Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Forgejo <=16.0.3 Critical RCE

codeberg.org

Post reply on HN
Print view View original

11–20 of 87 posts

Re: Forgejo <=16.0.3 Critical RCE

#11

Post by hephaes7us »

jzebedee wrote: post #4

Relevant change: Security bug fixes PR: Critical: fix: prevent template expansion from interfering with git repo initialization. When generating a new repository from a template repository, Forgejo clones the template repository, removes the .git folder, performs variable template expansion on files listed in .forgejo/template, and initializes a new git repository. During this process, variable template expansion cou…

It looks like this is a bit less concerning if you have turned off open account registration.

Re: Forgejo <=16.0.3 Critical RCE

#13

Post by titularcomment »

keel-control wrote: post #12

This was my first thought after they disallowed LLM contributions. They may not use AI to check for vulnerabilities but attackers are going to which puts themselves at the disadvantage.

I really disagree with their acceptable usage policy, but you can't say it with certainity that LLM contributions would be a fix for this. They generate so much noise (as the primary incentive behind an independent LLM scan is often cheap contributor brownie points for your CV) that it also could lead to bogus PRs being approved or helpful PRs being lost in the noise.

Re: Forgejo <=16.0.3 Critical RCE

#14

Post by otherme123 »

keel-control wrote: post #12

This was my first thought after they disallowed LLM contributions. They may not use AI to check for vulnerabilities but attackers are going to which puts themselves at the disadvantage.

Was this discovered by AI? Is all AI code 100% free of bugs?

You are implying that just by allowing LLM contributions your product is free of bugs, and the LLM won't introduce new bugs. Of course, if the LLM introduces bugs, the solution is to add another layer of LLM looking for bugs, ad infinitum.

Another post from today from Shopify, praising LLM to code their frontend, also stated that their LLM generated code is not ready to deploy, and needs to be reviewed:

> It’s tempting to just point an LLM to the React Native codebase and try to one-shot the same features in native, but it doesn’t work. Even if you ask it to gather as much information as it can up front, freeze that into specs, task files, and then implement it, you end up with a huge amount of unmaintainable code that can’t be shipped. [...] each [build] must prove its behavior with tests, match the running app in a visual review, survive two adversarial code reviewers, and get a human's nod before it's committed and the next one starts.

Re: Forgejo <=16.0.3 Critical RCE

#16

Post by striking »

keel-control wrote: post #12

This was my first thought after they disallowed LLM contributions. They may not use AI to check for vulnerabilities but attackers are going to which puts themselves at the disadvantage.

Disallowing LLM contributions doesn't disqualify the use of LLMs to identify vulnerabilities.

Re: Forgejo <=16.0.3 Critical RCE

#17

Post by 1matin »

otherme123 wrote: post #14
keel-control wrote: post #12

This was my first thought after they disallowed LLM contributions. They may not use AI to check for vulnerabilities but attackers are going to which puts themselves at the disadvantage.

Was this discovered by AI? Is all AI code 100% free of bugs? You are implying that just by allowing LLM contributions your product is free of bugs, and the LLM won't introduce new bugs. Of course, if the LLM introduces bugs, the solution is to add another layer of LLM looking for bugs, ad infinitum. Another post from today from Shopify, praising LLM to code their frontend, also stated that their LLM generated code is…

> They may not use AI to *check for vulnerabilities*

you didn't read the comment, did you?

Re: Forgejo <=16.0.3 Critical RCE

#18

Post by techknowlogick »

Only posting here because I've been asked about it. Gitea is protected against both of these issues.

(bias note: part of project leadership of Gitea)

Edit: As a note, security incidents happen to everyone and we shouldn't shame anyone for reporting them, especially as that'd otherwise cause less issues to be reported overall.

Re: Forgejo <=16.0.3 Critical RCE

#19

Post by tredre3 »

techknowlogick wrote: post #18

Only posting here because I've been asked about it. Gitea is protected against both of these issues. (bias note: part of project leadership of Gitea) Edit: As a note, security incidents happen to everyone and we shouldn't shame anyone for reporting them, especially as that'd otherwise cause less issues to be reported overall.

> Gitea is protected against both of these issues.

Is Gitea's immunity just incidental because it was written by a different person, or is it due to a deliberate defensive system that prevents such bug/mistake from occurring?

Re: Forgejo <=16.0.3 Critical RCE

#20

Post by bdcravens »

keel-control wrote: post #12

This was my first thought after they disallowed LLM contributions. They may not use AI to check for vulnerabilities but attackers are going to which puts themselves at the disadvantage.

Why can't you use an LLM to find vulnerabilities and then hand-code the fix? You don't even have to clean-room implement it; let the LLM write the code, and then reimplement, doing what you can to de-LLM-ify it.
Post reply on HN