Skip to main content

Browse the archive

Revision 8db1e8743c0f1ed241f6a1b8bf55b6fef07d6751 authored by Johannes Schindelin on 28 March 2024, 18:21:06 UTC, committed by Johannes Schindelin on 19 April 2024, 10:38:23 UTC 
clone: prevent hooks from running during a clone
 
Critical security issues typically combine relatively common
vulnerabilities such as case confusion in file paths with other
weaknesses in order to raise the severity of the attack.

One such weakness that has haunted the Git project in many a
submodule-related CVE is that any hooks that are found are executed
during a clone operation. Examples are the `post-checkout` and
`fsmonitor` hooks.

However, Git's design calls for hooks to be disabled by default, as only
disabled example hooks are copied over from the templates in
`<prefix>/share/git-core/templates/`.

As a defense-in-depth measure, let's prevent those hooks from running.

Obviously, administrators can choose to drop enabled hooks into the
template directory, though, _and_ it is also possible to override
`core.hooksPath`, in which case the new check needs to be disabled.

Signed-off-by: Johannes Schindelin <johannes.schindelin@gmx.de>
1 parent 584de0b
Raw File
walker.h 
#ifndef WALKER_H
#define WALKER_H

#include "remote.h"

struct walker {
	void *data;
	int (*fetch_ref)(struct walker *, struct ref *ref);
	void (*prefetch)(struct walker *, unsigned char *sha1);
	int (*fetch)(struct walker *, unsigned char *sha1);
	void (*cleanup)(struct walker *);
	int get_verbosely;
	int get_progress;
	int get_recover;

	int corrupt_object_found;
};

/* Report what we got under get_verbosely */
__attribute__((format (printf, 2, 3)))
void walker_say(struct walker *walker, const char *fmt, ...);

/* Load pull targets from stdin */
int walker_targets_stdin(char ***target, const char ***write_ref);

/* Free up loaded targets */
void walker_targets_free(int targets, char **target, const char **write_ref);

/* If write_ref is set, the ref filename to write the target value to. */
/* If write_ref_log_details is set, additional text will appear in the ref log. */
int walker_fetch(struct walker *impl, int targets, char **target,
		 const char **write_ref, const char *write_ref_log_details);

void walker_free(struct walker *walker);

struct walker *get_http_walker(const char *url);

#endif /* WALKER_H */
back to top