Page MenuHomePhabricator

Document the security reasons for mounting .git as read-only
Open, LowPublic

Description

Imported from GitHub issue wikimedia/fresh#6.


Original task written on 16 Sep 2019 by @Krinkle:

Escalation of rights by having an npm script add a shell script to .git/hooks which survives the container and would not should up in "git status" and would execute on the host machine (outside the container) on future git commands like git commit or git pull.

Event Timeline

Krinkle triaged this task as Medium priority.Aug 8 2020, 3:03 PM

In addition to writing to .git/hooks, you could also add malicious commits to a git repository that doesn't go through code review.

Krinkle lowered the priority of this task from Medium to Low.Sep 19 2022, 5:55 PM
Krinkle added a project: good first task.