4 ms·
> What is the simple test for whether this is the case or not? As suggested in GitHub's announcement post[1], you can test this with the following: `git confi
by matheust 6y ago
> What is the simple test for whether this is the case or not?
As suggested in GitHub's announcement post[1], you can test this with the following:
`git config --show-scope --get-regexp 'filter\..*\.process'`
(replace the single quotes by double quotes on Windows Command Prompt)
> Is this a default-on scenario?
On Windows yes, because Git-for-Windows configures Git LFS by default.
[1]: https://github.blog/2021-03-09-git-clone-vulnerability-announced https://github.blog/2021-03-09-git-clone-vulnerability-annou...
- dragonwriter 6y agoDoesn't Git-for-Windows default configure symbolic link support off, though? Or does this exploit work even in that case as long as the underlying file system supports symlinks?
- matheust 6y agoGit-for-Windows may turn symlink support on by default under some specific circumstances. As the repo's wiki [1] says: Short version: there is no exact equivalent for POSIX symlinks on Windows, and the closest thing is unavailable for non-admins by default unless Developer Mode is enabled and a relatively recent Windows 10 version is used. Therefore, symlink emulation support is only turned on by default when that scenario is detected. [1]: https://github.com/git-for-windows/git/wiki/Symbolic-Links https://github.com/git-for-windows/git/wiki/Symbolic-Links