Re: [PATCH] [RFC] shell: allow overriding built-in commands

From: Ayman Bagabas <ayman.bagabas@gmail.com>
Date: Mar 22, 2025, 18:02 UTC
Message-ID: <9A950A71-8847-4F1C-A691-5A9CD461FE6C@gmail.com>
In-Reply-To: <CABPp-BH9ia_GRNYx+zRCht3n0V=X-uLq2Zg+QWTWCyJfMkeznA@mail.gmail.com>

Show 20 quoted lines

> On Mar 22, 2025, at 8:39 PM, Elijah Newren <newren@gmail.com> wrote:
> 
> On Sat, Mar 22, 2025 at 3:02 AM Ayman Bagabas via GitGitGadget
> <gitgitgadget@gmail.com> wrote:
>> 
>> From: Ayman Bagabas <ayman.bagabas@gmail.com>
>> 
>> This patch allows overriding built-in commands by placing a script
>> with the same name under git-shell-commands directory.
>> 
>> This is useful for users who want to extend the built-in commands
>> without replacing the original command binary. For instance, a user
>> wanting to allow only a subset of users to run the git-receive-pack
>> can override the command with a script that checks the user and
>> calls the original command if the user is allowed.
> 
> Sounds like it'd open a window to generating numerous security
> vulnerabilities, break git's own commands that exec another git
> subprocess (e.g. git-stash), make debugging git bug reports harder,
> and likely break programs that use plumbing commands.

How so? The security implications are the same as any script defined under git-shell-commands. Git does not handle authentication nor authorization and it shouldn't do so, and this can allow repository based authorization to happen using git-shell.

Forgive my limited knowledge about git internals but how would this break git's own commands that exec another git subprocess and plumbing commands?

> 
> I'd rather we didn't.