Re: What's cooking in git.git (Mar 2021, #03; Wed, 10)

From: René Scharfe. <l.s.r@web.de>
Date: Mar 11, 2021, 19:13 UTC
Message-ID: <bb5f06df-226f-8c2d-93e1-7e55aab73917@web.de>
In-Reply-To: <87r1klhq3y.fsf@evledraar.gmail.com>

Am 11.03.21 um 12:44 schrieb Ævar Arnfjörð Bjarmason:

Show 12 quoted lines

>
> On Thu, Mar 11 2021, Junio C Hamano wrote:
>
>> * rs/pretty-describe (2021-03-01) 4 commits
>>   (merged to 'next' on 2021-03-01 at bee9248828)
>>  + pretty: document multiple %(describe) being inconsistent
>>  + t4205: assert %(describe) test coverage
>>   (merged to 'next' on 2021-02-25 at 2347ed8fe6)
>>  + pretty: add merge and exclude options to %(describe)
>>  + pretty: add %(describe)
>>
>>  "git log --format='...'" learned "%(describe)" placeholder.

This is missing the patch to limit %(describe) expansing to one per archive [1]. I think we need it to avoid hosters that generate archives for user-supplied repos becoming vulnerable to a DoS attack via this new feature. Demo script in [2].

> As an aside did anyone look into making most of ./builtin/describe.c a
> new ./describe.c library? I had a quick aborted attempt at doing that,
> but it didn't seem like it would be all that hard...

That's what I thought as well, but combined with log --format it produced bogus results for some commits. No idea what went wrong there.

René

[1] http://public-inbox.org/git/b7e1f6c0-6b13-efe4-74b5-ec8249855644@web.de/ [2] http://public-inbox.org/git/a28592c5-4a70-1ea8-fd73-959e28b4278d@web.de/