@matheusbsbs / matheus-bagliano / commits / 75631a3cd8

Revert "core.hooksPath: add some protection while cloning"

This defense-in-depth was intended to protect the clone operation against future escalations where bugs in `git clone` would allow attackers to write arbitrary files in the `.git/` directory would allow for Remote Code Execution attacks via maliciously-placed hooks. However, it turns out that the `core.hooksPath` protection has unintentional side effects so severe that they do not justify the benefit of the protections. For example, it has been reported in https://lore.kernel.org/git/FAFA34CB-9732-4A0A-87FB-BDB272E6AEE8@alchemists.io/ that the following invocation, which is intended to make `git clone` safer, is itself broken by that protective measure: git clone --config core.hooksPath=/dev/null <url> Since it turns out that the benefit does not justify the cost, let's revert 20f3588efc6 (core.hooksPath: add some protection while cloning, 2024-03-30). Signed-off-by: Johannes Schindelin <johannes.schindelin@gmx.de> Signed-off-by: Junio C Hamano <gitster@pobox.com>

Johannes Schindelin committed May 20, 2024 at 20:22 UTC 75631a3cd84887657c634a35d1095f4a0884e48a

2 files changed +1 -27

config.c

+1 -12

@@ -1525,19 +1525,8 @@ static int git_default_core_config(const char *var, const char *value, void *cb)

1525 if (!strcmp(var, "core.attributesfile"))

1526 return git_config_pathname(&git_attributes_file, var, value);

1527

1528 - if (!strcmp(var, "core.hookspath")) {

1529 - if (current_config_scope() == CONFIG_SCOPE_LOCAL &&

1530 - git_env_bool("GIT_CLONE_PROTECTION_ACTIVE", 0))

1531 - die(_("active `core.hooksPath` found in the local "

1532 - "repository config:\n\t%s\nFor security "

1533 - "reasons, this is disallowed by default.\nIf "

1534 - "this is intentional and the hook should "

1535 - "actually be run, please\nrun the command "

1536 - "again with "

1537 - "`GIT_CLONE_PROTECTION_ACTIVE=false`"),

1538 - value);

1528 + if (!strcmp(var, "core.hookspath"))

1529 return git_config_pathname(&git_hooks_path, var, value);

1540 - }

1530

1531 if (!strcmp(var, "core.bare")) {

1532 is_bare_repository_cfg = git_config_bool(var, value);

t/t1800-hook.sh

-15

@@ -177,19 +177,4 @@ test_expect_success 'git hook run a hook with a bad shebang' '

177 test_cmp expect actual

178 '

179

180 -test_expect_success 'clone protections' '

181 - test_config core.hooksPath "$(pwd)/my-hooks" &&

182 - mkdir -p my-hooks &&

183 - write_script my-hooks/test-hook <<-\EOF &&

184 - echo Hook ran $1

185 - EOF

186 -

187 - git hook run test-hook 2>err &&

188 - grep "Hook ran" err &&

189 - test_must_fail env GIT_CLONE_PROTECTION_ACTIVE=true \

190 - git hook run test-hook 2>err &&

191 - grep "active .core.hooksPath" err &&

192 - ! grep "Hook ran" err

193 -'

194 -

180 test_done