Git: Malicious repositories can execute remote code while cloning

Re:Git: Malicious repositories can execute remote code while... by caymanjim on Tuesday March 09, 2021 @05:29PM (#26405275)

MacOS by default uses a "case-preserving case-insensitive" filesystem, so you can create files with mixed case, but you can't create two files with the same name and different case. It's one of MacOS's more-egregious crimes against Unix. Fortunately it doesn't manifest that often, but it rears its head often enough to be a problem.

[ Parent | on HN ]

Re:Git: Malicious repositories can execute remote code while... by leephillips on Tuesday March 09, 2021 @05:38PM (#26405397)

It may be a crime, but is the result of a set of compromises in the design of the OSX filesystem, which had to work with a BSD variant while also being compatible with pre-OSX days. I think it’s one thing they actually did an elegant job with.

EDIT: This document describes some of the challenges: https://www.usenix.org/legacy/publications/library/proceedin...

[ Parent | on HN ]

Re:Git: Malicious repositories can execute remote code while... by EamonnMR on Tuesday March 09, 2021 @09:34PM (#26407094)

This is the first article I've found that does a decent job of explaining what a resource fork really is.

[ Parent | on HN ]

Re:Git: Malicious repositories can execute remote code while... by _jal on Tuesday March 09, 2021 @05:45PM (#26405467)

> It's one of MacOS's more-egregious crimes against Unix.

Nah. Using a file system means putting up with its semantics. HFS+ was case-insensitive; they were deploying an upgrade to millions of existing filesystems.

If you mount, say, an NFS volume, MacOS does the expected thing.

[ Parent | on HN ]

Re:Git: Malicious repositories can execute remote code while... by dreamcompiler on Tuesday March 09, 2021 @11:35PM (#26407806)

The fact that Linux is case-sensitive is the egregious crime. It's a nasty holdover from circa-1970 Unix when case-folding was an expensive operation.

[ Parent | on HN ]

Re:Git: Malicious repositories can execute remote code while... by akersten on Wednesday March 10, 2021 @01:14AM (#26408346)

Case-senitivity is not a "nasty holdover", it is a good design decision that continues to be proven correct (case in point, this bugfix for case-insensitive filesystems).

Why would you introduce complexity into the filesystem to try to normalize file names when you can simply, not? I mean, have you _seen_ the mess that is Unicode normalization? Hundreds of different glyphs or whatever that are all considered equivalent, but are actually composed of different bytes. The filesystem should try to make sense of all that, and consider them equivalent paths?

Even if you say "well, just capitalization, not Unicode normalization," there's the whole German letter ẞ => ss (or is it ß?) and similar friends like the Turkish dotted I that have popped up as articles on HN. Absolutely glad Linux filesystems by and large do not attempt to take that on, and treat paths as a bucket of bytes instead.

All for what benefit - so you can type File.txt in the terminal and have the OS find file.txt? That is much more appropriate for the Application layer to resolve, rather than the filesystem.

Bugs like this come from over-engineering. Filesystems should be simple, and follow the principle of least surprise.

[ Parent | on HN ]

Re:Git: Malicious repositories can execute remote code while... by dreamcompiler on Wednesday March 10, 2021 @05:54PM (#26417558)

It bugs me to see foo.c and Foo.c as separate files in a directory listing. I like the fact that MacOS doesn't allow this situation to ever happen. Not taking on that problem means it's left to the user to figure out what's going on when similar glyphs occur.

[ Parent | on HN ]

Re:Git: Malicious repositories can execute remote code while... by Ancapistani on Tuesday March 09, 2021 @09:03PM (#26406905)

> Fortunately it doesn't manifest that often, but it rears its head often enough to be a problem.

IIRC, one place where it does rear its head in when a file is renamed in a git commit to a value that downcases to the same value as the prior name. For example `Foo.txt`->`foo.txt`.

I have `core.ignorecase = true` in my `.gitconfig` for this very reason.

[ Parent | on HN ]

Re:Git: Malicious repositories can execute remote code while... by geofft on Tuesday March 09, 2021 @09:31PM (#26407079)

The extraordinarily frustrating case is where you're working on a repository that has multiple files that differ only by case. Git will check out one of them, then overwrite it with the other.

The Linux kernel is one of them: several of the headers that get installed to /usr/include/linux/netfilter have conflicts on a case-insensitive filesystem. https://github.com/torvalds/linux/tree/master/include/uapi/l...

Debhelper used to be one of those until I convinced them to change it: they had a Debian/ directory for the Perl module Debian::Debhelper as well as a debian/ directory for the packaging metadata. https://bugs.debian.org/873043

(I suspect I'm a little unusual in wanting to have checkouts of Linux and Debhelper on my Mac homedir.)

[ Parent | on HN ]

Re:Git: Malicious repositories can execute remote code while... by ComputerGuru on Tuesday March 09, 2021 @05:45PM (#26405471)

That’s the same as Windows, but Windows enables making directories case sensitive on a directory by directory basis.

[ Parent | on HN ]

Re:Git: Malicious repositories can execute remote code while... by shp0ngle on Thursday March 11, 2021 @02:38AM (#26421344)

wasn't this fixed with their new Apple FS?

Wait I'll try

...nope, after `touch makefile` and `touch Makefile`, I still see just `makefile`. OK

[ Parent | on HN ]