From: Theodore Tso <tytso@mit.edu>
Date: Mon, 12 Feb 2007 03:56:24 GMT
Subject: Re: [PATCH] Allow aliases to expand to shell commands
Message-ID: <20070212035613.GA18010@thunk.org>
In-Reply-To: <7vy7n4cqti.fsf@assigned-by-dhcp.cox.net>

On Sun, Feb 11, 2007 at 01:44:25PM -0800, Junio C Hamano wrote:
> Theodore Tso <tytso@mit.edu> writes:
> 
> > ..., I think we're
> > still safe, since aliases can't override commands.  
> 
> I feel a bit uneasy to hear safety argument based on that
> current restriction, since we might want to loosen it later.

Loosen which restriction?

1) The ability for aliases to shadow existing git commands?
2) The ability for untrusted users to make arbitrary changes to the 
      config file?
3) The ability for untrusted users to execute arbitrary git commands via 
      git-shell?

You hjave to loosen at least 2 of the 3 current restrictions before
the ability to execute shell commands out of aliases becomes a problem
--- and I would argue that either (2) or (3) are things that we would
be insane to loosen at least to the point of allowing untrusted users
to make arbitrary changes to the config or execute arbitrary git
commands, since even today, they could do a huge amount of damage
already.

						- Ted