PSA: Did you know that it’s **unsafe** to put code diffs into your commit messages?

[fallbackerik@mastodon.social]

@zekjur Is it surprising that one would expect such a behavior? A big part of git interaction is about diffs.

[ellie@ellieayla.net]

@zekjur inband signalling will always have this failure mode

[brandonscript@appdot.net]

@zekjur That is BONKERS @siracusa

[theonedoc@tech.lgbt]

@zekjur one calls it unsafe others an exploit 🤔

[jorendorff@federate.social]

@DecaturNature to be clear: github doesn't apply patches to your code.* The way `git push` works is not based on patches. That is, as the level of surprise in the original post suggests, not how any of this works.

But `patch` and `git-am` do take arbitrary text input and apply it as a patch, and patches are not a good data format. `patch` for sure can be tricked.

*see next message

[jorendorff@federate.social]

@DecaturNature Exception: github does apply patches in case of rebase/merge, but those are patches specifically generated by diffing trees, never patches provided by users (much less commit messages).

I'm not sure we even do that using any kind of custom code - probably we just use git.

I'm a GitHub employee.

To quibble with the framing of the original: the unsafe behavior is using `patch` to apply patches - good reminder to be super careful doing that. yow

[endlessmason@hachyderm.io]

@TheOneDoc @zekjur
patch is an interpreter that runs as you and can write the file system ...

[theonedoc@tech.lgbt]

@EndlessMason @zekjur

In this space it's safe to assume that everyone knows what patch and diff are.

Just in case I have to explicitly point it out workflows can have exploits not only software. In fact usually the human is the easiest exploit vector.

Edit: That sounded meaner than intended, sorry. Changed.

[natkr@hachyderm.io]

@zekjur Ouch.

[aapis@mastodon.world]

@zekjur this is a solved problem. all my commit messages are simply "updates" 👍

[joeyh@sunbeam.city]

@zekjur patch(1) has an excuse, but git-am should know better. Security bug in it IMHO.

[li@tech.lgbt]

@zekjur @tauon ffffff this feels like some sort of injection and like it shouldnt work like this

[paul@soylent.green]

@zekjur love me a good combined data and control channel, never once seen that backfire

+++ATH

[swags@social.treehouse.systems]

@zekjur Would this not be considered a git bug? It is not escaping the patch bit of the commit message properly, right?

[ferrix@mastodon.online]

@zekjur @gsuberland that... does not seem like a safe design