git/list[1] front-page[2] threads[3] people[4] search[5] about
 

Re: GIT Hooks and security

From
Junio C Hamano <gitster@pobox.com>
Date
Oct 25, 2013, 22:14 UTC
Message-ID
<xmqqwql1hub6.fsf@gitster.dls.corp.google.com>
In-Reply-To
<CA+nXgrUZk=_wtQ2yQnxwCZ3Mazdz=ZH2FJV+V92PVa0a4+A1hQ@mail.gmail.com>
Olivier Revollat <revollat@gmail.com> writes:
> I was wondering : What if I had a "malicious" GIT repository who can
> "inject" code  via git hooks mechanism : someone clone my repo and
> some malicious code is executed when a certain GIT hook is triggered
> (for example on commit ("prepare-commit-msg' hook))

In that somebody else's clone, you will not have _your_ malicious hook installed, unless that cloner explicitly does something stupid, like copying that malicious hook.

Previous: Olivier RevollatNext: Olivier Revollat
Message 2 of 6 in “GIT Hooks and security”
  1. Olivier RevollatOct 25, 2013
  2. Junio C HamanoOct 25, 2013
  3. Olivier RevollatOct 25, 2013
  4. Bryan TurnerOct 26, 2013
  5. Olivier RevollatOct 26, 2013
  6. Ondřej BílkaOct 26, 2013

Read the whole thread, see it on lore, or plain text.

$ cat FOOTERMessages come from the public archive at lore.kernel.org/git, fetched every hour. The front page is chosen and written each morning by an AI editor and can be wrong; the threads themselves are the record. About and API. For agents: an MCP server at https://gitlist.dev/mcp, and any thread, story or person page as Markdown by adding .md to its URL (or sending Accept: text/markdown). Details in /llms.txt.