Re: Files with colons under Cygwin

From: Johannes Sixt <j.sixt@viscovery.net>
Date: Oct 7, 2008, 06:13 UTC
Message-ID: <48EAFE00.3040907@viscovery.net>
In-Reply-To: <20081007005327.GT21650@dpotapov.dyndns.org>

Dmitry Potapov schrieb:

Show 12 quoted lines

> On Mon, Oct 06, 2008 at 08:54:44AM +0200, Johannes Sixt wrote:
>> [*] I say "meaningful" and not "necessary" because the situation is just
>> like when you grab some random SoftwarePackage.tar.gz, and run ./configure
>> without looking first what it is going to do.
> 
> When I grab any tar, I can look at its context without myself of any
> risk that some files can be overwritten on my file system. And when
> I want to look at some remote git repository, I usually do:
> 
>    git clone URL
> 
> If it can overwrite some files behind my back, it is security a hole.

Fair enough.

> On Linux (or other sane file systems), we have all required checks to
> prevent that from happening, and they are places in verify_path, which
> prevents malicious names entering into the index and thus to the file
> system too. So, we should do all required checks on Windows too.

I don't object the intention of your patch. But I cannot judge whether verify_path() is the correct location to put the checks because I don't know this part of the code. I leave the final word to others.

-- Hannes