git.vger.kernel.org archive mirror
 help / color / mirror / Atom feed
From: "René Scharfe." <l.s.r@web.de>
To: "Ævar Arnfjörð Bjarmason" <avarab@gmail.com>,
	"Junio C Hamano" <gitster@pobox.com>
Cc: git@vger.kernel.org, Elijah Newren <newren@gmail.com>,
	Han-Wen Nienhuys <hanwen@google.com>, Jeff King <peff@peff.net>,
	Taylor Blau <me@ttaylorr.com>
Subject: Re: What's cooking in git.git (Mar 2021, #03; Wed, 10)
Date: Thu, 11 Mar 2021 20:13:02 +0100	[thread overview]
Message-ID: <bb5f06df-226f-8c2d-93e1-7e55aab73917@web.de> (raw)
In-Reply-To: <87r1klhq3y.fsf@evledraar.gmail.com>

Am 11.03.21 um 12:44 schrieb Ævar Arnfjörð Bjarmason:
>
> On Thu, Mar 11 2021, Junio C Hamano wrote:
>
>> * rs/pretty-describe (2021-03-01) 4 commits
>>   (merged to 'next' on 2021-03-01 at bee9248828)
>>  + pretty: document multiple %(describe) being inconsistent
>>  + t4205: assert %(describe) test coverage
>>   (merged to 'next' on 2021-02-25 at 2347ed8fe6)
>>  + pretty: add merge and exclude options to %(describe)
>>  + pretty: add %(describe)
>>
>>  "git log --format='...'" learned "%(describe)" placeholder.

This is missing the patch to limit %(describe) expansing to one per
archive [1].  I think we need it to avoid hosters that generate archives
for user-supplied repos becoming vulnerable to a DoS attack via this new
feature.  Demo script in [2].

> As an aside did anyone look into making most of ./builtin/describe.c a
> new ./describe.c library? I had a quick aborted attempt at doing that,
> but it didn't seem like it would be all that hard...

That's what I thought as well, but combined with log --format it
produced bogus results for some commits.  No idea what went wrong
there.

René


[1] http://public-inbox.org/git/b7e1f6c0-6b13-efe4-74b5-ec8249855644@web.de/
[2] http://public-inbox.org/git/a28592c5-4a70-1ea8-fd73-959e28b4278d@web.de/

      parent reply	other threads:[~2021-03-11 19:13 UTC|newest]

Thread overview: 14+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2021-03-11  3:01 What's cooking in git.git (Mar 2021, #03; Wed, 10) Junio C Hamano
2021-03-11  4:49 ` Elijah Newren
2021-03-11  6:08   ` Junio C Hamano
2021-03-11  5:20 ` ZheNing Hu
2021-03-11  5:28   ` Junio C Hamano
2021-03-11  6:18     ` ZheNing Hu
2021-03-11 11:44 ` Ævar Arnfjörð Bjarmason
2021-03-11 13:01   ` Han-Wen Nienhuys
2021-03-11 18:12     ` Junio C Hamano
2021-03-11 16:17   ` Elijah Newren
2021-03-11 18:27   ` Junio C Hamano
2021-03-11 19:17     ` Jeff King
2021-03-12  7:10     ` Junio C Hamano
2021-03-11 19:13   ` René Scharfe. [this message]

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=bb5f06df-226f-8c2d-93e1-7e55aab73917@web.de \
    --to=l.s.r@web.de \
    --cc=avarab@gmail.com \
    --cc=git@vger.kernel.org \
    --cc=gitster@pobox.com \
    --cc=hanwen@google.com \
    --cc=me@ttaylorr.com \
    --cc=newren@gmail.com \
    --cc=peff@peff.net \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body. 
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).