Messages in this thread | | | From | Andreas Gruenbacher <> | Subject | Re: patch-2.7.3 no longer applies relative symbolic link patches | Date | Tue, 27 Jan 2015 15:47:04 +0000 (UTC) |
| |
On Mon, 26 Jan 2015 13:50:10 -0800, Linus Torvalds wrote:
> On Mon, Jan 26, 2015 at 1:35 PM, Junio C Hamano <gitster@pobox.com> > wrote: >> >> What is your take on CVE-2015-1196, which brought this /regression/ to >> GNU patch? >> If "git apply" get /fixed/ for that same CVE, would that /break/ your >> fix? > > I _think_ we allow arbitrary symlinks to be created, but then we should > be careful about actually _following_ them.
I would prefer to allow arbitrary symlinks even in GNU patch, but patch still must not be allowed to leave the working directory. The only way to achieve that I can think of is to implement path traversal in user space, which is not so easy to do correctly and efficiently.
I think file system modifications from "outside" are not much of a concern.
Andreas
| |