git/list[1] front-page[2] threads[3] people[4] search[5] about
 

Re: [PATCH 2/2] pretty: add merge and exclude options to %(describe)

From
René Scharfe. <l.s.r@web.de>
Date
Mar 2, 2021, 16:00 UTC
Message-ID
<3be35be6-66f7-9191-1c9f-1b279ca760f9@web.de>
In-Reply-To
<xmqqy2f6rc8f.fsf@gitster.c.googlers.com>
Am 01.03.21 um 18:54 schrieb Junio C Hamano:
Show 31 quoted lines
> René Scharfe. <l.s.r@web.de> writes:
>
>> Am 17.02.21 um 19:31 schrieb Jeff King:
>>> On Sun, Feb 14, 2021 at 11:10:57AM +0100, René Scharfe. wrote:
>>>
>>>> Allow restricting the tags used by the placeholder %(describe) with the
>>>> options match and exclude.  E.g. the following command describes the
>>>> current commit using official version tags, without those for release
>>>> candidates:
>>>>
>>>>    $ git log -1 --format='%(describe:match=v[0-9]*,exclude=*rc*)'
>>>
>>> An interesting side effect of this series is that it allows remote users
>>> asking for archives to fill in this data, too (by using export-subst
>>> placeholders). That includes servers allowing "git archive --remote",
>>> but also services like GitHub that will run git-archive on behalf of
>>> clients.
>>>
>>> I wonder what avenues for mischief this provides. Certainly using extra
>>> CPU to run git-describe.
>>
>> A repository can contain millions of files, each file can contain
>> millions of $Format:...$ sequences and each of them can contain millions
>> of %(describe) placeholders.  Each of them could have different match or
>> exclude args to prevent caching.  Allowing a single request to cause
>> trillions of calls of git describe sounds excessive.  Let's limit this.
>
> An invocation of "git archive" would have to deal with a single
> commit, no?  I wonder if it is a more fruitful direction to go to
> teach format_subst() to "cache" the mapping from <placeholders> to
> <resulting-string> and reuse.

Yes, git archive only works on a single commit. Caching cannot help against a DoS attack using describe placeholders with different match or exclude arguments.

René
Previous: René Scharfe.
Message 27 of 27 in “gitattributes export-subst and software versioning”
  1. Eli SchwartzJan 25, 2021
  2. René ScharfeFeb 8, 2021
  3. Junio C HamanoFeb 8, 2021
  4. Eli SchwartzFeb 9, 2021
  5. Junio C HamanoFeb 9, 2021
  6. René ScharfeFeb 14, 2021
  7. René ScharfeFeb 14, 2021
  8. 1/2 pretty: add %(describe)René Scharfe, Feb 14, 2021
  9. 2/2 pretty: add merge and exclude options to %(describe)René Scharfe., Feb 14, 2021
  10. Jeff KingFeb 17, 2021
  11. René Scharfe.Feb 28, 2021
  12. Ævar Arnfjörð BjarmasonFeb 28, 2021
  13. René Scharfe.Mar 2, 2021
  14. René Scharfe.Mar 6, 2021
  15. Eli SchwartzFeb 16, 2021
  16. Ævar Arnfjörð BjarmasonFeb 16, 2021
  17. René Scharfe.Feb 16, 2021
  18. Junio C HamanoFeb 16, 2021
  19. Ævar Arnfjörð BjarmasonFeb 17, 2021
  20. René Scharfe.Feb 28, 2021
  21. Ævar Arnfjörð BjarmasonFeb 17, 2021
  22. Junio C HamanoFeb 17, 2021
  23. René Scharfe.Feb 28, 2021
  24. René Scharfe.Feb 28, 2021
  25. René Scharfe.Mar 2, 2021
  26. René Scharfe.Mar 2, 2021
  27. René Scharfe.Mar 2, 2021

Read the whole thread, see it on lore, or plain text.

$ cat FOOTERMessages come from the public archive at lore.kernel.org/git, fetched every hour. The front page is chosen and written each morning by an AI editor and can be wrong; the threads themselves are the record. About and API. For agents: an MCP server at https://gitlist.dev/mcp, and any thread, story or person page as Markdown by adding .md to its URL (or sending Accept: text/markdown). Details in /llms.txt.