4 ms·
This is silly. Fix PS1, I can’t trust all repos I clone. I also want to cross-user access git log/blame etc.
by hsbauauvhabzb 5y ago
This is silly. Fix PS1, I can’t trust all repos I clone. I also want to cross-user access git log/blame etc.
- deleted 5y ago[deleted]
- deleted 5y ago[deleted]
- megous 5y agoCan't you? What kind of foreign code can be executed that way? Clonning will not copy .git/hooks/ nor .git/config which is the main danger here, I guess. But I'd sure want to hear about other risks. Maybe an env variable to disable hooks execution and .git/config parsing would be nice to have for safer use of git repositories you didn't clone yourself as part of shell prompt customizations.
- hsbauauvhabzb 5y agoGit clone doesn’t mean I’m blindly executing the code inside it.
- megous 5y agoAlso, looks like you didn't read the linked page. The first thing there is a git config option to disable this check on select directories.
- saagarjha 5y agoObviously adding every single repo you will ever work with into the config is not workable.
- kadoban 5y agoYou don't have to trust repos you clone, if I understand correctly. You just need to trust ones you're given in other ways. The difference is, clone won't let you set up arbitrary config (or malformed internal data or etc.)
- hsbauauvhabzb 5y agoCan you store a .git/config filepath in a git repository, either via the cli or manually hacking the repo data files?
- jwilk 5y agoI hope not! But, as it was pointed out in <https://news.ycombinator.com/item?id=31010522 https://news.ycombinator.com/item?id=31010522>, you can have nested malicious bare git repos.
- kadoban 5y agoNo. I think long ago there may have been some bug that allowed it with a hacked repo, so it's not a ridiculous thing to consider, but no git won't let you and any way you could would be a major CVE.