Re: Fetch/push lets a malicious server steal the targets of "have" lines

From: Junio C Hamano <gitster@pobox.com>
Date: Oct 28, 2016, 22:00 UTC
Message-ID: <xmqqmvhoxhfp.fsf@gitster.mtv.corp.google.com>
In-Reply-To: <1477690790.2904.22.camel@mattmccutchen.net>

Matt McCutchen <matt@mattmccutchen.net> writes:

Show 5 quoted lines

> I was studying the fetch protocol and I realized that in a scenario in
> which a client regularly fetches a set of refs from a server and pushes
> them back without careful scrutiny, the server can steal the targets of
> unrelated refs from the client repository by fabricating its own refs
> to the "have" objects specified by the client during the fetch.

Let me see if I understood your scenario correctly.

Suppose we start from this history where 'O' are common, your victim has a 'Y' branch with two commits that are private to it, as well as a 'X' branch on which it has X1 that it previously obtained from the server. On the other hand, the server does not know about Y1 or Y2, and it added one commit X2 to the branch 'x' the victim is following:

           victim                server

             Y1---Y2               
            /                      
    ---O---O---X1           ---O---O---X1---X2

Then when victim wants to fetch 'x' from the server, it would say

    have X1, have Y2, have Y1, have O

and gets told to shut up by the server who heard enough. The histories on these two parties will then become like this:

           victim                server

             Y1---Y2               
            /                      
    ---O---O---X1---X2      ---O---O---X1---X2

Victim wishes to keep Y1 and Y2 private, but pushes some other branch (perhaps builds X3 on top of X2 and pushes 'x'). On push protocol, the server would lie to the victim that it has Y2 without knowing what they are.

Is that how your attack scenario goes?