git/list[1] front-page[2] threads[3] people[4] search[5] about
 

Re: [PATCH 2/2] archive: limit ourselves during remote requests

From
Junio C Hamano <gitster@pobox.com>
Date
Nov 16, 2011, 00:03 UTC
Message-ID
<7v7h31szlb.fsf@alter.siamese.dyndns.org>
In-Reply-To
<20111115214840.GB20624@sigill.intra.peff.net>
Jeff King <peff@peff.net> writes:
Show 6 quoted lines
> ... just a very stripped-down version of
> git-archive (i.e., it _only_ calls write_archive). Or it could even be
> spelled "git upload-archive --remote-request". But the point is that
> git-archive never needed to worry about security before.  We
> shouldn't be polluting it with security code; we should be bypassing it
> going to write_archive directly.
Quite sensible, and a good approach to reroll the series, I would think.
Previous: Jeff KingNext: Erik Faye-Lund
Message 4 of 7 in “upload-archive security issues”
  1. 0/2 upload-archive security issuesJeff King, Nov 15, 2011
  2. 1/2 archive: don't allow negation of --remote-requestJeff King, Nov 15, 2011
  3. 2/2 archive: limit ourselves during remote requestsJeff King, Nov 15, 2011
  4. Junio C HamanoNov 16, 2011
  5. Erik Faye-LundNov 15, 2011
  6. Jeff KingNov 15, 2011
  7. Junio C HamanoNov 15, 2011

Read the whole thread, see it on lore, or plain text.

$ cat FOOTERMessages come from the public archive at lore.kernel.org/git, fetched every hour. The front page is chosen and written each morning by an AI editor and can be wrong; the threads themselves are the record. About and API. For agents: an MCP server at https://gitlist.dev/mcp, and any thread, story or person page as Markdown by adding .md to its URL (or sending Accept: text/markdown). Details in /llms.txt.