Re: [RFC/PATCH] receive-pack.c: only accept push-cert if push_cert_nonce was advertised

From: Junio C Hamano <gitster@pobox.com>
Date: Jan 9, 2015, 23:57 UTC
Message-ID: <xmqqbnm7bj8m.fsf@gitster.dls.corp.google.com>
In-Reply-To: <CAGZ79kZhUZBU886UkqbAXZwSO+xE90FyEqcJYB+AQZ9Aa_c9xg@mail.gmail.com>

Stefan Beller <sbeller@google.com> writes:

> Your proposal to acknowledge the correctness of the message leads
> to more questions. How would we proceed?

How would it fail if we pretend that "push-cert" line had to be old/new/ref line? Failing the same way, but with a better diagnosis, would be sufficient.

> I expect such behavior only from malicious clients which actively
> want to abuse a feature which wasn't advertised,...

Do not assume malice; it is not 2005 anymore. You have to remember that we are mature enough that there are many reimplementations of Git, all of which (us included ;-) start with a buggy version.

Show 5 quoted lines

>> When the protocol exchange gets to this state, in practice, we know
>> we are talking with somebody who has push privilege into the
>> repository,
>
> Yeah but what is one repository compared to the whole server?

Huh? If an auth good enough for one repository allows things to another repository, then I consider that to that other repository the pusher also has push privilege. So what is the problem?

But again, our first version could just be "pretend we do not know anything about push-cert", with discussions on alternative considered in its log message. I do not think it is a blocker to lack the "more helpful diagnosis" feature.