Re: Bare repositories in the working tree are a security risk
- From
Junio C Hamano <gitster@pobox.com>
- Date
- Apr 13, 2022, 23:36 UTC
- Message-ID
- <xmqqwnfs4kud.fsf@gitster.g>
- In-Reply-To
- <kl6lv8vc90ts.fsf@chooglen-macbookpro.roam.corp.google.com>
Glen Choo <chooglen@google.com> writes:
Show 9 quoted lines
> Martin observed that, viability aside, there's another approach that I > haven't discussed: > > == 5 Disable bare repo discovery > > We could introduce a config value that disables bare repo discovery > altogether. This would only disable _discovery_; a user can still use > the bare repo by specifying the gitdir (e.g. via `--git-dir=.` or > GIT_DIR).
Does it or does it not count as "allowing discovery to do its job" if you go to the directory, knowing that the directory is a bare one, and expect Git to work in it?
I am guessing that your definition of "discovery" is not even consider if the current directory is a repository and always force the user to tell us with --git-dir or GIT_DIR. I am not sure that is realistically feasible (I am thinking of cases like "git fetch" going to the remote repository on the local disk that is bare to run "git upload-pack"), but if the fallout is not too bad, it may be a good heuristics.