• Show log

    Commit

  • Hash : b93e82d4
    Author : Carlos Martín Nieto
    Date : 2018-10-05T11:47:39

    submodule: ignore path and url attributes if they look like options
    
    These can be used to inject options in an implementation which performs a
    recursive clone by executing an external command via crafted url and path
    attributes such that it triggers a local executable to be run.
    
    The library is not vulnerable as we do not rely on external executables but a
    user of the library might be relying on that so we add this protection.
    
    This matches this aspect of git's fix for CVE-2018-17456.