Subject: Re: [PATCH] Allow aliases to expand to shell commands

From: "Shawn O. Pearce" <[email-masked]>
Date: Mon, 12 Feb 2007 01:53:19 -0500

Theodore Tso <[email-masked]> wrote:
> On Sun, Feb 11, 2007 at 01:44:25PM -0800, Junio C Hamano wrote:
> > Theodore Tso <[email-masked]> writes:
> > 
> > > ..., I think we're
> > > still safe, since aliases can't override commands.  
> > 
> > I feel a bit uneasy to hear safety argument based on that
> > current restriction, since we might want to loosen it later.
> 
> Loosen which restriction?
> 
> 1) The ability for aliases to shadow existing git commands?

This one.

> 2) The ability for untrusted users to make arbitrary changes to the 
>       config file?
> 3) The ability for untrusted users to execute arbitrary git commands via 
>       git-shell?
> 
> You hjave to loosen at least 2 of the 3 current restrictions before
> the ability to execute shell commands out of aliases becomes a problem
> --- and I would argue that either (2) or (3) are things that we would
> be insane to loosen at least to the point of allowing untrusted users
> to make arbitrary changes to the config or execute arbitrary git
> commands, since even today, they could do a huge amount of damage
> already.

I agree, 2 and 3 are the real issue here, not 1.  1 is only an
issue for scripts which expect the plumbing to behave a certain
way, but doesn't, as the user has aliased the plumbing command.

-- 
Shawn.