Anyone can access deleted and private repository data on GitHub

Re:Anyone can access deleted and private repository data on ... by qual on Wednesday July 24, 2024 @03:24PM (#41060858)

>If you know the hash of some data, then you either already have the data yourself, or you learned the hash from someone who had the data.

From the article, you do not need to have the data nor learn the hash from someone who had the data.

>Commit hashes can be brute forced through GitHub’s UI, particularly because the git protocol permits the use of short SHA-1 values when referencing a commit. A short SHA-1 value is the minimum number of characters required to avoid a collision with another commit hash, with an absolute minimum of 4. The keyspace of all 4 character SHA-1 values is 65,536

[ Parent | on HN ]

Re:Anyone can access deleted and private repository data on ... by londons_explore on Wednesday July 24, 2024 @03:27PM (#41060890)

In which case, yeah, thats a vulnerability. They shouldn't allow a short hash to match up against anything but public data.

[ Parent | on HN ]

Re:Anyone can access deleted and private repository data on ... by gus_massa on Wednesday July 24, 2024 @04:16PM (#41061541)

It's common to use short hash in pull request, and then modify or rebase the commits.

The solutions are:

* Force people to use the full hash.

* Get use to a lot of dead links.

* Claim that it's a feature, not a bug.

[ Parent | on HN ]

Re:Anyone can access deleted and private repository data on ... by guipsp on Wednesday July 24, 2024 @05:47PM (#41062526)

* Force people to use the full hash for commits pushed now on?

[ Parent | on HN ]

Re:Anyone can access deleted and private repository data on ... by Dylan16807 on Thursday July 25, 2024 @02:06AM (#41065203)

* Check visibility at the time of posting.

[ Parent | on HN ]