diff options
| author | Johannes Schindelin <johannes.schindelin@gmx.de> | 2019-10-03 20:44:34 +0200 |
|---|---|---|
| committer | Johannes Schindelin <johannes.schindelin@gmx.de> | 2019-12-04 13:23:22 +0100 |
| commit | a7b1ad3b05fd1dc03c3de12ea4f2d8118ad24e2c (patch) | |
| tree | 9603df337bf43eec5d4998d44f5c3293661950d2 /builtin/commit.c | |
| parent | d0832b2847aa9669c09397c5639d7fe56abaf9fc (diff) | |
| parent | a52ed76142f6e8d993bb4c50938a408966eb2b7c (diff) | |
Merge branch 'jk/fast-import-unsafe'
The `--export-marks` option of `git fast-import` is exposed also via the
in-stream command `feature export-marks=...` and it allows overwriting
arbitrary paths.
This topic branch prevents the in-stream version, to prevent arbitrary
file accesses by `git fast-import` streams coming from untrusted sources
(e.g. in remote helpers that are based on `git fast-import`).
This fixes CVE-2019-1348.
Signed-off-by: Johannes Schindelin <johannes.schindelin@gmx.de>
Diffstat (limited to 'builtin/commit.c')
0 files changed, 0 insertions, 0 deletions