Re: [PATCH v2 2/2] setup.c: learn discovery.bareRepository=cwd

From: Derrick Stolee <derrickstolee@github.com>
Date: May 16, 2022, 18:49 UTC
Message-ID: <c01a4ab9-675d-e0df-dfc9-2ec48a2a3ea2@github.com>
In-Reply-To: <62070aab7eb8734f82e3881e25ff0f9cee6bb077.1652485058.git.gitgitgadget@gmail.com>

On 5/13/2022 7:37 PM, Glen Choo via GitGitGadget wrote:

Show 6 quoted lines

> From: Glen Choo <chooglen@google.com>
> 
> Add a 'cwd' option to discovery.bareRepository, which allows a bare
> repository to be used if and only if the cwd is the root of a bare
> repository. This covers the common case where a user works with a bare
> repository by cd-ing into the repository's root.

I don't consider this case valuable. In addition to allowing the most-common use case, it also allows the most-common route that an attacker would use to try to get a user to run a Git command in a malicious embedded bare repo. I think we are better off without it.

Thanks, -Stolee