3 ms·
The question is whether recursive submodule checkout happens after some integrity/signature validation or before. The RCE can be an issue in the latter case.
by leni536 1y ago
The question is whether recursive submodule checkout happens after some integrity/signature validation or before. The RCE can be an issue in the latter case.
- johncolanduoni 1y agoThere would also have to be a compromise of the transport (i.e. a MITM of HTTPS or SSH) to use this in most practical scenarios.
- leni536 1y agoIt still weakens the security, otherwise why bother with integrity/signature checks if you trust the git remote?