Re: [PATCH] git-cvsserver runs hooks/post-receive

On 30 Nov 2007, at 9:37:01 PM, Junio C Hamano wrote:

I'll send another patch that includes support for post-update.

Will the old patch already be in place?

Also, I explicitly decided to pipe input into post-receive by hand rather than relying on a system() call that someone might exploit maliciously.

Unfortunately, it turns out that open() with a pipe essentially invokes system(); the solution is to fork a child process and then to turn the child into the process with which communication is desired via a call to exec().

Because the rest of git-cvsserver.perl uses explicit system() calls, I have been wondering if I am being overly cautious.