Skip to content
Snippets Groups Projects
  1. Dec 22, 2019
    • Georges Racinet's avatar
      tests: skipping test-illegal-contents on Git >= 2.24 · ed3767c0bc92
      Georges Racinet authored
      Git behaviour and output has changed, in a way that seems
      hard to reconcile with glob or regex patterns.
      
      we'll probably have to write an entire variant of this test.
      In the meanwhile, this skipping should restore the main CI runs.
      ed3767c0bc92
  2. Aug 01, 2019
  3. Feb 04, 2016
  4. Nov 24, 2014
    • durin42's avatar
      hg2git: audit path components during export (CVE-2014-9390) · 81c55f8629ba
      durin42 authored
      A user recently got confused and managed to track and export a .git
      directory, which confuses git and causes it to emit very odd
      errors. For example, cloning one such repository (which has a symlink
      for .git) produces this output from git:
      
        Cloning into 'git'...
        done.
        error: Updating '.git' would lose untracked files in it
      
      and another (which has a .git directory checked in) produces this:
      
        Cloning into 'git'...
        done.
        error: Invalid path '.git/hooks/post-update'
      
      If it ended there, that'd be fine, but this led to a line of
      investigation that ended with CVE-2014-9390, so now git will block
      checking these revisions out, so we should try to prevent
      foot-shooting on our end. Since some servers (notably github) are
      blocking trees that contain these entries, default to refusing to
      export any path component that looks like it folds to .git. Since some
      histories probably contain this already, we offer an escape hatch via
      the config option git.blockdotgit that allows users to resume
      foot-shooting behavior.
      81c55f8629ba
Loading