26 lines
951 B
Plaintext
26 lines
951 B
Plaintext
Git v2.7.6 Release Notes
|
|
========================
|
|
|
|
Fixes since v2.7.5
|
|
------------------
|
|
|
|
* A "ssh://..." URL can result in a "ssh" command line with a
|
|
hostname that begins with a dash "-", which would cause the "ssh"
|
|
command to instead (mis)treat it as an option. This is now
|
|
prevented by forbidding such a hostname (which will not be
|
|
necessary in the real world).
|
|
|
|
* Similarly, when GIT_PROXY_COMMAND is configured, the command is
|
|
run with host and port that are parsed out from "ssh://..." URL;
|
|
a poorly written GIT_PROXY_COMMAND could be tricked into treating
|
|
a string that begins with a dash "-". This is now prevented by
|
|
forbidding such a hostname and port number (again, which will not
|
|
be necessary in the real world).
|
|
|
|
* In the same spirit, a repository name that begins with a dash "-"
|
|
is also forbidden now.
|
|
|
|
Credits go to Brian Neel at GitLab, Joern Schneeweisz of Recurity
|
|
Labs and Jeff King at GitHub.
|
|
|