3 ms·
> Git support: View the staged and unstaged status of every file, right there in the standard view. Also works in tree view. This is nearly impossible to imple
by jwilk 9y ago
> Git support: View the staged and unstaged status of every file, right there in the standard view. Also works in tree view.
This is nearly impossible to implement securely.
Better don't run exa against untrusted directories.
- steveklabnik 9y agoIt uses libgit2 for this; I don't know what specific attack vector you're thinking about though.
- lima 9y agoGit's on disk format has a massive attack surface. Do not run "git" in untrusted directories. It is not hardened against that (as opposed to the network protocol). That probably includes libgit2 unless it explicitly states the opposite.
- jwilk 9y agoThe blurb made it sound like it checks the git status by default. But this isn't the case. You have to explicitly ask for with --git. Never mind then.
- urda 9y agoCan you please expand on your comment? It currently makes zero sense with zero references.