From: Andreas Ericsson <ae@op5.se>
Date: Fri, 18 Nov 2005 23:23:47 GMT
Subject: Re: [PATCH 1/5] Library code for user-relative paths, take three.
Message-ID: <437E6283.8060002@op5.se>
In-Reply-To: <437E5A90.3070405@op5.se>

Andreas Ericsson wrote:
> H. Peter Anvin wrote:
> 
>> The whole point with --strict is that it shouldn't DWIM.  DWIMming is 
>> *NOT* safe if the data has previously passed through a security screen.
>>
> 
> But it hasn't at this point. The security scan is done afterwards, when 
> the canonical path is compared against the whitelist which, in strict 
> mode, only matches if it matches exactly.
> 
> But anyways, how about doing
> 
>     enter_repo(path, 2)
> 
> from the daemon to make enter_repo() do the chdir(".git")?
> 

... while preventing the later call from git-upload-pack from doing so.

-- 
Andreas Ericsson                   andreas.ericsson@op5.se
OP5 AB                             www.op5.se
Tel: +46 8-230225                  Fax: +46 8-230231