See: http://rachelbythebay.com/w/2018/04/05/bangpatch/
I have meetings in SF for the rest of the day and haven't evaluated this, but it looks like some real sketchy garbage that we should probably be killing dead in, e.g., arc patch and raw diff export.
| Status | Assigned | Task | ||
|---|---|---|---|---|
| Open | None | T12664 Update diff/patch parsing to extract more metadata and parse a wider range of formats | ||
| Open | epriestley | T13117 `patch` just runs any command? |
A related attack is a bare whatever.patch file which writes to .git/config or .hg/hgconfig or whatever.