5 ms·

No, the .git directory is not cloned. But if the repo is already on disk it can be game over.

by oauea 5y ago

ddworken 5y ago
Though you could have a repository on Github that contains a subdirectory that is a malicious bare Git repo. So doing: ``` git clone github.com/foo/bar cd bar/subdir/ ``` is unsafe with a Git PS1. See https://offensi.com/2019/12/16/4-google-cloud-shell-bugs-explained-bug-3/ https://offensi.com/2019/12/16/4-google-cloud-shell-bugs-exp...
- megous 5y ago
  Looks like git complains of invalid paths when you try that.
  - hsbauauvhabzb 5y ago
    Just because the cli won’t add doesn’t mean it may not be possible.
    - nybble41 4y ago
      I was able to manually construct a commit with a .git subdirectory using `git mktree` and `git commit-tree`, but Git still refused to create the .git subdirectory in the index or working copy: [testrepo]$ git checkout --orphan test-branch [testrepo]$ git update-ref HEAD f4da9cde406a7b80d99694b5f8d369a8dd6e5a7d [testrepo]$ git ls-tree -r HEAD 100644 blob e69de29bb2d1d6434b8b29ae775ad8c2e48c5391 a/.git/config [testrepo]$ git show commit f4da9cde406a7b80d99694b5f8d369a8dd6e5a7d (HEAD -> test-branch) Author: <<redacted>> Date: <<redacted>> WIP2 diff --git a/a/.git/config b/a/.git/config new file mode 100644 index 0000000..e69de29 [testrepo]$ git status On branch test-branch Changes to be committed: (use "git restore --staged <file>..." to unstage) deleted: a/.git/config [testrepo]$ git restore --staged a/.git/config error: invalid path 'a/.git/config' error: pathspec 'a/.git/config' did not match any file(s) known to git [testrepo]$ git reset --hard HEAD error: invalid path 'a/.git/config' fatal: Could not reset index file to revision 'HEAD'. So it looks like even if you do try to check out a tree with an unexpected .git subdirectory it won't actually be created in the filesystem.
  - jwilk 5y ago
    What do you mean?
- tedunangst 5y ago
  Or create a mercurial repo that contains a .git directory, and rely on finger memory making them run git immediately after cloning...
  - db48x 5y ago
    I’ve done that a few times. I’ve typed “git foo” while mentally thinking about “svn foo”, and after a few hours working on a project that still uses svn I will start making the opposite substitution too.
    - kruador 5y ago
      We use the grunt build tool. More than a handful of times, I've tried to get grunt to do a merge, or git to build the app.
  - comex 5y ago
    Finger memory, or just a shell configured to run `git status` before every command, as some people have. And besides a Mercurial repo, it could also be a tarball or zip file… Quite a dangerous situation.

No, the .git directory is not cloned. But if the repo is already on disk it can be game over.

by oauea 5y ago

No, the .git directory is not cloned. But if the repo is already on disk it can be game over.

Though you could have a repository on Github that contains a subdirectory that is a malicious bare Git repo. So doing: ``` git clone github.com/foo/bar cd bar/subdir/ ``` is unsafe with a Git PS1. See https://offensi.com/2019/12/16/4-google-cloud-shell-bugs-explained-bug-3/ https://offensi.com/2019/12/16/4-google-cloud-shell-bugs-exp...

megous 5y ago
Looks like git complains of invalid paths when you try that.
- hsbauauvhabzb 5y ago
  Just because the cli won’t add doesn’t mean it may not be possible.
  - nybble41 4y ago
    I was able to manually construct a commit with a .git subdirectory using `git mktree` and `git commit-tree`, but Git still refused to create the .git subdirectory in the index or working copy: [testrepo]$ git checkout --orphan test-branch [testrepo]$ git update-ref HEAD f4da9cde406a7b80d99694b5f8d369a8dd6e5a7d [testrepo]$ git ls-tree -r HEAD 100644 blob e69de29bb2d1d6434b8b29ae775ad8c2e48c5391 a/.git/config [testrepo]$ git show commit f4da9cde406a7b80d99694b5f8d369a8dd6e5a7d (HEAD -> test-branch) Author: <<redacted>> Date: <<redacted>> WIP2 diff --git a/a/.git/config b/a/.git/config new file mode 100644 index 0000000..e69de29 [testrepo]$ git status On branch test-branch Changes to be committed: (use "git restore --staged <file>..." to unstage) deleted: a/.git/config [testrepo]$ git restore --staged a/.git/config error: invalid path 'a/.git/config' error: pathspec 'a/.git/config' did not match any file(s) known to git [testrepo]$ git reset --hard HEAD error: invalid path 'a/.git/config' fatal: Could not reset index file to revision 'HEAD'. So it looks like even if you do try to check out a tree with an unexpected .git subdirectory it won't actually be created in the filesystem.
- jwilk 5y ago
  What do you mean?
tedunangst 5y ago
Or create a mercurial repo that contains a .git directory, and rely on finger memory making them run git immediately after cloning...
- db48x 5y ago
  I’ve done that a few times. I’ve typed “git foo” while mentally thinking about “svn foo”, and after a few hours working on a project that still uses svn I will start making the opposite substitution too.
  - kruador 5y ago
    We use the grunt build tool. More than a handful of times, I've tried to get grunt to do a merge, or git to build the app.
- comex 5y ago
  Finger memory, or just a shell configured to run `git status` before every command, as some people have. And besides a Mercurial repo, it could also be a tarball or zip file… Quite a dangerous situation.