Re: Fetch/push lets a malicious server steal the targets of "have" lines

From: Matt McCutchen <matt@mattmccutchen.net>
Date: Nov 13, 2016, 02:10 UTC
Message-ID: <1479003016.3471.18.camel@mattmccutchen.net>
In-Reply-To: <xmqqtwbuuuuy.fsf@gitster.mtv.corp.google.com>

On Sun, 2016-10-30 at 01:03 -0700, Junio C Hamano wrote:

Show 30 quoted lines

> Matt McCutchen <matt@mattmccutchen.net> writes:
> 
> > 
> > On Fri, 2016-10-28 at 22:31 -0700, Junio C Hamano wrote:
> > > 
> > > Not sending to the list, where mails from Gmail/phone is known to
> > > get
> > > rejected.
> > 
> > [I guess I can go ahead and quote this to the list.]
> > 
> > > 
> > > No. I'm saying that the scenario you gave is bad and people
> > > should be
> > > taught not to connect to untrustworthy sites.
> > 
> > To clarify, are you saying:
> > 
> > (1) don't connect to an untrusted server ever (e.g., we don't
> > promise
> > that the server can't execute arbitrary code on the client), or
> > 
> > (2) don't connect to an untrusted server if the client repository
> > has
> > data that needs to be kept secret from the server?
> 
> You sneaked "arbitrary code execution" into the discussion but I do
> not know where it came from.  In any case, "don't pull from or push
> to untrustworthy place" would be a common sense advice that would
> make sense in any scenario ;-)

A blanket statement like that without explanation is not very helpful to users who do find themselves needing to pull from or push to a server they don't absolutely trust. The only "definitely safe" option it leaves them is to run the entire thing in a sandbox. A statement of the nature of the risk is much more helpful: users can determine that they don't care about the risk, or if it does, what the easiest workaround is.

The new risk we discovered in this thread is of leakage of private data from the local repository. To avoid that risk, it's sufficient for users to move private data to a separate repository, so that's the advice I propose to give. Are you aware of issues with fetch/push with potential impact beyond leakage of private data, which would make my proposed text insufficient? I was giving "arbitrary code execution" as an example of what the impact of such an issue could be.

Show 27 quoted lines

> Just for future reference, when you have ideas/issues that might
> have possible security ramifications, I'd prefer to see it first
> discussed on a private list we created for that exact purpose, until
> we can assess the impact (if any).  Right now MaintNotes says this:
> 
>     If you think you found a security-sensitive issue and want to
> disclose
>     it to us without announcing it to wider public, please contact us
> at
>     our security mailing list <git-security@googlegroups.com>.  This
> is
>     a closed list that is limited to people who need to know early
> about
>     vulnerabilities, including:
> 
>       - people triaging and fixing reported vulnerabilities
>       - people operating major git hosting sites with many users
>       - people packaging and distributing git to large numbers of
> people
> 
>     where these issues are discussed without risk of the information
>     leaking out before we're ready to make public announcements.
> 
> We may want to tweak the description from "disclose it to us" to
> "have a discussion on it with us" (the former makes it sound as if
> the topic has to be a definite problem, the latter can include an
> idle speculation that may not be realistic attack vector).

OK.  I'll admit that I didn't even look for a policy on reporting of
security issues because I believed the issue had low enough impact that
a report to a dedicated security contact point would be unwelcome.
 Maybe that was reckless.  The new text sounds good, if you put it in a
place where people like me would see it. :/

Matt