On 28/10/16 09:55, Jeff King wrote: > On Fri, Oct 28, 2016 at 09:28:23AM +1300, Aaron Pelly wrote: > >>> - we parse possibly-hostile .gitignore files from cloned repositories. >>> What happens when I include ask to include /etc/passwd? Probably >>> nothing, but there are setups where it might matter (e.g., something >>> like Travis that auto-builds untrusted repositories, and you could >>> potentially leak the contents of files via error messages). It's >>> nice to avoid the issue entirely. >> >> I understand the issue. >> >> It's not obvious to me how using a .d solves this problem though. > > It doesn't by itself. But we are worried only about tracked .gitignore > files (recall that even repo-level files in $GIT_DIR/info are generated > fresh by the clone process, and don't come from the remote). If we apply > the feature only to core.excludeFile and $GIT_DIR/info/exclude, those > are already under the user's control. The things you say make sense from this perspective. I was hoping to employ this mechanism throughout the git ecosystem. Thinking out loud for a minute: 1) I clone a repo with a hostile ignore file. It includes files from /etc/ssl/private or some such. Change. Don't pay attention. Commit. Push. Problems. What is the use case for reaching out of the repo in the first place? 2) I fetch a repo with a hostile ignore file. It includes files from $GIT_DIR/test-data/ssl/private or some such. Change. Don't pay attention. Commit. Push. Problems if my test data comes from production. Is this mitigated currently? Not that git should be an enabler, but surely it falls on the user of untrusted software to ensure their own security? > It's true that we could make a similar exception for an "include" > feature, and respect include directives only in those "safe" files. > Somehow that seems more confusing to me, though, than doing adding the > feature at the file level, as it introduces slightly varying syntax > between the locations. I'm quickly getting over the include file idea. But yes, that would be non obvious. >>> Whereas letting any of the user- or repo-level exclude files be a >>> directory, and simply reading all of the files inside, seems simple and >>> obvious. >> >> Apart from backwards compatibility, unless there's something I'm missing. > > I'm not sure what you mean. If we make: > > mkdir .git/info/exclude > echo whatever >.git/info/exclude/local > > work, I don't think we have to care about backwards compatibility. That > was nonsensical before, and never did anything useful (so somebody might > have done it, but we can assume anybody relying on it not to read the > contents is crazy). Seeing your perspective, now, I can see why you didn't understand me. In your context this makes perfect sense.