Re: [PATCH] Allow aliases to expand to shell commands

From: Johannes Schindelin <johannes.schindelin@gmx.de>
Date: Feb 11, 2007, 16:03 UTC
Message-ID: <Pine.LNX.4.63.0702111701160.22628@wbgn013.biozentrum.uni-wuerzburg.de>
In-Reply-To: <20070211001346.GA19656@thunk.org>

Hi,

On Sat, 10 Feb 2007, Theodore Tso wrote:

Show 9 quoted lines

> On Sat, Feb 10, 2007 at 09:34:38PM +0100, Johannes Schindelin wrote:
> 
> > It made me feel a little uneasy that we can execute _any_ command now, 
> > but I can only find one way to exploit this, when an attacker does not 
> > have shell access anyway: git-shell.
> 
> ... and git-shell only allows git-receive-pack and git-upload-pack to be 
> called, with a single argument, and aliases aren't allowed to override 
> commands.  So we're safe here, I think.

Yes, sorry. I have a modified git-shell, which allows the git wrapper, too, to allow setting the config. I'll just fix it here.

Ciao, Dscho

$ cat FOOTERMessages come from the public archive at lore.kernel.org/git, fetched every hour. The front page is chosen and written each morning by an AI editor and can be wrong; the threads themselves are the record. About and API. For agents: an MCP server at https://gitlist.dev/mcp, and any thread, story or person page as Markdown by adding .md to its URL (or sending Accept: text/markdown). Details in /llms.txt.