Hacker News Reader

Comment by ddworken | Hacker News Reader

Though you could have a repository on Github that contains a subdirectory that is a malicious bare Git repo. So doing:

``` git clone github.com/foo/bar cd bar/subdir/ ```

is unsafe with a Git PS1. See https://offensi.com/2019/12/16/4-google-cloud-shell-bugs-exp...

Or create a mercurial repo that contains a .git directory, and rely on finger memory making them run git immediately after cloning...

I’ve done that a few times. I’ve typed “git foo” while mentally thinking about “svn foo”, and after a few hours working on a project that still uses svn I will start making the opposite substitution too.

We use the grunt build tool. More than a handful of times, I've tried to get grunt to do a merge, or git to build the app.

Finger memory, or just a shell configured to run `git status` before every command, as some people have.

And besides a Mercurial repo, it could also be a tarball or zip file…

Quite a dangerous situation.

Looks like git complains of invalid paths when you try that.

Just because the cli won’t add doesn’t mean it may not be possible.

I was able to manually construct a commit with a .git subdirectory using `git mktree` and `git commit-tree`, but Git still refused to create the .git subdirectory in the index or working copy:

  [testrepo]$ git checkout --orphan test-branch
  
  [testrepo]$ git update-ref HEAD f4da9cde406a7b80d99694b5f8d369a8dd6e5a7d
  
  [testrepo]$ git ls-tree -r HEAD
  100644 blob e69de29bb2d1d6434b8b29ae775ad8c2e48c5391    a/.git/config

  [testrepo]$ git show
  commit f4da9cde406a7b80d99694b5f8d369a8dd6e5a7d (HEAD -> test-branch)
  Author: <<redacted>>
  Date:   <<redacted>>

      WIP2

  diff --git a/a/.git/config b/a/.git/config
  new file mode 100644
  index 0000000..e69de29

  [testrepo]$ git status
  On branch test-branch
  Changes to be committed:
    (use "git restore --staged <file>..." to unstage)
          deleted:    a/.git/config

  [testrepo]$ git restore --staged a/.git/config
  error: invalid path 'a/.git/config'
  error: pathspec 'a/.git/config' did not match any file(s) known to git

  [testrepo]$ git reset --hard HEAD
  error: invalid path 'a/.git/config'
  fatal: Could not reset index file to revision 'HEAD'.

So it looks like even if you do try to check out a tree with an unexpected .git subdirectory it won't actually be created in the filesystem.

What do you mean?

Reply on news.ycombinator.com