From: H. Peter Anvin <hpa@zytor.com>
Date: Fri, 18 Nov 2005 20:41:32 GMT
Subject: Re: [PATCH 5/5] git-daemon support for user-relative paths.
Message-ID: <437E3C7C.6000303@zytor.com>
In-Reply-To: <437DAA66.6070301@op5.se>

Andreas Ericsson wrote:
> 
> It's already there but in a different format. Adding "if (!strict)" to 
> the previously unconditional 'chdir(".git");' won't change that.
> 
> Like I said, I made sure everything that worked before works now too.
> 
>> Under strict-path, I think not doing any DWIM like this is fine,
>> but otherwise I suspect changing this would break existing
>> remotes/origin file people may have.  In addition enter_repo()
>> as posted does its own DWIM to chdir to ".git" unconditionally
>> as I pointed out...
> 
> DWIM? That's an acronym I don't know.
> 

DWIM = "Do What I Mean", i.e. program trying to be clever.  A (usually) 
good thing for usability, a very bad thing for security.

In particular, DWIM is bad for security when you have a flow like:

	user input -> security check -> DWIM

... which lets the user subvert the security check by knowing how the 
DWIM will mangle the input.  What's worse, programmers like yourself 
frequently say "oh, it's okay, though, I know what the DWIM does and it 
can't break the security checks I do."

Well, then someone comes along and changes either the security checks 
(e.g. add a blacklist), or the DWIM, or both.  Security hole opens.

Therefore, the flow must *ALWAYS* be:

	user input -> DWIM -> security check


Your patch re-introduces the incorrect flow.

	-hpa