Re: Checks added for CVE-2018-11235 too restrictive?

2018-07-04 Thread Mike Hommey
On Wed, Jul 04, 2018 at 07:30:30AM +0900, Mike Hommey wrote: > That being said, I'm not even sure this particular use case is worth a > new feature. I'm not storing random stuff as gitlinks, I'm storing > sha1s. Well, maybe a mode that makes the distinction between "git oid" > and "external oid"

Re: Checks added for CVE-2018-11235 too restrictive?

2018-07-03 Thread Mike Hommey
On Tue, Jul 03, 2018 at 10:15:19AM -0400, Jeff King wrote: > On Tue, Jul 03, 2018 at 04:06:50PM +0900, Mike Hommey wrote: > > > I had a first shot at that a few months ago, but the format of the > > metadata branch made it impossible to push to github, hitting its push > > size limit. With some

Re: Checks added for CVE-2018-11235 too restrictive?

2018-07-03 Thread Jeff King
On Tue, Jul 03, 2018 at 10:45:51AM -0700, Junio C Hamano wrote: > > I'm open to the idea that the new checks are too restrictive (both this > > and the gitmodulesParse error we're discussing in [1]). They definitely > > outlaw things that _used_ to be OK. And the security benefit is a little > >

Re: Checks added for CVE-2018-11235 too restrictive?

2018-07-03 Thread Junio C Hamano
Jeff King writes: >> A small testcase to reproduce looks like this: >> >> $ git init bar; cd bar >> $ git fast-import <> commit refs/heads/bar >> committer Bar 0 + >> data 0 >> >> M 16

Re: Checks added for CVE-2018-11235 too restrictive?

2018-07-03 Thread Jeff King
On Tue, Jul 03, 2018 at 04:06:50PM +0900, Mike Hommey wrote: > I had a first shot at that a few months ago, but the format of the > metadata branch made it impossible to push to github, hitting its push > size limit. With some pre-processing work, I was able to push the data > to github, with the

Checks added for CVE-2018-11235 too restrictive?

2018-07-03 Thread Mike Hommey
Hi, (Background) I'm the author of a git remote-helper that can talk directly to mercurial servers, known as git-cinnabar. One of the design decisions was to use git objects to store all the metadata necessary to reconstruct mercurial changesets, manifests and files, and one special thing that's