Re: [PATCH 5/5] git-daemon support for user-relative paths.

From: H. Peter Anvin <hpa@zytor.com>
Date: Nov 18, 2005, 20:41 UTC
Message-ID: <437E3C7C.6000303@zytor.com>
In-Reply-To: <437DAA66.6070301@op5.se>

Andreas Ericsson wrote:

Show 14 quoted lines

> 
> It's already there but in a different format. Adding "if (!strict)" to 
> the previously unconditional 'chdir(".git");' won't change that.
> 
> Like I said, I made sure everything that worked before works now too.
> 
>> Under strict-path, I think not doing any DWIM like this is fine,
>> but otherwise I suspect changing this would break existing
>> remotes/origin file people may have.  In addition enter_repo()
>> as posted does its own DWIM to chdir to ".git" unconditionally
>> as I pointed out...
> 
> DWIM? That's an acronym I don't know.
>

DWIM = "Do What I Mean", i.e. program trying to be clever. A (usually) good thing for usability, a very bad thing for security.

In particular, DWIM is bad for security when you have a flow like:

	user input -> security check -> DWIM

... which lets the user subvert the security check by knowing how the DWIM will mangle the input. What's worse, programmers like yourself frequently say "oh, it's okay, though, I know what the DWIM does and it can't break the security checks I do."

Well, then someone comes along and changes either the security checks (e.g. add a blacklist), or the DWIM, or both. Security hole opens.

Therefore, the flow must *ALWAYS* be:

	user input -> DWIM -> security check

Your patch re-introduces the incorrect flow.

	-hpa