4 ms·

I think many people don't realize that the git integrated shell prompts for example are not safe to use in untrusted git repos. Lots of editors will also query

I think many people don't realize that the git integrated shell prompts for example are not safe to use in untrusted git repos. Lots of editors will also query git repo information for displaying information to the user, and may do this completely automatically. If you "git clone" the repo, git will not clone hooks from my understanding, so the primary issue is unpacking a tarball with a git repo inside of it and then trying to do something with the repo.

abathur 3y ago
If your toolchain does something silly like eval some output from git, cloning and then triggering that interaction (probably cding in) could be enough. I made a little test repo for this a while back https://github.com/abathur/LittleGaryGitles https://github.com/abathur/LittleGaryGitles :)
tomlx 3y ago
git does not clone hooks, but if a subdirectory of a repo has the structure of a bare repo it can hijack git subcommands for code execution. try: git clone https://git.0x90.space/vmann/pwnd && cd pwnd/whoot && git status it is a bit crazy this is not disabled by default yet.
- darau1 3y ago
  That's terrifying. I'll think twice before cloning any repository from now on. > not disabled by default yet You're saying there's a way to "disable" this behavior?
  - tomlx 3y ago
    none that i know of
  - joeyh 3y ago
    Set safe.bareRepository = explicit.
    - jwilk 3y ago
      Available since Git v2.38: https://github.com/git/git/commit/8d1a7448206e11cd https://github.com/git/git/commit/8d1a7448206e11cd
- jdsalaro 3y ago
  That's fascinating! Time to update my Blogpost on git hooks and go down this rabbit hole !