git/list[1] front-page[2] threads[3] people[4] search[5] about
 

Re: git format-patch --in-reply-to allows header injection. Intended?

From
NHNiklas Hambüchen <mail@nh2.me>
Date
Sep 4, 2014, 21:42 UTC
Message-ID
<5408DCC5.8000607@nh2.me>
In-Reply-To
<xmqqppfbqd9x.fsf@gitster.dls.corp.google.com>
On 04/09/14 23:36, Junio C Hamano wrote:
> While I do not think of a reason to specify such a string to the
> in-reply-to option (I'd rather edit the output in the editor if I
> wanted to do anything fancy [*1*]), I do not think there is a reason
> why you want to add a code to forbid such use, either.

My question was to find out whether I can pass untrusted user input to --in-reply-to and expect that no header beyond "In-Reply-To" and "References" is modified, but your answer makes clear that I cannot.

A possible alternative might have been that git verifies that the input to --in-reply-to matches the format specified RFC2822 (section 3.6.4.).

Thanks!
Previous: Junio C HamanoNext: Junio C Hamano
Message 3 of 4 in “git format-patch --in-reply-to allows header injection. Intended?”
  1. Niklas HambüchenSep 4, 2014
  2. Junio C HamanoSep 4, 2014
  3. Niklas HambüchenSep 4, 2014
  4. Junio C HamanoSep 4, 2014

Read the whole thread, see it on lore, or plain text.

$ cat FOOTERMessages come from the public archive at lore.kernel.org/git, fetched every hour. The front page is chosen and written each morning by an AI editor and can be wrong; the threads themselves are the record. About and API. For agents: an MCP server at https://gitlist.dev/mcp, and any thread, story or person page as Markdown by adding .md to its URL (or sending Accept: text/markdown). Details in /llms.txt.