5 ms·

Though you could have a repository on Github that contains a subdirectory that is a malicious bare Git repo. So doing: ``` git clone github.com/foo/bar cd bar/

Though you could have a repository on Github that contains a subdirectory that is a malicious bare Git repo. So doing: ``` git clone github.com/foo/bar cd bar/subdir/ ``` is unsafe with a Git PS1. See https://offensi.com/2019/12/16/4-google-cloud-shell-bugs-explained-bug-3/ https://offensi.com/2019/12/16/4-google-cloud-shell-bugs-exp...

megous 4y ago
Looks like git complains of invalid paths when you try that.
- hsbauauvhabzb 4y ago
  Just because the cli won’t add doesn’t mean it may not be possible.
  - nybble41 4y ago
    I was able to manually construct a commit with a .git subdirectory using `git mktree` and `git commit-tree`, but Git still refused to create the .git subdirectory in the index or working copy: [testrepo]$ git checkout --orphan test-branch [testrepo]$ git update-ref HEAD f4da9cde406a7b80d99694b5f8d369a8dd6e5a7d [testrepo]$ git ls-tree -r HEAD 100644 blob e69de29bb2d1d6434b8b29ae775ad8c2e48c5391 a/.git/config [testrepo]$ git show commit f4da9cde406a7b80d99694b5f8d369a8dd6e5a7d (HEAD -> test-branch) Author: <<redacted>> Date: <<redacted>> WIP2 diff --git a/a/.git/config b/a/.git/config new file mode 100644 index 0000000..e69de29 [testrepo]$ git status On branch test-branch Changes to be committed: (use "git restore --staged <file>..." to unstage) deleted: a/.git/config [testrepo]$ git restore --staged a/.git/config error: invalid path 'a/.git/config' error: pathspec 'a/.git/config' did not match any file(s) known to git [testrepo]$ git reset --hard HEAD error: invalid path 'a/.git/config' fatal: Could not reset index file to revision 'HEAD'. So it looks like even if you do try to check out a tree with an unexpected .git subdirectory it won't actually be created in the filesystem.
- jwilk 4y ago
  What do you mean?
tedunangst 4y ago
Or create a mercurial repo that contains a .git directory, and rely on finger memory making them run git immediately after cloning...
- db48x 4y ago
  I’ve done that a few times. I’ve typed “git foo” while mentally thinking about “svn foo”, and after a few hours working on a project that still uses svn I will start making the opposite substitution too.
  - kruador 4y ago
    We use the grunt build tool. More than a handful of times, I've tried to get grunt to do a merge, or git to build the app.
- comex 4y ago
  Finger memory, or just a shell configured to run `git status` before every command, as some people have. And besides a Mercurial repo, it could also be a tarball or zip file… Quite a dangerous situation.

megous 4y ago

Looks like git complains of invalid paths when you try that.

hsbauauvhabzb 4y ago
Just because the cli won’t add doesn’t mean it may not be possible.
- nybble41 4y ago
  I was able to manually construct a commit with a .git subdirectory using `git mktree` and `git commit-tree`, but Git still refused to create the .git subdirectory in the index or working copy: [testrepo]$ git checkout --orphan test-branch [testrepo]$ git update-ref HEAD f4da9cde406a7b80d99694b5f8d369a8dd6e5a7d [testrepo]$ git ls-tree -r HEAD 100644 blob e69de29bb2d1d6434b8b29ae775ad8c2e48c5391 a/.git/config [testrepo]$ git show commit f4da9cde406a7b80d99694b5f8d369a8dd6e5a7d (HEAD -> test-branch) Author: <<redacted>> Date: <<redacted>> WIP2 diff --git a/a/.git/config b/a/.git/config new file mode 100644 index 0000000..e69de29 [testrepo]$ git status On branch test-branch Changes to be committed: (use "git restore --staged <file>..." to unstage) deleted: a/.git/config [testrepo]$ git restore --staged a/.git/config error: invalid path 'a/.git/config' error: pathspec 'a/.git/config' did not match any file(s) known to git [testrepo]$ git reset --hard HEAD error: invalid path 'a/.git/config' fatal: Could not reset index file to revision 'HEAD'. So it looks like even if you do try to check out a tree with an unexpected .git subdirectory it won't actually be created in the filesystem.
jwilk 4y ago
What do you mean?

tedunangst 4y ago

Or create a mercurial repo that contains a .git directory, and rely on finger memory making them run git immediately after cloning...

db48x 4y ago
I’ve done that a few times. I’ve typed “git foo” while mentally thinking about “svn foo”, and after a few hours working on a project that still uses svn I will start making the opposite substitution too.
- kruador 4y ago
  We use the grunt build tool. More than a handful of times, I've tried to get grunt to do a merge, or git to build the app.
comex 4y ago
Finger memory, or just a shell configured to run `git status` before every command, as some people have. And besides a Mercurial repo, it could also be a tarball or zip file… Quite a dangerous situation.