PSA: Did you know that it’s **unsafe** to put code diffs into your commit messages?

[decaturnature@theatl.social]

@zekjur is this a GitHub feature? Or something Debian developers set up? Or something in Git itself?

[foosel@chaos.social]

@zekjur TIL 😳

[jorendorff@federate.social]

@DecaturNature I think this must be a git-am thing. Absolutely wild.

[kumarvibe@mastodon.social]

@zekjur git never ceases to amaze. What a terrible footgun.

[simontatham@hachyderm.io]

@zekjur not the first time: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1081179

But at least in my case it was pretty harmless, and the worst effect was that 'dgit clone' was unexpectedly slow (which is how I spotted it).

[tux0r@layer8.space]

@zekjur Looks like a Git problem.

[tux0r@layer8.space]

@Natanox @zekjur @RandamuMaki Fossil does not do that anyway.

[missqarnstein@eldritch.cafe]

@zekjur in fact i did not know this 💔

[mb21@hachyderm.io]

What?! and how is a patch identified? any line that starts with a minus or plus?

[fallbackerik@mastodon.social]

@zekjur Is it surprising that one would expect such a behavior? A big part of git interaction is about diffs.

[ellie@ellieayla.net]

@zekjur inband signalling will always have this failure mode

[brandonscript@appdot.net]

@zekjur That is BONKERS @siracusa

[theonedoc@tech.lgbt]

@zekjur one calls it unsafe others an exploit 🤔

[jorendorff@federate.social]

@DecaturNature to be clear: github doesn't apply patches to your code.* The way `git push` works is not based on patches. That is, as the level of surprise in the original post suggests, not how any of this works.

But `patch` and `git-am` do take arbitrary text input and apply it as a patch, and patches are not a good data format. `patch` for sure can be tricked.

*see next message

[jorendorff@federate.social]

@DecaturNature Exception: github does apply patches in case of rebase/merge, but those are patches specifically generated by diffing trees, never patches provided by users (much less commit messages).

I'm not sure we even do that using any kind of custom code - probably we just use git.

I'm a GitHub employee.

To quibble with the framing of the original: the unsafe behavior is using `patch` to apply patches - good reminder to be super careful doing that. yow

[endlessmason@hachyderm.io]

@TheOneDoc @zekjur
patch is an interpreter that runs as you and can write the file system ...

[theonedoc@tech.lgbt]

@EndlessMason @zekjur

In this space it's safe to assume that everyone knows what patch and diff are.

Just in case I have to explicitly point it out workflows can have exploits not only software. In fact usually the human is the easiest exploit vector.

Edit: That sounded meaner than intended, sorry. Changed.

[natkr@hachyderm.io]

@zekjur Ouch.

[aapis@mastodon.world]

@zekjur this is a solved problem. all my commit messages are simply "updates" 👍

[joeyh@sunbeam.city]

@zekjur patch(1) has an excuse, but git-am should know better. Security bug in it IMHO.