git/list[1] front-page[2] threads[3] people[4] search[5] about
 

Re: Security of .git/config and .git/hooks

From
Christian Couder <christian.couder@gmail.com>
Date
Oct 3, 2017, 10:59 UTC
Message-ID
<CAP8UFD3FJBns+dnJz94SN6htboDt1aKi5FZCLQMGc39+yORH0A@mail.gmail.com>
In-Reply-To
<20171002234517.GV19555@aiede.mtv.corp.google.com>
Hi,
On Tue, Oct 3, 2017 at 1:45 AM, Jonathan Nieder <jrnieder@gmail.com> wrote:
Show 5 quoted lines
> Proposed fix: because of case (1), I would like a way to tell Git to
> stop trusting any files in .git.  That is:
>
>  1. Introduce a (configurable) list of "safe" configuration items that
>     can be set in .git/config and don't respect any others.

Maybe we can already add a --list-security or --check-security or --unsafe to `git config` to list the unsafe options and their values as well as the active hooks, so that admins/users can already easily take a quick look at the config before they start playing with a potentially unsafe repo.

Previous: Junio C HamanoNext: Jeff King
Message 3 of 5 in “Security of .git/config and .git/hooks”
  1. Jonathan NiederOct 2, 2017
  2. Junio C HamanoOct 3, 2017
  3. Christian CouderOct 3, 2017
  4. Jeff KingOct 3, 2017
  5. Stefan BellerOct 3, 2017

Read the whole thread, see it on lore, or plain text.

$ cat FOOTERMessages come from the public archive at lore.kernel.org/git, fetched every hour. The front page is chosen and written each morning by an AI editor and can be wrong; the threads themselves are the record. About and API. For agents: an MCP server at https://gitlist.dev/mcp, and any thread, story or person page as Markdown by adding .md to its URL (or sending Accept: text/markdown). Details in /llms.txt.