From: demerphq <demerphq@gmail.com>
To: Jeff King <peff@peff.net>
Cc: Richard Weinberger <richard@nod.at>,
Philip Oakley <philipoakley@iee.org>,
Junio C Hamano <gitster@pobox.com>,
Jonathan Nieder <jrnieder@gmail.com>,
git@vger.kernel.org
Subject: Re: git ate my home directory :-(
Date: Tue, 26 Mar 2013 20:08:39 +0100 [thread overview]
Message-ID: <CANgJU+U-M9zUUzRNJ=r=Utp7BMhGO37wDQAx8et0W23P3CTegA@mail.gmail.com> (raw)
In-Reply-To: <20130326174804.GB10383@sigill.intra.peff.net>
On 26 March 2013 18:48, Jeff King <peff@peff.net> wrote:
> On Tue, Mar 26, 2013 at 06:20:09PM +0100, demerphq wrote:
>
>> Seconded. At $work lots of people started asking anxious questions
>> about this. It was suggested it is a potential security hole, although
>> I am not sure I agree, but the general idea being that if you could
>> manage to set this var in someones environment then they might use git
>> to do real damage to a system. (The counterargument being that if you
>> can set that in someones environment you can do worse already... But
>> im a not a security type so I cant say)
>
> IMHO, that is just silly. Setting GIT_WORK_TREE=/ would be just as
> destructive. Or GIT_EXTERNAL_DIFF="rm -rf /" (or GIT_PAGER, etc).
> If there is a danger to the implicit-workdir behavior, it is due to
> accidental usage, not from a malicious attack.
Yeah, that was my line of reasoning too. I'm glad to hear you agree.
cheers
Yves
--
perl -Mre=debug -e "/just|another|perl|hacker/"
next prev parent reply other threads:[~2013-03-26 19:09 UTC|newest]
Thread overview: 35+ messages / expand[flat|nested] mbox.gz Atom feed top
2013-03-25 21:38 git ate my home directory :-( Richard Weinberger
2013-03-25 21:43 ` Jonathan Nieder
2013-03-25 22:02 ` Junio C Hamano
2013-03-25 22:08 ` Jonathan Nieder
2013-03-25 22:15 ` Junio C Hamano
2013-03-25 22:06 ` Junio C Hamano
2013-03-25 22:09 ` Richard Weinberger
2013-03-25 22:15 ` Jonathan Nieder
2013-03-25 22:20 ` Junio C Hamano
2013-03-25 22:27 ` Richard Weinberger
2013-03-25 22:13 ` Jonathan Nieder
2013-03-25 22:21 ` Brandon Casey
2013-03-26 8:02 ` Philip Oakley
2013-03-26 9:48 ` Duy Nguyen
2013-03-26 15:04 ` Jeff King
2013-03-26 16:32 ` Junio C Hamano
2013-03-27 13:05 ` Duy Nguyen
2013-03-26 21:47 ` Philip Oakley
2013-03-26 13:07 ` Richard Weinberger
2013-03-26 14:56 ` Jeff King
2013-03-26 17:06 ` Richard Weinberger
2013-03-26 17:20 ` demerphq
2013-03-26 17:48 ` Jeff King
2013-03-26 19:08 ` demerphq [this message]
2013-03-26 17:41 ` Jeff King
2013-03-26 18:20 ` Junio C Hamano
2013-03-26 20:08 ` Jeff King
2013-03-26 20:11 ` [DONOTAPPLY PATCH 1/3] environment: set GIT_WORK_TREE when we figure out work tree Jeff King
2013-03-26 20:16 ` Jonathan Nieder
2013-03-26 20:12 ` [DONOTAPPLY PATCH 2/3] setup: warn about implicit worktree with $GIT_DIR Jeff King
2013-03-26 20:21 ` Jonathan Nieder
2013-03-26 20:27 ` Jeff King
2013-03-26 20:35 ` Jonathan Nieder
2013-03-27 8:24 ` Matthieu Moy
2013-03-26 20:13 ` [DONOTAPPLY PATCH 3/3] setup: treat GIT_DIR without GIT_WORK_TREE as a bare repo Jeff King
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to='CANgJU+U-M9zUUzRNJ=r=Utp7BMhGO37wDQAx8et0W23P3CTegA@mail.gmail.com' \
--to=demerphq@gmail.com \
--cc=git@vger.kernel.org \
--cc=gitster@pobox.com \
--cc=jrnieder@gmail.com \
--cc=peff@peff.net \
--cc=philipoakley@iee.org \
--cc=richard@nod.at \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).