git/list[1] front-page[2] threads[3] people[4] search[5] about
 

Re: what are the chances of a 'pre-upload' hook?

From
Sitaram Chamarty <sitaramc@gmail.com>
Date
Nov 25, 2011, 04:13 UTC
Message-ID
<CAMK1S_gh_CsWc-DnbOuUwn+H1i3skm99xzDbWe-wxsKKS0Qw-w@mail.gmail.com>
In-Reply-To
<CAMK1S_jaEWV=F6iHKZw_6u5ncDW0bPosNx-03W9bOLOfEEEY1Q@mail.gmail.com>
On Fri, Nov 25, 2011 at 8:46 AM, Sitaram Chamarty <sitaramc@gmail.com> wrote:
> (...and/or a post-upload hook)
>
> Has this ever come up?

Sorry for the google-fu fail and for replying to my own post. http://git.661346.n2.nabble.com/Removal-of-post-upload-hook-td4394312.html is the longest thread I (later) found.

The quick summary, in the words of Jeff (second post in that link) is: "Because [upload]-pack runs as the user who is [fetching], not as the repository owner. So by convincing you to [fetch from] my repository in a multi-user environment, I convince you to run some arbitrary code of mine."

My contention (today) is:
  - you're already taking that risk for push
  - so this would add a new risk only for people who fetch but don't push
  - which, I submit, is a very small (if not almost empty) set of people

I may be wrong but I imagine shared environments are those where almost everyone will push at least once in a while. It's a closed group of people, probably all developers, etc etc etc...

Thanks for listening.
Previous: Martin FickNext: Andreas Ericsson
Message 4 of 23 in “what are the chances of a 'pre-upload' hook?”
  1. Sitaram ChamartyNov 25, 2011
  2. Martin FickNov 25, 2011
  3. Martin FickNov 25, 2011
  4. Sitaram ChamartyNov 25, 2011
  5. Andreas EricssonNov 25, 2011
  6. Sitaram ChamartyNov 25, 2011
  7. Jeff KingNov 25, 2011
  8. Junio C HamanoNov 26, 2011
  9. Jeff KingNov 26, 2011
  10. Junio C HamanoNov 26, 2011
  11. Jeff KingNov 26, 2011
  12. Junio C HamanoNov 27, 2011
  13. Jeff KingNov 26, 2011
  14. Jeff KingNov 27, 2011
  15. Junio C HamanoNov 27, 2011
  16. Sitaram ChamartyNov 27, 2011
  17. Junio C HamanoNov 28, 2011
  18. Jeff KingNov 28, 2011
  19. Sitaram ChamartyNov 28, 2011
  20. Sitaram ChamartyNov 28, 2011
  21. Jeff KingNov 28, 2011
  22. Jeff KingNov 28, 2011
  23. Jeff KingNov 28, 2011

Read the whole thread, see it on lore, or plain text.

$ cat FOOTERMessages come from the public archive at lore.kernel.org/git, fetched every hour. The front page is chosen and written each morning by an AI editor and can be wrong; the threads themselves are the record. About and API. For agents: an MCP server at https://gitlist.dev/mcp, and any thread, story or person page as Markdown by adding .md to its URL (or sending Accept: text/markdown). Details in /llms.txt.