3 ms·

It’s one step more indirect than that. If I want my prompt to tell me what branch is checked out, I can have it include the output of running `git branch`, for

by db48x 5y ago

It’s one step more indirect than that. If I want my prompt to tell me what branch is checked out, I can have it include the output of running `git branch`, for example. Unbeknownst to me, running `git branch` can cause git to run programs specified in the git repository’s config file. It’s not normally a problem of course, because I am using my own computer with all of my own git repositories. But it can be a problem if the computer is shared with others.

zarzavat 5y ago
> `git branch` can cause git to run programs specified in the git repository’s config file This is the real vulnerability. Why is git branch running random external programs?
- dataflow 5y ago
  I think `git branch` here wasn't intended to be taken literally. If anything, you'd use a plumbing command to get the branch, not a porcelain command. I think they just meant that some commands that might be run might in turn run programs specified in the config file (either now or in the future).
  - zarzavat 5y ago
    So what's a good example of a git command that you might reasonably run as part of your $PS1 that runs an external program? It's not like people have git push or git commit in their $PS1.
    - faho 5y ago
      `git status`. This essentially has a "prompt" mode with `--porcelain`, which can even print branch and stash state, so it features all of the information for a prompt. Prompts have been mentioned in adding the v2 porcelain format[0] It will call the fsmonitor hook configured in core.fsmonitor - this is supposed to speed up figuring out which files to check. The official git-prompt.sh calls `git diff`, which will do the same[1]. [0]: https://github.com/git/git/commit/00d27937bf0348e7da615f04b65f535a58e096c1 https://github.com/git/git/commit/00d27937bf0348e7da615f04b6... [1]: https://github.com/git/git/blob/11cfe552610386954886543f5de87dcc49ad5735/contrib/completion/git-prompt.sh#L528 https://github.com/git/git/blob/11cfe552610386954886543f5de8...

by db48x 5y ago

zarzavat 5y ago

> `git branch` can cause git to run programs specified in the git repository’s config file This is the real vulnerability. Why is git branch running random external programs?

dataflow 5y ago
I think `git branch` here wasn't intended to be taken literally. If anything, you'd use a plumbing command to get the branch, not a porcelain command. I think they just meant that some commands that might be run might in turn run programs specified in the config file (either now or in the future).
- zarzavat 5y ago
  So what's a good example of a git command that you might reasonably run as part of your $PS1 that runs an external program? It's not like people have git push or git commit in their $PS1.
  - faho 5y ago
    `git status`. This essentially has a "prompt" mode with `--porcelain`, which can even print branch and stash state, so it features all of the information for a prompt. Prompts have been mentioned in adding the v2 porcelain format[0] It will call the fsmonitor hook configured in core.fsmonitor - this is supposed to speed up figuring out which files to check. The official git-prompt.sh calls `git diff`, which will do the same[1]. [0]: https://github.com/git/git/commit/00d27937bf0348e7da615f04b65f535a58e096c1 https://github.com/git/git/commit/00d27937bf0348e7da615f04b6... [1]: https://github.com/git/git/blob/11cfe552610386954886543f5de87dcc49ad5735/contrib/completion/git-prompt.sh#L528 https://github.com/git/git/blob/11cfe552610386954886543f5de8...