Fix an issue where "git" may be unable to read a temporary file in Diffusion
ClosedPublic
Actions

Authored by epriestley on Apr 20 2022, 4:31 PM.

Details

Reviewers: None
Maniphest Tasks: T13673: CVE-2022-24765 - Multi-user Git Privilege Escalation
Commits: rP52df4ff515b7: Fix an issue where "git" may be unable to read a temporary file in Diffusion

Summary

Ref T13673. After the changes in that task, we may execute "git config -l ..." as a user other than the user we used to write this temporary file.

Use "--file -" to pass the data instead, avoiding use of temporary files. This makes us agnostic to filesystem permissions.

Test Plan

Viewed a Git repository with submodules in Diffusion with "ssh.user" configured as a user relatively isolated from the webserver user.

Repository

rP Phabricator

Branch

sub1

Lint

Lint Passed

Unit

Tests Passed

Build Status

Buildable 25644
Build 35472: arc lint + arc unit

epriestley requested review of this revision.Apr 20 2022, 4:31 PM

epriestley created this revision.

This revision was not accepted when it landed; it landed in state Needs Review.Apr 20 2022, 8:04 PM

This revision was automatically updated to reflect the committed changes.

Path

Size

src/

applications/

diffusion/

conduit/

18 lines