Re: [PATCH 0/1] pack-bitmap.c: avoid exposing absolute paths

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

 



On Fri, Aug 26 2022, Teng Long wrote:

> This patch tries to avoid the problem of leaking sensitive information that
> could output the absolute path of the repository when try to open multiple
> bitmaps. For example, in "alternates" scenario, where the repository
> "alternate_repo" serves as alternate object stores for repository
> "want_to_borrow" , and each of both has it's own bitmap file, then we run
> `git rev-list --use-bitmap-index HEAD`, the output might be:
>
>   $ cd want_to_borrow.git
>   $ git rev-list --test-bitmap HEAD
>   warning: ignoring extra bitmap file: /Users/tenglong.tl/Downloads/alternate_repo.git/.git/objects/pack/pack-bff67e2a7a154e6933afe61b3681726cf9bd8e8b.pack
>   Bitmap v1 test (1 entries loaded)
>   Found bitmap for 30f146d41a7a86930fae3f4a5e1f1c1f2bfacbba. 64 bits / 11030517 checksum
>   Verifying bitmap entries: 100% (3/3), done.
>   OK!
>
> After apply this patch:
>
>   $ git rev-list --test-bitmap HEAD
>   warning: ignoring extra bitmap files
>   Bitmap v1 test (1 entries loaded)
>   Found bitmap for 30f146d41a7a86930fae3f4a5e1f1c1f2bfacbba. 64 bits / 11030517 checksum
>   Verifying bitmap entries: 100% (3/3), done.
>   OK!

I see that downthread of here there's discussion about keeping the
warning, adding tracing, etc. etc.

Maybe it's been brought up (I was skimming, sorry), but for the problem
you have isn't a narrow and acceptable solution to you to keep the
warning, but just don't print the absolute path?

I.e.:

	warning: ignoring extra bitmap file: /Users/tenglong.tl/Downloads/alternate_repo.git/.git/objects/pack/pack-bff67e2a7a154e6933afe61b3681726cf9bd8e8b.pack

To:

	warning: ignoring extra bitmap file: ../alternate_repo.git/.git/objects/pack/pack-bff67e2a7a154e6933afe61b3681726cf9bd8e8b.pack

Or would the relative path to the alternate also be sensitive?

We might also want to just remove this etc., but that's a different
question than "should we print these absolute paths?".



[Index of Archives]     [Linux Kernel Development]     [Gcc Help]     [IETF Annouce]     [DCCP]     [Netdev]     [Networking]     [Security]     [V4L]     [Bugtraq]     [Yosemite]     [MIPS Linux]     [ARM Linux]     [Linux Security]     [Linux RAID]     [Linux SCSI]     [Fedora Users]

  Powered by Linux