Git 2.7.6
Signed-off-by: Junio C Hamano <gitster@pobox.com>
Junio C Hamano committed
Jul 30, 2017 at 14:45 UTC
5e0649dc65fe33e8cf38823350e9d7951f6a6346
3 files changed
+27
-2
Documentation/RelNotes/2.7.6.txt
new
+25
@@ -0,0 +1,25 @@
1
+Git v2.7.6 Release Notes
2
+========================
3
+
4
+Fixes since v2.7.5
5
+------------------
6
+
7
+ * A "ssh://..." URL can result in a "ssh" command line with a
8
+ hostname that begins with a dash "-", which would cause the "ssh"
9
+ command to instead (mis)treat it as an option. This is now
10
+ prevented by forbidding such a hostname (which will not be
11
+ necessary in the real world).
12
+
13
+ * Similarly, when GIT_PROXY_COMMAND is configured, the command is
14
+ run with host and port that are parsed out from "ssh://..." URL;
15
+ a poorly written GIT_PROXY_COMMAND could be tricked into treating
16
+ a string that begins with a dash "-". This is now prevented by
17
+ forbidding such a hostname and port number (again, which will not
18
+ be necessary in the real world).
19
+
20
+ * In the same spirit, a repository name that begins with a dash "-"
21
+ is also forbidden now.
22
+
23
+Credits go to Brian Neel at GitLab, Joern Schneeweisz of Recurity
24
+Labs and Jeff King at GitHub.
25
+
GIT-VERSION-GEN
+1
-1
@@ -1,7 +1,7 @@
1
#!/bin/sh
2
3
GVF=GIT-VERSION-FILE
4
-DEF_VER=v2.7.5
4
+DEF_VER=v2.7.6
5
6
LF='
7
'
RelNotes
+1
-1
@@ -1 +1 @@
1
-Documentation/RelNotes/2.7.5.txt
\ No newline at end of file
1
+Documentation/RelNotes/2.7.6.txt
\ No newline at end of file