{"thread":{"id":"50237","subject":"Re: Git bomb still present (at least in SUSE)?","startedAt":"2019-01-16T02:51:15Z","lastAt":"2019-01-17T12:26:18Z","messageCount":2,"participants":["Jonathan Nieder","Marketa Calabkova"],"isPatch":false,"patchVersion":null,"patchTotal":null},"messages":[{"id":"366791","messageId":"20190116025110.GD8864@google.com","threadId":"50237","inReplyTo":"20190115180031.GA31834@sigill.intra.peff.net","subject":"Re: Git bomb still present (at least in SUSE)?","fromName":"Jonathan Nieder","fromEmail":"jrnieder@gmail.com","sentAt":"2019-01-16T02:51:10Z","receivedAt":"2019-01-16T02:51:15Z","isPatch":false,"sender":{"key":"jrnieder@gmail.com","avatar":"https://avatars.githubusercontent.com/u/281595?v=4"},"body":"(moving conversation to the main Git list.  I hope that's okay.)\nHi,\n\nJeff King wrote:\n> On Tue, Jan 15, 2019 at 02:35:29PM +0100, Marketa Calabkova wrote:\n\n>> meggy@irbis:/tmp/test> /usr/bin/time git clone\n>> https://github.com/Katee/git-bomb.git\n>> Cloning into 'git-bomb'...\n>> remote: Enumerating objects: 18, done.\n>> remote: Total 18 (delta 0), reused 0 (delta 0), pack-reused 18\n>> Unpacking objects: 100% (18/18), done.\n>> ^Cwarning: Clone succeeded, but checkout failed.\n[...]\n>   git clone --bare https://github.com/Katee/git-bomb.git\n>   cd git-bomb.git\n>   git read-tree HEAD ;# yikes!\n>\n> So I don't think there's a bug per se. It is possible that Git could\n> have better protections against maliciously gigantic repositories, but I\n> don't think anybody is actively working on such a feature (and it would\n> involve much more than this case; it's pretty easy to generate trees\n> with pessimal diffs, etc).\n\nOne thing I think interested people could do is introduce some kind of\n\"limits\" subsystem into Git, so that a person could configure Git to\nrefuse to even try when it notices that an operation is going to be\nsufficiently expensive.  I.e. something similar to what rlimits (or\nother limits e.g. enforced in cgroups) provide in an operating system.\n\nThat said, as alluded to in the last paragraph, there's also some\nprotection possible at the operating system level.\n\nSo my feeling is that there's some real potential for improvement\nhere, and I'm happy to help mentor anyone working on it if it is their\nitch (because of the \"can handle at another level\" thing, it is not\nmine).\n\nThanks,\nJonathan\n"},{"id":"366910","messageId":"e212c318-8158-23b4-5a84-b178c0979c14@suse.cz","threadId":"50237","inReplyTo":"20190116025110.GD8864@google.com","subject":"Re: Git bomb still present (at least in SUSE)?","fromName":"Marketa Calabkova","fromEmail":"mcalabkova@suse.cz","sentAt":"2019-01-17T12:26:13Z","receivedAt":"2019-01-17T12:26:18Z","isPatch":false,"sender":{"key":"mcalabkova@suse.cz","avatar":null},"body":"Hi,\n\nJonathan Nieder wrote:\n> Jeff King wrote:\n>> On Tue, Jan 15, 2019 at 02:35:29PM +0100, Marketa Calabkova wrote:\n>>> meggy@irbis:/tmp/test> /usr/bin/time git clone\n>>> https://github.com/Katee/git-bomb.git\n>>> Cloning into 'git-bomb'...\n>>> remote: Enumerating objects: 18, done.\n>>> remote: Total 18 (delta 0), reused 0 (delta 0), pack-reused 18\n>>> Unpacking objects: 100% (18/18), done.\n>>> ^Cwarning: Clone succeeded, but checkout failed.\n> [...]\n>>   git clone --bare https://github.com/Katee/git-bomb.git\n>>   cd git-bomb.git\n>>   git read-tree HEAD ;# yikes!\n>>\n>> So I don't think there's a bug per se. It is possible that Git could\n>> have better protections against maliciously gigantic repositories, but I\n>> don't think anybody is actively working on such a feature (and it would\n>> involve much more than this case; it's pretty easy to generate trees\n>> with pessimal diffs, etc).\nThanks for your answer, now I finally understand what the fix is about.\n> One thing I think interested people could do is introduce some kind of\n> \"limits\" subsystem into Git, so that a person could configure Git to\n> refuse to even try when it notices that an operation is going to be\n> sufficiently expensive.  I.e. something similar to what rlimits (or\n> other limits e.g. enforced in cgroups) provide in an operating system.\n>\n> That said, as alluded to in the last paragraph, there's also some\n> protection possible at the operating system level.\n>\n> So my feeling is that there's some real potential for improvement\n> here, and I'm happy to help mentor anyone working on it if it is their\n> itch (because of the \"can handle at another level\" thing, it is not\n> mine).\nThank you, I am interested. Mostly for educational purpose, I have to say,\nI would like to contribute on such a big project as git is.\n\nI would be happy if you help me with that. How can git know how big the\nrepository is before it tries to checkout? Or do you think it is OK to\nstart the operation, notice it is already too expensive and kill it? And,\nwell, how to easily track how expensive the operation is (e. g. not in the\nparticular operation)?\n\nGreetings,\nMarketa\n\n"}]}