I recently discovered that I had been serving .git on my blog for a couple of years. All it took to fix was a simple rule in my Nginx config: # Don't expose hidden files to the web location ~ /\. { return 404; }
deny all; works too
Please stop serving .git to the outside world
11–20 of 91 posts
Re: Please stop serving .git to the outside world
#12I think there's nothing wrong with this if there aren't (and weren't) any secrets directly embedded in the source code and all configuration files that contain sensitive information are (and always were) properly gitignore'd. Tech-savvy users can even be encouraged to pull the code and send patches. :)
Somebody correct me if I'm wrong here, but doesn't the .git directory essentially contain the entire history of the repository? The history could easily contain sensitive information like passwords. It will contain names email addresses of contributors, too. Try it yourself: cat .git/logs/HEAD
Why would it contain passwords?
Re: Please stop serving .git to the outside world
#13Earlier quoted context omitted.
Somebody correct me if I'm wrong here, but doesn't the .git directory essentially contain the entire history of the repository? The history could easily contain sensitive information like passwords. It will contain names email addresses of contributors, too. Try it yourself: cat .git/logs/HEAD
Why would it contain passwords?
The history could. If you ever stored passwords in Git, even if you have now removed them, they would still be in the history.
Re: Please stop serving .git to the outside world
#14Earlier quoted context omitted.
Somebody correct me if I'm wrong here, but doesn't the .git directory essentially contain the entire history of the repository? The history could easily contain sensitive information like passwords. It will contain names email addresses of contributors, too. Try it yourself: cat .git/logs/HEAD
Why would it contain passwords?
Naive users have left passwords in by mistake, only to make another mistake in thinking a commit takes care of it.
Re: Please stop serving .git to the outside world
#15Earlier quoted context omitted.
Somebody correct me if I'm wrong here, but doesn't the .git directory essentially contain the entire history of the repository? The history could easily contain sensitive information like passwords. It will contain names email addresses of contributors, too. Try it yourself: cat .git/logs/HEAD
Why would it contain passwords?
Well, it could contain OAuth tokens for external services (eg Twitter), as well as secret tokens (used in Rails, Django for cookies).
Worse still, they could be using passwords in an external service (eg, for a database) and have included those as well.
Re: Please stop serving .git to the outside world
#16Earlier quoted context omitted.
Somebody correct me if I'm wrong here, but doesn't the .git directory essentially contain the entire history of the repository? The history could easily contain sensitive information like passwords. It will contain names email addresses of contributors, too. Try it yourself: cat .git/logs/HEAD
Why would it contain passwords?
//TODO replace password and username with user input
password = "johnsmithAdminpass1234"
username = "johnsmith01"
login(username, password)
Edit: formatting
Re: Please stop serving .git to the outside world
#17.git should never be in your web root... I can't think of any situation (other than a very simple site) where you'd want to just stick the whole Git repository in the web root. Normally there's a bunch of other things in the repository (documentation, database scripts, etc.) that you wouldn't want exposed publicly.
Re: Please stop serving .git to the outside world
#18I make it a habit to put all my public files in directory such as www/, where as .git and other non public but site-related files/directories are contained above this.
IMO this is the correct approach - Exposing every single file in the repository (including files that don't need to be public) sounds terrible.
Re: Please stop serving .git to the outside world
#19Earlier quoted context omitted.
Somebody correct me if I'm wrong here, but doesn't the .git directory essentially contain the entire history of the repository? The history could easily contain sensitive information like passwords. It will contain names email addresses of contributors, too. Try it yourself: cat .git/logs/HEAD
Why would it contain passwords?
Some people are naïve. All people make mistakes. And many people are naïve about whether they make mistakes.
Re: Please stop serving .git to the outside world
#20devs aren't always the ones deploying the sites they develop! Also, non-standard file extensions for source code is often exposed and should probably be hidden. (e.g. .module for drupal sites).