lobsters__frankwiles@crustaceanson.theshelf.topM to Lobsters - all tags@crustaceanson.theshelf.topEnglish · 26 days ago[security, vcs] I got targeted: Trying to get your credentials via a git post-checkout hookfrankwiles.comexternal-linkmessage-square27linkfedilinkarrow-up10file-textcross-posted to: technology@lemmy.world
arrow-up10external-link[security, vcs] I got targeted: Trying to get your credentials via a git post-checkout hookfrankwiles.comlobsters__frankwiles@crustaceanson.theshelf.topM to Lobsters - all tags@crustaceanson.theshelf.topEnglish · 26 days agomessage-square27linkfedilinkfile-textcross-posted to: technology@lemmy.world
minus-squarelobsters__agwa@crustaceanson.theshelf.toplinkfedilinkarrow-up1·25 days agoAs I said in my comment, cloning a repo cannot install malicious config. It’s the other ways of installing directory trees that you have to be wary of. score 1 · canonical
minus-squarelobsters__quasi_b0ee@crustaceanson.theshelf.topMlinkfedilinkarrow-up1·24 days agohttps://github.com/justinsteven/advisories/blob/main/2022_git_buried_bare_repos_and_fsmonitor_various_abuses.md Running operations in a subdirectory can still own you unless you turn on an option that’s off by default. Specifically: git clone ssh://git@host.example/helloworld.git cd helloworld git status # <-- Safe cd malicious_subdirectory git status # <-- Dangerous score 1 · canonical
minus-squarelobsters__samrw@crustaceanson.theshelf.topMlinkfedilinkarrow-up1·24 days agoAhhhh I see the distinction. If you clone it you’re fine, but if you e.g, download it from Dropbox, you get RCE. Tricky! score 1 · canonical
As I said in my comment, cloning a repo cannot install malicious config. It’s the other ways of installing directory trees that you have to be wary of.
score 1 · canonical
https://github.com/justinsteven/advisories/blob/main/2022_git_buried_bare_repos_and_fsmonitor_various_abuses.md
Running operations in a subdirectory can still own you unless you turn on an option that’s off by default. Specifically:
git clone ssh://git@host.example/helloworld.git cd helloworld git status # <-- Safe cd malicious_subdirectory git status # <-- Dangerousscore 1 · canonical
Ahhhh I see the distinction. If you clone it you’re fine, but if you e.g, download it from Dropbox, you get RCE. Tricky!
score 1 · canonical