Re: [PATCH 1/5] Library code for user-relative paths, take three.

Andreas Ericsson wrote:

H. Peter Anvin wrote:

quoted

The whole point with --strict is that it shouldn't DWIM.  DWIMming is 
*NOT* safe if the data has previously passed through a security screen.

But it hasn't at this point. The security scan is done afterwards, when 
the canonical path is compared against the whitelist which, in strict 
mode, only matches if it matches exactly.

But anyways, how about doing

    enter_repo(path, 2)

from the daemon to make enter_repo() do the chdir(".git")?

... while preventing the later call from git-upload-pack from doing so.

-- 
Andreas Ericsson                   andreas.ericsson@op5.se
OP5 AB                             www.op5.se
Tel: +46 8-230225                  Fax: +46 8-230231