PSA: Did you know that it’s **unsafe** to put code diffs into your commit messages?

[setcab@rollenspiel.social]

@zekjur Why would someone design it like that? What's the possible use case for this behavior?

[randamumaki@mstdn.social]

@zekjur Just fucking stop using github.

[curiousicae@tech.lgbt]

@max
A strong case can be made though that the patch tool garbage erasure must only apply to initial “garbage”, rather than initial and inter-chunk garbage. That’s the aspect that causes the surprise here: VCS diffs only ever place commit metadata (including the message) before the actual patch, but the patch tool allows this metadata (“garbage”) anywhere. At least for git apply that is an obvious bug in and of itself.

Secondly, given this git show should have exported the commit message with one leading space on every line, as that is the escaping mechanism specified by patch for “garbage” data.

Doing both of the above changes would make for a robust mitigation on all levels.
@bmarinov @zekjur @musicmatze

[natanox@chaos.social]

@zekjur @RandamuMaki I do wonder though, does gitlab or forgejo behave differently?

[privateger@plasmatrap.com]

@RandamuMaki@mstdn.social @zekjur@mas.to What? Did you read anything in the post?

[fishidwardrobe@mastodon.me.uk]

@zekjur … with git. other vcs do exist. i know, i know.

[decaturnature@theatl.social]

@zekjur is this a GitHub feature? Or something Debian developers set up? Or something in Git itself?

[foosel@chaos.social]

@zekjur TIL 😳

[jorendorff@federate.social]

@DecaturNature I think this must be a git-am thing. Absolutely wild.

[kumarvibe@mastodon.social]

@zekjur git never ceases to amaze. What a terrible footgun.

[simontatham@hachyderm.io]

@zekjur not the first time: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1081179

But at least in my case it was pretty harmless, and the worst effect was that 'dgit clone' was unexpectedly slow (which is how I spotted it).

[tux0r@layer8.space]

@zekjur Looks like a Git problem.

[tux0r@layer8.space]

@Natanox @zekjur @RandamuMaki Fossil does not do that anyway.

[missqarnstein@eldritch.cafe]

@zekjur in fact i did not know this 💔

[mb21@hachyderm.io]

What?! and how is a patch identified? any line that starts with a minus or plus?

[fallbackerik@mastodon.social]

@zekjur Is it surprising that one would expect such a behavior? A big part of git interaction is about diffs.

[ellie@ellieayla.net]

@zekjur inband signalling will always have this failure mode

[brandonscript@appdot.net]

@zekjur That is BONKERS @siracusa

[theonedoc@tech.lgbt]

@zekjur one calls it unsafe others an exploit 🤔

[jorendorff@federate.social]

@DecaturNature to be clear: github doesn't apply patches to your code.* The way `git push` works is not based on patches. That is, as the level of surprise in the original post suggests, not how any of this works.

But `patch` and `git-am` do take arbitrary text input and apply it as a patch, and patches are not a good data format. `patch` for sure can be tricked.

*see next message