On Thu, Oct 20, 2011 at 08:14:56PM +1100, Nguyen Thai Ngoc Duy wrote: > > But you cannot hide from "cat-file commit" ;-) > > > > With the recent push to more (perceived) security, it may probably make > > sense to teach "log" family commands to quote-show ^@ and what is behind > > in their output by default, perhaps with an option to turn it off. > > What about NUL in file name in tree objects? Suppose the original tree > has an entry named "goodthing". With luck, they might be able to > create a new tree object with the entry renamed to "evil\x001234" that > has the same SHA-1. Could that possibly cause any problems? NUL is already meaningful in a tree object; it is the end of the filename. So after the NUL, we will consider the next 20 bytes to be sha1, and then after that, the mode of the next file entry. -Peff -- To unsubscribe from this list: send the line "unsubscribe git" in the body of a message to majordomo@xxxxxxxxxxxxxxx More majordomo info at http://vger.kernel.org/majordomo-info.html