PSA: Did you know that it’s **unsafe** to put code diffs into your commit messages?

[pq1r@tech.lgbt]

@zekjur classic lack of separation of in-band vs. out-of-band. Very similar to many security vulnerabilities get created, including some of the recent gpg.fail vulnerabilities.

[meph@social.treehouse.systems]

@zekjur weird little footguns

[sowophie@chaos.social]

@zekjur For being a central component of software development, "unified context diff" files are surprisingly fragile.

- Tools are supposed to skip "garbage" lines and apply everything that looks like a diff (this is what's happening here).

- Creating and deleting files is a done via implementation-specific hacks. GNU patch for example cannot create or delete an empty file.

- The format of file names is standardized, but the definition is lacking (see above), so Git does something else.

etc.

[setcab@rollenspiel.social]

@zekjur Why would someone design it like that? What's the possible use case for this behavior?

[randamumaki@mstdn.social]

@zekjur Just fucking stop using github.

[curiousicae@tech.lgbt]

@max
A strong case can be made though that the patch tool garbage erasure must only apply to initial “garbage”, rather than initial and inter-chunk garbage. That’s the aspect that causes the surprise here: VCS diffs only ever place commit metadata (including the message) before the actual patch, but the patch tool allows this metadata (“garbage”) anywhere. At least for git apply that is an obvious bug in and of itself.

Secondly, given this git show should have exported the commit message with one leading space on every line, as that is the escaping mechanism specified by patch for “garbage” data.

Doing both of the above changes would make for a robust mitigation on all levels.
@bmarinov @zekjur @musicmatze

[natanox@chaos.social]

@zekjur @RandamuMaki I do wonder though, does gitlab or forgejo behave differently?

[privateger@plasmatrap.com]

@RandamuMaki@mstdn.social @zekjur@mas.to What? Did you read anything in the post?

[fishidwardrobe@mastodon.me.uk]

@zekjur … with git. other vcs do exist. i know, i know.

[decaturnature@theatl.social]

@zekjur is this a GitHub feature? Or something Debian developers set up? Or something in Git itself?

[foosel@chaos.social]

@zekjur TIL 😳

[jorendorff@federate.social]

@DecaturNature I think this must be a git-am thing. Absolutely wild.

[kumarvibe@mastodon.social]

@zekjur git never ceases to amaze. What a terrible footgun.

[simontatham@hachyderm.io]

@zekjur not the first time: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1081179

But at least in my case it was pretty harmless, and the worst effect was that 'dgit clone' was unexpectedly slow (which is how I spotted it).

[tux0r@layer8.space]

@zekjur Looks like a Git problem.

[tux0r@layer8.space]

@Natanox @zekjur @RandamuMaki Fossil does not do that anyway.

[missqarnstein@eldritch.cafe]

@zekjur in fact i did not know this 💔

[mb21@hachyderm.io]

What?! and how is a patch identified? any line that starts with a minus or plus?

[fallbackerik@mastodon.social]

@zekjur Is it surprising that one would expect such a behavior? A big part of git interaction is about diffs.

[ellie@ellieayla.net]

@zekjur inband signalling will always have this failure mode