Re: [PATCH v2 2/2] setup: allow Git.pm to do unsafe repo checking
- From
Jeff King <peff@peff.net>
- Date
- Oct 24, 2022, 23:38 UTC
- Message-ID
- <Y1ch/PKAvNbYNLY7@coredump.intra.peff.net>
- In-Reply-To
- <221024.861qqxeah5.gmgdl@evledraar.gmail.com>
On Mon, Oct 24, 2022 at 12:57:29PM +0200, Ævar Arnfjörð Bjarmason wrote:
> The important point/question I have is whether we can think of any such > config variable understood by the code that uses Git.pm.
I don't think that matters. Before the CVE fix, Git.pm scripts were just as vulnerable as all the other parts of Git. After, they were broken because of the syntax error. Fixing the syntax error re-opened the bug there, but as long as we close it again before releasing, we don't have to care.
You can argue that the CVE wasn't that important for Git.pm, and thus not that big a deal to re-open. But I think post-CVE we're making the stronger promise that Git won't discover a repo directory with funky ownership. And Git.pm is violating that (or would be after the syntax fix if we don't go further).
> The only ones I can think are the "sendemail.{to,cc}Cmd" variables.I don't think we can be that exhaustive. It's also any programs that are called by scripts using Git.pm. But even that is not a closed set, since we ship Git.pm for people to use in their own scripts. We don't know what those scripts might be doing.
-Peff