git/list[1] front-page[2] threads[3] people[4] search[5] about
 

Re: Proposal for missing blob support in Git repos

From
Junio C Hamano <gitster@pobox.com>
Date
May 1, 2017, 23:29 UTC
Message-ID
<xmqq1ss8gnqn.fsf@gitster.mtv.corp.google.com>
In-Reply-To
<193d1d84-2386-c4c8-81ef-0042f0d8bb02@google.com>
Jonathan Tan <jonathantanmy@google.com> writes:
Show 6 quoted lines
> Thanks for your comments. If you're referring to the codepath
> involving write_sha1_file() (for example, builtin/hash-object ->
> index_fd or builtin/unpack-objects), that is fine because
> write_sha1_file() invokes freshen_packed_object() and
> freshen_loose_object() directly to check if the object already exists
> (and thus does not invoke the new mechanism in this patch).

Is that a good thing, though? It means that you an attacker can feed one version to the remote object store your "grab blob" hook gets the blobs from, and have you add a colliding object locally, and the usual "are we recording the same object as existing one?" check is bypassed.

Previous: Jonathan TanNext: Jonathan Tan
Message 4 of 12 in “Proposal for missing blob support in Git repos”
  1. Jonathan TanApr 26, 2017
  2. Junio C HamanoMay 1, 2017
  3. Jonathan TanMay 1, 2017
  4. Junio C HamanoMay 1, 2017
  5. Jonathan TanMay 2, 2017
  6. Brandon WilliamsMay 2, 2017
  7. Junio C HamanoMay 2, 2017
  8. Jonathan TanMay 2, 2017
  9. Ævar Arnfjörð BjarmasonMay 2, 2017
  10. Jonathan TanMay 2, 2017
  11. Junio C HamanoMay 4, 2017
  12. Jonathan TanMay 4, 2017

Read the whole thread, see it on lore, or plain text.

$ cat FOOTERMessages come from the public archive at lore.kernel.org/git, fetched every hour. The front page is chosen and written each morning by an AI editor and can be wrong; the threads themselves are the record. About and API. For agents: an MCP server at https://gitlist.dev/mcp, and any thread, story or person page as Markdown by adding .md to its URL (or sending Accept: text/markdown). Details in /llms.txt.