Files
git/Documentation
Taylor Blau a1d4f67c12 transport: make protocol.file.allow be "user" by default
An earlier patch discussed and fixed a scenario where Git could be used
as a vector to exfiltrate sensitive data through a Docker container when
a potential victim clones a suspicious repository with local submodules
that contain symlinks.

That security hole has since been plugged, but a similar one still
exists.  Instead of convincing a would-be victim to clone an embedded
submodule via the "file" protocol, an attacker could convince an
individual to clone a repository that has a submodule pointing to a
valid path on the victim's filesystem.

For example, if an individual (with username "foo") has their home
directory ("/home/foo") stored as a Git repository, then an attacker
could exfiltrate data by convincing a victim to clone a malicious
repository containing a submodule pointing at "/home/foo/.git" with
`--recurse-submodules`. Doing so would expose any sensitive contents in
stored in "/home/foo" tracked in Git.

For systems (such as Docker) that consider everything outside of the
immediate top-level working directory containing a Dockerfile as
inaccessible to the container (with the exception of volume mounts, and
so on), this is a violation of trust by exposing unexpected contents in
the working copy.

To mitigate the likelihood of this kind of attack, adjust the "file://"
protocol's default policy to be "user" to prevent commands that execute
without user input (including recursive submodule initialization) from
taking place by default.

Suggested-by: Jeff King <peff@peff.net>
Signed-off-by: Taylor Blau <me@ttaylorr.com>
2022-10-01 00:23:38 -04:00
..
2020-07-06 22:09:16 -07:00
2022-06-23 12:31:05 +02:00
2019-05-09 00:37:27 +09:00
2020-08-04 18:34:02 -07:00
2020-09-19 15:56:06 -07:00
2021-01-04 11:27:48 -08:00
2021-01-04 11:27:48 -08:00
2020-04-29 16:15:27 -07:00
2019-08-11 17:40:07 -07:00
2019-01-23 11:37:29 -08:00
2020-10-22 10:29:30 -07:00
2018-12-26 14:59:37 -08:00
2021-01-04 11:27:48 -08:00
2019-05-07 13:04:48 +09:00
2019-05-07 13:04:48 +09:00
2020-12-17 15:06:40 -08:00
2019-10-21 12:02:39 +09:00