diff options
| author | Carlos MartÃn Nieto <cmn@dwim.me> | 2018-10-05 11:47:39 +0200 |
|---|---|---|
| committer | Patrick Steinhardt <ps@pks.im> | 2018-10-05 19:50:18 +0200 |
| commit | c8ca3caef68f31d553c131b471223ff934bb3cff (patch) | |
| tree | 5f3324fef07f69ee286dfb33818e9d2591e670cd /src/commit.c | |
| parent | 4e0bdaa877336efc9d42fe7c2a57d4cfe60e66a2 (diff) | |
| download | libgit2-c8ca3caef68f31d553c131b471223ff934bb3cff.tar.gz | |
submodule: ignore path and url attributes if they look like options
These can be used to inject options in an implementation which performs a
recursive clone by executing an external command via crafted url and path
attributes such that it triggers a local executable to be run.
The library is not vulnerable as we do not rely on external executables but a
user of the library might be relying on that so we add this protection.
This matches this aspect of git's fix for CVE-2018-17456.
Diffstat (limited to 'src/commit.c')
0 files changed, 0 insertions, 0 deletions