Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Nits to improve git backend #7

Merged
merged 1 commit into from
Apr 16, 2023

Conversation

6543
Copy link
Contributor

@6543 6543 commented Apr 13, 2023

close #6

I could not find any issues ... so this is just Nits to ensure it stays like that

@thomiceli
Copy link
Owner

Thank you for your PR ; just for my knowledge, is there any use case where git ls-tree <revision> --name-only would have been unsafe or unstable with this context ?

@6543
Copy link
Contributor Author

6543 commented Apr 14, 2023

I did not had a look in try to craft an exploit against it ... nor if it is posible at all.

This pull just make sure there for sure is none ... we at gitea did had some issues specific to such escape git commands ... you might find the CVE ...

@thomiceli
Copy link
Owner

I will check it out more closely, thanks

@thomiceli thomiceli merged commit 19db4c2 into thomiceli:master Apr 16, 2023
@6543 6543 deleted the terminate-commands branch April 16, 2023 15:18
jiriks74 pushed a commit to jiriks74/opengist that referenced this pull request Apr 28, 2024
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

If not done right you can craft git references that lead to RCE
2 participants