4 ms·
haha sure. so when you git clone something, it arrives to you through divination, and there is no larger attack vector once you can meddle with the entire commu
by 4gotunameagain 3y ago
haha sure. so when you git clone something, it arrives to you through divination, and there is no larger attack vector once you can meddle with the entire communication part and not just the blobs and refs.
- kragen 3y agoin this case it arrives to you through apache, which gives git the contents of the files it requests, just like the filesystem does when you clone a repo off a usb pendrive. there's no git-specific code running on the server when you clone that url there is, however, a faster 'smart http' git cloning protocol which apache can't participate in, and that is indeed a potential attack surface. i don't think any of the bugs i linked upthread were in that protocol though