Re: git ate my home directory :-(
- From
- demerphq <demerphq@gmail.com>
- Date
- Mar 26, 2013, 17:20 UTC
- Message-ID
- <CANgJU+Wihp=rSQevij6R7SnZtW8UpDtRpFYE00aKKAwiYi9Q_Q@mail.gmail.com>
- In-Reply-To
- <5151D589.2000002@nod.at>
On 26 March 2013 18:06, Richard Weinberger <richard@nod.at> wrote:
> P.s: I've told this story to some friends and co-workers which use git like > me very day. > All of them were shocked about the behavior of git-clean and GIT_DIR.
Seconded. At $work lots of people started asking anxious questions about this. It was suggested it is a potential security hole, although I am not sure I agree, but the general idea being that if you could manage to set this var in someones environment then they might use git to do real damage to a system. (The counterargument being that if you can set that in someones environment you can do worse already... But im a not a security type so I cant say)
As a knee-jerk response we will be armoring various scripts we have that use git automatically to refuse to run if GIT_DIR is set. I suspect a lot of people will be doing the same.
cheers, Yves
-- perl -Mre=debug -e "/just|another|perl|hacker/"