Quantcast
Channel: How easy is it to hide adding a file to a git repository - Information Security Stack Exchange
Viewing all articles
Browse latest Browse all 4

Answer by cjs for How easy is it to hide adding a file to a git repository

$
0
0

...because all commits (diffs) and new files being added to the repository are checked and signed off by the repository 'owner'...

It's important to remember that Git does not store diffs of any kind. Every commit contains a complete set of all the files for that commit. Commands such as git diff and git log -p generate diffs on the fly from the complete files in the commits they are comparing.

...and any new files would show as new to the local version when a status or pull is made.

New files will not show up when you run git status or git pull (or git fetch followed by git rebase, which is the equivalent of git pull). So if you're relying on just that, you won't get any indications that new files have been added; they will just quietly appear in your working copy.

For any commit with only one parent, you can use git log --stat to see the entire list of new and changed files, but it doesn't distinguish between the two, and newly introduced files (or files where it would be suspicious if they are changed) can easily get lost in commits that affect a lot of files. For single-parent commits git log --patch will distinguish new files from changed ones, but there it's even easier to miss new files in a commit that affects a lot of files, or even just a lot of lines in a few files.

Unfortunately, this all breaks down if you have commits with more than one parent, i.e. merge commits, in your repo. git log --patch and even git diff do some suppression of information that people don't normally want to see about a merge, and this includes files newly introduced in merge commits (or at least did so in the past--I myself avoid merge commits now). In particular, I've seen it completely suppressing information about new files added in the "merge" commit itself (i.e., existing in neither parent commit, which doesn't normally happen when doing a merge); in the most egregious example most of the files in the repo (hundreds of them) were somehow added in a merge commit and it took me ages to figure out where they came from. (They definitely did not show up in git log --stat.)

If you are interested in reliably being able to review exactly what is being changed in your repo (including new file additions), my suggestion is that you avoid merge commits or anything else that can result in a commit having more than one parent. Then you can use git log --stat and git log --patch and know you're looking at the exact and complete changes introduced by that commit.


Viewing all articles
Browse latest Browse all 4

Trending Articles