3 ms·
One mitigation for this is to use `col -bp` as a git pager, but it seems clumsy. However, for completeness I post it here with an example for how this makes the
by jsteemann 9y ago
One mitigation for this is to use `col -bp` as a git pager, but it seems clumsy.
However, for completeness I post it here with an example for how this makes the backdoor visible.
Reproduce instruction:
# clone repo and cd into it
git clone https://github.com/twistlock/gitPocDiff https://github.com/twistlock/gitPocDiff
cd gitPocDiff
# show diff (this includes the backdoor but it won't be visible)
git show ebc3f506a7ec8278e1a3ad4108612b66d10b41ca
# expose the backdoor, using `col -bp` as pager
git show ebc3f506a7ec8278e1a3ad4108612b66d10b41ca | col -bp
- jwilk 9y agoNo, "col -bp" is not bulletproof. The attacker could still use backspace characters to hide malicious content.