undefined | Better HN

0 pointshsbauauvhabzb3y ago0 comments

Can you do this to a GitHub hosted repo?

0 comments

oauea3y ago

No, the .git directory is not cloned. But if the repo is already on disk it can be game over.

Though you could have a repository on Github that contains a subdirectory that is a malicious bare Git repo. So doing:

``` git clone github.com/foo/bar cd bar/subdir/ ```

Or create a mercurial repo that contains a .git directory, and rely on finger memory making them run git immediately after cloning...

Looks like git complains of invalid paths when you try that.

j / k navigate · click thread line to collapse

oauea3y ago

No, the .git directory is not cloned. But if the repo is already on disk it can be game over.

Though you could have a repository on Github that contains a subdirectory that is a malicious bare Git repo. So doing:

``` git clone github.com/foo/bar cd bar/subdir/ ```

Or create a mercurial repo that contains a .git directory, and rely on finger memory making them run git immediately after cloning...

Looks like git complains of invalid paths when you try that.

j / k navigate · click thread line to collapse