Re:Git security vulnerability announced
by megous on Tuesday April 12, 2022 @11:04PM
(#31010771)
Looks like git complains of invalid paths when you try that.
[ Parent
| on HN ]
Re:Git security vulnerability announced
by hsbauauvhabzb on Wednesday April 13, 2022 @04:46AM
(#31012451)
Just because the cli won’t add doesn’t mean it may not be possible.
I was able to manually construct a commit with a .git subdirectory using `git mktree` and `git commit-tree`, but Git still refused to create the .git subdirectory in the index or working copy:
[testrepo]$ git checkout --orphan test-branch
[testrepo]$ git update-ref HEAD f4da9cde406a7b80d99694b5f8d369a8dd6e5a7d
[testrepo]$ git ls-tree -r HEAD
100644 blob e69de29bb2d1d6434b8b29ae775ad8c2e48c5391 a/.git/config
[testrepo]$ git show
commit f4da9cde406a7b80d99694b5f8d369a8dd6e5a7d (HEAD -> test-branch)
Author: <<redacted>>
Date: <<redacted>>
WIP2
diff --git a/a/.git/config b/a/.git/config
new file mode 100644
index 0000000..e69de29
[testrepo]$ git status
On branch test-branch
Changes to be committed:
(use "git restore --staged <file>..." to unstage)
deleted: a/.git/config
[testrepo]$ git restore --staged a/.git/config
error: invalid path 'a/.git/config'
error: pathspec 'a/.git/config' did not match any file(s) known to git
[testrepo]$ git reset --hard HEAD
error: invalid path 'a/.git/config'
fatal: Could not reset index file to revision 'HEAD'.
So it looks like even if you do try to check out a tree with an unexpected .git subdirectory it won't actually be created in the filesystem.