19:58:52Z","lastAt":"2009-04-14T06:09:27Z","messageCount":4,"participants":["Erik Broes","Junio C Hamano","Björn Steinbrink"],"isPatch":true,"patchVersion":1,"patchTotal":null},"messages":[{"id":"110964","messageId":"49DE537C.8070907@ripe.net","threadId":"18814","inReplyTo":null,"subject":"[PATCH] git-shell: Add 'git-upload-archive' to allowed commands.","fromName":"Erik Broes","fromEmail":"erikbroes@ripe.net","sentAt":"2009-04-09T19:58:52Z","receivedAt":"2009-04-09T19:58:52Z","isPatch":true,"sender":{"key":"erikbroes@ripe.net","avatar":null},"body":"This allows for example gitosis to allow use of 'git archive --remote' in a\ncontrolled environment.\n\nSigned-off-by: Erik Broes \n---\n\nThere were some questions on IRC raising (valid) concerns about security.\nIf there is a dangling commit on the remote end and any user would know\nor guess the SHA, it could be retrieved where git-upload-pack will not\nallow so.\n\nWe were unable to find out if this was the original reason git-shell was\nnever extended with git-upload-archive functionality or if it was a simple\noversight. If it was the reason I'm not sure there is an easy way out.\n\n Documentation/git-shell.txt | 6 +++---\n shell.c | 1 +\n 2 files changed, 4 insertions(+), 3 deletions(-)\n\ndiff --git a/Documentation/git-shell.txt b/Documentation/git-shell.txt\nindex 3f8d973..0f3ad81 100644\n--- a/Documentation/git-shell.txt\n+++ b/Documentation/git-shell.txt\n@@ -18,9 +18,9 @@ of server-side GIT commands implementing the pull/push functionality.\n The commands can be executed only by the '-c' option; the shell is not\n interactive.\n\n-Currently, only three commands are permitted to be called, 'git-receive-pack'\n-'git-upload-pack' with a single required argument or 'cvs server' (to invoke\n-'git-cvsserver').\n+Currently, only four commands are permitted to be called, 'git-receive-pack'\n+'git-upload-pack' and 'git-upload-archive' with a single required argument, or\n+'cvs server' (to invoke 'git-cvsserver').\n\n Author\n ------\ndiff --git a/shell.c b/shell.c\nindex e339369..b968be7 100644\n--- a/shell.c\n+++ b/shell.c\n@@ -40,6 +40,7 @@ static struct commands {\n } cmd_list[] = {\n \t{ \"git-receive-pack\", do_generic_cmd },\n \t{ \"git-upload-pack\", do_generic_cmd },\n+\t{ \"git-upload-archive\", do_generic_cmd },\n \t{ \"cvs\", do_cvs_cmd },\n \t{ NULL },\n };\n-- \n1.6.2.1.519.gcf01bc\n"},{"id":"111077","messageId":"7v3acff10x.fsf@gitster.siamese.dyndns.org","threadId":"18814","inReplyTo":"49DE537C.8070907@ripe.net","subject":"Re: [PATCH] git-shell: Add 'git-upload-archive' to allowed commands.","fromName":"Junio C Hamano","fromEmail":"gitster@pobox.com","sentAt":"2009-04-11T19:22:54Z","receivedAt":"2009-04-11T19:22:54Z","isPatch":true,"sender":{"key":"gitster@pobox.com","avatar":"https://avatars.githubusercontent.com/u/54884?v=4"},"body":"Erik Broes writes:\n\n> This allows for example gitosis to allow use of 'git archive --remote' in a\n> controlled environment.\n>\n> Signed-off-by: Erik Broes \n> ---\n>\n> There were some questions on IRC raising (valid) concerns about security.\n> If there is a dangling commit on the remote end and any user would know\n> or guess the SHA, it could be retrieved where git-upload-pack will not\n> allow so.\n>\n> We were unable to find out if this was the original reason git-shell was\n> never extended with git-upload-archive functionality or if it was a simple\n> oversight. If it was the reason I'm not sure there is an easy way out.\n\nCan't the \"security concern\" be addressed by whatever creates the\ncontrolled environment (e.g. gitosis)? For example, git-daemon can be\nconfigured to service upload-archive request, so I do not think it is such\na bad idea to make this available if the site owner wants to use it.\n"},{"id":"111128","messageId":"49E1F5B5.6090500@ripe.net","threadId":"18814","inReplyTo":"7v3acff10x.fsf@gitster.siamese.dyndns.org","subject":"Re: [PATCH] git-shell: Add 'git-upload-archive' to allowed commands.","fromName":"Erik Broes","fromEmail":"erikbroes@ripe.net","sentAt":"2009-04-12T14:07:49Z","receivedAt":"2009-04-12T14:07:49Z","isPatch":true,"sender":{"key":"erikbroes@ripe.net","avatar":null},"body":"> Can't the \"security concern\" be addressed by whatever creates the\n> controlled environment (e.g. gitosis)? For example, git-daemon can be\n> configured to service upload-archive request, so I do not think it is such\n> a bad idea to make this available if the site owner wants to use it.\n\nI completely agree. :)\n\n-- \nErik Broes\nDatabase Group\nRIPE NCC\n"},{"id":"111266","messageId":"20090414060927.GA3948@atjola.homenet","threadId":"18814","inReplyTo":"7v3acff10x.fsf@gitster.siamese.dyndns.org","subject":"Re: [PATCH] git-shell: Add 'git-upload-archive' to allowed commands.","fromName":"Björn Steinbrink","fromEmail":"b.steinbrink@gmx.de","sentAt":"2009-04-14T06:09:27Z","receivedAt":"2009-04-14T06:09:27Z","isPatch":true,"sender":{"key":"b.steinbrink@gmx.de","avatar":"https://avatars.githubusercontent.com/u/230962?v=4"},"body":"On 2009.04.11 12:22:54 -0700, Junio C Hamano wrote:\n> Erik Broes writes:\n> \n> > This allows for example gitosis to allow use of 'git archive --remote' in a\n> > controlled environment.\n> >\n> > Signed-off-by: Erik Broes \n> > ---\n> >\n> > There were some questions on IRC raising (valid) concerns about security.\n> > If there is a dangling commit on the remote end and any user would know\n> > or guess the SHA, it could be retrieved where git-upload-pack will not\n> > allow so.\n> >\n> > We were unable to find out if this was the original reason git-shell was\n> > never extended with git-upload-archive functionality or if it was a simple\n> > oversight. If it was the reason I'm not sure there is an easy way out.\n> \n> Can't the \"security concern\" be addressed by whatever creates the\n> controlled environment (e.g. gitosis)? For example, git-daemon can be\n> configured to service upload-archive request, so I do not think it is such\n> a bad idea to make this available if the site owner wants to use it.\n\nBut what about users that just have their shell set to git-shell? IIRC\naround 1.6.0 we had some reports about broken setups because git-shell\nhad been moved to libexec. So apparently there are such setups, and the\nchange would weaken the restrictions for them.\n\nHm?\nBjörn\n"}]}