git/list[1] front-page[2] threads[3] people[4] search[5] about
 

Re: [BUG] fatal: transport 'file' not allowed during submodule add

From
Junio C Hamano <gitster@pobox.com>
Date
Dec 28, 2022, 03:34 UTC
Message-ID
<xmqqilhwp5g4.fsf@gitster.g>
In-Reply-To
<00f901d91a47$09400110$1bc00330$@nexbridge.com>
<rsbecker@nexbridge.com> writes:
Show 8 quoted lines
> As of 2.39.0, I am now getting fatal: transport 'file' not allowed when
> performing a submodule add after a clone -l. The simple reproduce of this
> is:
> ...
> This happens for any submodule add on the same system. Some online research
> indicates that there was a security patch to git causing this, but I can't
> find it. This does not seem correct to me or how this improves security.
> Help please - this is causing some of my workflows to break.
Thanks for reporting, Randall.

This suspiciously sounds like what a1d4f67c (transport: make `protocol.file.allow` be "user" by default, 2022-07-29) is doing deliberately. Taylor, does this look like a corner case the 2.30.6 updates forgot to consider?

Thanks.
Previous: rsbecker@nexbridge.comNext: rsbecker@nexbridge.com
Message 2 of 12 in “[BUG] fatal: transport 'file' not allowed during submodule add”
  1. rsbecker@nexbridge.comDec 27, 2022
  2. Junio C HamanoDec 28, 2022
  3. rsbecker@nexbridge.comDec 28, 2022
  4. Jonathan NiederDec 28, 2022
  5. rsbecker@nexbridge.comDec 28, 2022
  6. Taylor BlauDec 30, 2022
  7. rsbecker@nexbridge.comDec 30, 2022
  8. Jeff KingJan 3, 2023
  9. Taylor BlauDec 30, 2022
  10. rsbecker@nexbridge.comDec 30, 2022
  11. rsbecker@nexbridge.comDec 30, 2022
  12. rsbecker@nexbridge.comDec 30, 2022

Read the whole thread, see it on lore, or plain text.

$ cat FOOTERMessages come from the public archive at lore.kernel.org/git, fetched every hour. The front page is chosen and written each morning by an AI editor and can be wrong; the threads themselves are the record. About and API. For agents: an MCP server at https://gitlist.dev/mcp, and any thread, story or person page as Markdown by adding .md to its URL (or sending Accept: text/markdown). Details in /llms.txt.