From: Michael Witten Date: Sat, 01 Dec 2007 09:17:02 GMT Subject: Re: [PATCH] git-cvsserver runs hooks/post-receive Message-ID: In-Reply-To: <7vmysv87jm.fsf@gitster.siamese.dyndns.org> On 30 Nov 2007, at 9:37:01 PM, Junio C Hamano wrote: > I'll queue your patch, but I think it should be enhanced to support > post-update for consistency. I'll send another patch that includes support for post-update. > I'll queue your patch, Will the old patch already be in place? Also, I explicitly decided to pipe input into post-receive by hand rather than relying on a system() call that someone might exploit maliciously. Unfortunately, it turns out that open() with a pipe essentially invokes system(); the solution is to fork a child process and then to turn the child into the process with which communication is desired via a call to exec(). Because the rest of git-cvsserver.perl uses explicit system() calls, I have been wondering if I am being overly cautious.