From: Junio C Hamano <gitster@pobox.com>
Date: Fri, 25 Oct 2013 22:14:37 GMT
Subject: Re: GIT Hooks and security
Message-ID: <xmqqwql1hub6.fsf@gitster.dls.corp.google.com>
In-Reply-To: <CA+nXgrUZk=_wtQ2yQnxwCZ3Mazdz=ZH2FJV+V92PVa0a4+A1hQ@mail.gmail.com>

Olivier Revollat <revollat@gmail.com> writes:

> I was wondering : What if I had a "malicious" GIT repository who can
> "inject" code  via git hooks mechanism : someone clone my repo and
> some malicious code is executed when a certain GIT hook is triggered
> (for example on commit ("prepare-commit-msg' hook))

In that somebody else's clone, you will not have _your_ malicious
hook installed, unless that cloner explicitly does something stupid,
like copying that malicious hook.