From: Ayman Bagabas Date: Sat, 22 Mar 2025 18:02:17 GMT Subject: Re: [PATCH] [RFC] shell: allow overriding built-in commands Message-ID: <9A950A71-8847-4F1C-A691-5A9CD461FE6C@gmail.com> In-Reply-To: > On Mar 22, 2025, at 8:39 PM, Elijah Newren wrote: > > On Sat, Mar 22, 2025 at 3:02 AM Ayman Bagabas via GitGitGadget > wrote: >> >> From: Ayman Bagabas >> >> This patch allows overriding built-in commands by placing a script >> with the same name under git-shell-commands directory. >> >> This is useful for users who want to extend the built-in commands >> without replacing the original command binary. For instance, a user >> wanting to allow only a subset of users to run the git-receive-pack >> can override the command with a script that checks the user and >> calls the original command if the user is allowed. > > Sounds like it'd open a window to generating numerous security > vulnerabilities, break git's own commands that exec another git > subprocess (e.g. git-stash), make debugging git bug reports harder, > and likely break programs that use plumbing commands. How so? The security implications are the same as any script defined under git-shell-commands. Git does not handle authentication nor authorization and it shouldn't do so, and this can allow repository based authorization to happen using git-shell. Forgive my limited knowledge about git internals but how would this break git's own commands that exec another git subprocess and plumbing commands? > > I'd rather we didn't.