4 ms·
Here's a note about it in the Git mirror repo: Malicious URLs may cause Git to present stored credentials to the wrong server - https://github.com/git/git/secu
by lioeters 7y ago
Here's a note about it in the Git mirror repo:
Malicious URLs may cause Git to present stored credentials to the wrong server - https://github.com/git/git/security/advisories/GHSA-qm7j-c969-7j4q https://github.com/git/git/security/advisories/GHSA-qm7j-c96...
..And the commit that fixed it:
https://github.com/git/git/commit/9a6bbee8006c24b46a85d29e7b38cfa79e9ab21b https://github.com/git/git/commit/9a6bbee8006c24b46a85d29e7b...
- floatingatoll 7y agoPreviously on HN (2 comments, yesterday): https://news.ycombinator.com/item?id=22876108 https://news.ycombinator.com/item?id=22876108
- asdfqwerty18 7y agothanks
- kyrra 7y agoI wonder how this fix behaves with '\r' on all platforms. Obviously the primary systems (windows/osx/linux/bsd) all use \n or \r\n, but I'm wondering if Git has been ported to more obscure systems that only use \r [0], and how this fix would behave there. [0] https://en.wikipedia.org/wiki/Newline#Representation https://en.wikipedia.org/wiki/Newline#Representation
- peff 7y agoThat was discussed before the fix, but it doesn't matter. The helper protocol specifies a raw newline as the delimiter, and both sides of the conversation parse on that.