git/list[1] front-page[2] threads[3] people[4] search[5] about
 

Re: [PATCH 0/1] Disallow writing, but not fetching commits with file names containing backslashes

From
Junio C Hamano <gitster@pobox.com>
Date
Dec 26, 2019, 19:22 UTC
Message-ID
<xmqqk16ilwnw.fsf@gitster-ct.c.googlers.com>
In-Reply-To
<pull.682.git.git.1577382151.gitgitgadget@gmail.com>

"Johannes Schindelin via GitGitGadget" <gitgitgadget@gmail.com> writes:

> I would appreciate reviews with a particular eye on keeping users safe: I am
> not 100% certain that all relevant file writes go through the index (I think 
> that they all go through the index, but I might have well missed a corner
> case).

There are peripheral commands that do not use the index at all, such as "archive"; piping "git archive" output to unarchiver that writes into the filesystem would be a way. But I do not think that qualifies as an attack vector you are looking for.

Previous: Johannes SchindelinNext: Johannes Schindelin
Message 16 of 19 in “Disallow writing, but not fetching commits with file names containing backslashes”
  1. 0/1 Disallow writing, but not fetching commits with file names containing backslashesJohannes Schindelin via GitGitGadget, Dec 26, 2019
  2. 1/1 mingw: only test index entries for backslashes, not tree entriesJohannes Schindelin via GitGitGadget, Dec 26, 2019
  3. Junio C HamanoDec 26, 2019
  4. Johannes SchindelinDec 26, 2019
  5. Junio C HamanoDec 30, 2019
  6. Johannes SchindelinJan 2, 2020
  7. Jonathan NiederDec 26, 2019
  8. Johannes SchindelinDec 26, 2019
  9. Jonathan NiederDec 26, 2019
  10. Junio C HamanoDec 26, 2019
  11. Junio C HamanoDec 26, 2019
  12. Johannes SchindelinDec 31, 2019
  13. Johannes SchindelinJan 2, 2020
  14. Jonathan NiederJan 4, 2020
  15. Johannes SchindelinJan 4, 2020
  16. Junio C HamanoDec 26, 2019
  17. Johannes SchindelinDec 26, 2019
  18. 0/1 Disallow writing, but not fetching commits with file names containing backslashesJohannes Schindelin via GitGitGadget, Dec 31, 2019
  19. 1/1 mingw: only test index entries for backslashes, not tree entriesJohannes Schindelin via GitGitGadget, Dec 31, 2019

Read the whole thread, see it on lore, or plain text.

$ cat FOOTERMessages come from the public archive at lore.kernel.org/git, fetched every hour. The front page is chosen and written each morning by an AI editor and can be wrong; the threads themselves are the record. About and API. For agents: an MCP server at https://gitlist.dev/mcp, and any thread, story or person page as Markdown by adding .md to its URL (or sending Accept: text/markdown). Details in /llms.txt.