From: Brooke Kuhlmann <brooke@alchemists.io>
Date: Tue, 21 May 2024 22:57:05 GMT
Subject: Re: [PATCH 09/12] tests: verify that `clone -c core.hooksPath=/dev/null` works again
Message-ID: <9933EA45-85FE-4372-8177-E0D47A596C72@alchemists.io>
In-Reply-To: <20240521195659.870714-10-gitster@pobox.com>

Thanks, Junio and Johannes. Looking forward to making use of this again!

> On May 21, 2024, at 1:56 PM, Junio C Hamano <gitster@pobox.com> wrote:
> 
> From: Johannes Schindelin <johannes.schindelin@gmx.de>
> 
> As part of the protections added in Git v2.45.1 and friends,
> repository-local `core.hooksPath` settings are no longer allowed, as a
> defense-in-depth mechanism to prevent future Git vulnerabilities to
> raise to critical level if those vulnerabilities inadvertently allow the
> repository-local config to be written.
> 
> What the added protection did not anticipate is that such a
> repository-local `core.hooksPath` can not only be used to point to
> maliciously-placed scripts in the current worktree, but also to
> _prevent_ hooks from being called altogether.
> 
> We just reverted the `core.hooksPath` protections, based on the Git
> maintainer's recommendation in
> https://lore.kernel.org/git/xmqq4jaxvm8z.fsf@gitster.g/ to address this
> concern as well as related ones. Let's make sure that we won't regress
> while trying to protect the clone operation further.
> 
> Reported-by: Brooke Kuhlmann <brooke@alchemists.io>
> Signed-off-by: Johannes Schindelin <johannes.schindelin@gmx.de>
> Signed-off-by: Junio C Hamano <gitster@pobox.com>
> ---
> t/t1350-config-hooks-path.sh | 7 +++++++
> 1 file changed, 7 insertions(+)
> 
> diff --git a/t/t1350-config-hooks-path.sh b/t/t1350-config-hooks-path.sh
> index f6dc83e2aa..45a0492917 100755
> --- a/t/t1350-config-hooks-path.sh
> +++ b/t/t1350-config-hooks-path.sh
> @@ -41,4 +41,11 @@ test_expect_success 'git rev-parse --git-path hooks' '
> 	test .git/custom-hooks/abc = "$(cat actual)"
> '
> 
> +test_expect_success 'core.hooksPath=/dev/null' '
> +	git clone -c core.hooksPath=/dev/null . no-templates &&
> +	value="$(git -C no-templates config --local core.hooksPath)" &&
> +	# The Bash used by Git for Windows rewrites `/dev/null` to `nul`
> +	{ test /dev/null = "$value" || test nul = "$value"; }
> +'
> +
> test_done
> -- 
> 2.45.1-216-g4365c6fcf9
>