439
700+ self-hosted Git instances battered in 0-day attacks with no fix imminent (www.theregister.com)
submitted 11 months ago by to c/selfhosted@lemmy.world
86 comments fedilink hide all child comments
 

By 'Git instances' they mean Gogs instances that allow open registration. I know most of the community moved from Gogs to Gitea, and then to Forgejo, but thought this was still worth noting.

you are viewing a single comment's thread
view the rest of the comments
[–] 27 points 11 months ago (5 children)

Especially since any version of Git from the last view years has a passionate hatred of symlinks for this reason, which is a bit annoying if you've a legit usecase. They're either very out-of-date, or have done some very foolish customisation...

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 5 child comments
    •
  • [–] 2 points 11 months ago (4 children)

    I think the ZIP standard has something similar and it causes similar problems.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 4 child comments
    •
  • [–] 8 points 11 months ago (3 children)

    It's because of the old notion of "be generous in what you accept and strict in what you send". I think the error is something about adding more parent directories so that part of your zip file will be extracted above the selected directory. Not all implementations of zip support this "feature".

    There are also all kinds of stupid ancient features in tar and zip from a time when hard drives were measured in megabytes or less. The latest episode of the open source security podcast talks about it.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 3 child comments
    •
  • [–] 3 points 11 months ago (2 children)

    We also have COW filesystems now. If you need large datasets in different places, used by different projects, etc, just copy them and use BTRFS or ZFS or whatever. It wont take any space and be safer. Git also has multiple ways of connecting external data artifacts. Git should by default reject symlinks.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 2 child comments
    •
  • [–] 3 points 11 months ago

    Git itself (Or any other VCS for that matter) really should treat symlinks as special, similar as to how btrfs stores everything as "reflinks" internally. They be stored as special references to other tracked objects (so it'd be impossible to commit a symlink that pointed at anything other than a checked-in file, and ensure they always match), and git can materialise them as needed.

  • permalink
  • fedilink
  • source
  • parent