News for hackers. Stuff that matters.
Re:Git security vulnerability announced by megous on Tuesday April 12, 2022 @11:04PM (#31010771)
Looks like git complains of invalid paths when you try that.
Re:Git security vulnerability announced by hsbauauvhabzb on Wednesday April 13, 2022 @04:46AM (#31012451)
Just because the cli won’t add doesn’t mean it may not be possible.
Re:Git security vulnerability announced by nybble41 on Thursday April 14, 2022 @01:55PM (#31030631)
I was able to manually construct a commit with a .git subdirectory using `git mktree` and `git commit-tree`, but Git still refused to create the .git subdirectory in the index or working copy:

  [testrepo]$ git checkout --orphan test-branch
  
  [testrepo]$ git update-ref HEAD f4da9cde406a7b80d99694b5f8d369a8dd6e5a7d
  
  [testrepo]$ git ls-tree -r HEAD
  100644 blob e69de29bb2d1d6434b8b29ae775ad8c2e48c5391    a/.git/config

  [testrepo]$ git show
  commit f4da9cde406a7b80d99694b5f8d369a8dd6e5a7d (HEAD -> test-branch)
  Author: <<redacted>>
  Date:   <<redacted>>

      WIP2

  diff --git a/a/.git/config b/a/.git/config
  new file mode 100644
  index 0000000..e69de29

  [testrepo]$ git status
  On branch test-branch
  Changes to be committed:
    (use "git restore --staged <file>..." to unstage)
          deleted:    a/.git/config

  [testrepo]$ git restore --staged a/.git/config
  error: invalid path 'a/.git/config'
  error: pathspec 'a/.git/config' did not match any file(s) known to git

  [testrepo]$ git reset --hard HEAD
  error: invalid path 'a/.git/config'
  fatal: Could not reset index file to revision 'HEAD'.
So it looks like even if you do try to check out a tree with an unexpected .git subdirectory it won't actually be created in the filesystem.
Re:Git security vulnerability announced by jwilk on Wednesday April 13, 2022 @04:55AM (#31012495)
What do you mean?