From: Junio C Hamano <gitster@pobox.com>
Date: Fri, 30 Jan 2015 19:07:34 GMT
Subject: Re: [PATCH 2/1] apply: reject input that touches outside $cwd
Message-ID: <xmqqegqcccjt.fsf@gitster.dls.corp.google.com>
In-Reply-To: <20150130182456.GA29477@peff.net>

Jeff King <peff@peff.net> writes:

> It looks like your new --allow-uplevel goes to verify_path(). So this
> isn't just about "..", but it will also protect against applying a patch
> inside ".git". Which seems like a good thing to me, but I wonder if the
> option name is a little misleading.

True; not just misleading but is incorrect, I would say.
Suggestions?

> I agree they are orthogonal in concept, though I doubt the symlink tests
> here would pass without the previous one...

It won't; "do not apply across symlinks" is unconditional, and the
new codepath introduced by this patch, which is conditional to the
user option, shouldn't have to worry about them.