diff options
| author | Johannes Schindelin <johannes.schindelin@gmx.de> | 2024-04-10 18:01:13 +0200 |
|---|---|---|
| committer | Johannes Schindelin <johannes.schindelin@gmx.de> | 2024-04-19 12:38:25 +0200 |
| commit | a33fea0886cfa016d313d2bd66bdd08615bffbc9 (patch) | |
| tree | b8c29bc2c4fdf4a1bcf34a1acdde2e429168724c /builtin/commit.c | |
| parent | 20f3588efc6cbcae5bbaabf65ee12df87b51a9ea (diff) | |
fsck: warn about symlink pointing inside a gitdir
In the wake of fixing a vulnerability where `git clone` mistakenly
followed a symbolic link that it had just written while checking out
files, writing into a gitdir, let's add some defense-in-depth by
teaching `git fsck` to report symbolic links stored in its trees that
point inside `.git/`.
Even though the Git project never made any promises about the exact
shape of the `.git/` directory's contents, there are likely repositories
out there containing symbolic links that point inside the gitdir. For
that reason, let's only report these as warnings, not as errors.
Security-conscious users are encouraged to configure
`fsck.symlinkPointsToGitDir = error`.
Signed-off-by: Johannes Schindelin <johannes.schindelin@gmx.de>
Diffstat (limited to 'builtin/commit.c')
0 files changed, 0 insertions, 0 deletions