The commit that fixes this issue: https://github.com/gitster/git/commit/684dd4c2b414bcf648505e... (Surprise, the root cause is a cache )
Strange. The guy who fixed the issue works at Microsoft, but uses his gmx email for Github.
Git: Malicious repositories can execute remote code while cloning
111–120 of 228 posts
Re: Git: Malicious repositories can execute remote code while cloning
#112Re: Git: Malicious repositories can execute remote code while cloning
#113Earlier quoted context omitted.
Difficult problems in programming: (1) cache invalidation (2) off-by-one errors
I thought the two hardest problems were: 1) naming 2) cache invalidation ... 3) off-by-one errors
You forgot
0) Race consegmentation fault (core dumped)
(I know I was ninja’d but didn’t see until after)
Re: Git: Malicious repositories can execute remote code while cloning
#114Re: Git: Malicious repositories can execute remote code while cloning
#115Earlier quoted context omitted.
I mean, there are... not-totally-unreasonable workflows that do clones as root. Edit: although I am struggling to think of one that clones from an untrusted source.
> not-totally-unreasonable workflows that do clones as root Uh... really? Like what?
etckeeper and friends (I have a git checkout in /etc/nixos on nixos machines), portage sync on funtoo, pulling ports tree or even system source on a BSD, grabbing setup scripts during install of Arch before a non-root user exists
Re: Git: Malicious repositories can execute remote code while cloning
#116Earlier quoted context omitted.
> not-totally-unreasonable workflows that do clones as root Uh... really? Like what?
etckeeper and friends (I have a git checkout in /etc/nixos on nixos machines), portage sync on funtoo, pulling ports tree or even system source on a BSD, grabbing setup scripts during install of Arch before a non-root user exists
So, basically workflows where the cloned code gets run as root without further inspection anyways.
Re: Git: Malicious repositories can execute remote code while cloning
#117I guess I'll have to stop running $ sudo git clone ...
I don't think that smugly not running as root saves normal users; while malware running as your user can't trash your laptop, they can get your Google cookie and read and send emails as you, spend your money, view your private photos, etc.
And it can run sudo as your user after you warm it up. Or use any number of frequently disclosed OS vulnerabilities for local privilege escalation.
Re: Git: Malicious repositories can execute remote code while cloning
#118That could be any Git repository. Have you seen the mayhem that some of mine cause when you clone them and then type ./configure && make, like you have been socially engineered into doing?
It doesn't even have to be there... The main reasons to clone a repo are because you're about to compile and run the code there, or you already have and need to fix something.
I don't personally audit all the code I run, but I hope someone is doing it. That being said, source code being public is much better than the alternative of just downloading binaries from who knows where.
I don't trust anything absolutely, and I don't see a way past it.
Re: Git: Malicious repositories can execute remote code while cloning
#119That could be any Git repository. Have you seen the mayhem that some of mine cause when you clone them and then type ./configure && make, like you have been socially engineered into doing?
There is a huge difference between “clone a repo” and “clone a repo and run code from it”.
Re: Git: Malicious repositories can execute remote code while cloning
#120That could be any Git repository. Have you seen the mayhem that some of mine cause when you clone them and then type ./configure && make, like you have been socially engineered into doing?
For a while I tried to only run untrusted builds in Docker containers, like doing `docker run -v $PWD:/src node npm install`, but IDEs are not really configured to deal with this. Even my Vim has ALE and would just run node_modules/.bin/tsserver on my machine, which could be anything. Why aren't our tools concerned with this at all?