Git-Mirrors/qusal
1
0
Fork 0
mirror of https://github.com/ben-grande/qusal.git synced 2025-05-02 14:26:21 -04:00
Code Issues Projects Releases Packages Wiki Activity

doc: how to update the repository

Browse source 
As it is not easy to get files to dom0 and we don't want to reimplement
a package manager, crude Git is the solution as of know.

With Git we have the following advantages: native fetch format for
source controlled files, cleaner command-line, automatic signature
verification during merge, the disadvantage is that it is not included
by default in Dom0 and filtering it's stdout chars are not possible.
Note that the remote can report messages to the client via stderr, which
is filtered already, and if it tries to send an escape sequence to
stdout, the operation will fail with 'bad line length character: CHAR'
printed to stderr on the client, unfiltered by qrexec, but filtered to
some extent by the git client. If it is an escape character, the char is
transformed to "?", but UTF-8 multibyte characters are not filtered. Up
to 4 bytes can be displayed.

Tar on the other hand is already installed, but it is much ancient and
it's file parsing caused CVEs in the past relatively more drastic than
Git, it also doesn't only include committed files, it can include any
file that is present in the directory, which by far, increases a lot of
the attack surface unless you reset the state to HEAD, clean .git
directory manually and there are possibly other avenues of attack.
This commit is contained in:
Ben Grande 2024-01-18 15:22:35 +01:00
parent 9b740d8314
commit f8ea066b2b
2 changed files with 79 additions and 18 deletions
Download patch file Download diff file Expand all files Collapse all files

27
salt/sys-git/README.md
View file

@ -40,13 +40,36 @@ implementation:
| Fetch | True | True | True (only tags) | True |
| Push | True | True | False | True |
| Init | True | False | False | False |
| Validates Git communication | False | False | True | False |
| Validates git communication | False | False | True | False |
| Verifies tag signature | False | False | True | False |
## Security
It is not possible to filter Git's stdout from a Qrexec call as it is used by
the local running git process.
the local running git process, we rely on Git's parsing and filtering for
remote operations. A remote can send up to 4 bytes of UTF-8 character to it's
stdout as packet information during the initial server client negotiation, the
client will display the characters on stderr with an error message containing
the character. Git only filters for control characters but other characters
that are valid UTF-8 such as multibyte are not filtered. The same characters
can be present in the git log.
A remote helper that validates the data received can increase the security
by not printing untrusted data, which is the case with
[qubes-app-split-git](https://github.com/QubesOS-contrib/qubes-app-split-git/commits/master/),
but unfortunately it demands signed tags and doesn't work for normal git
operations with signed commits and branches, as the later can't be signed.
A fork of the aforementioned project might be the future of this helper.
Even if the transport is secure, the tool that renders the information of your
recently acquired repository
[can](https://nvd.nist.gov/vuln/detail/CVE-2022-23521)
[contain](https://nvd.nist.gov/vuln/detail/CVE-2022-41902)
[bugs](https://nvd.nist.gov/vuln/detail/CVE-2022-46663)
[that](https://nvd.nist.gov/vuln/detail/CVE-2023-25652)
[result](https://nvd.nist.gov/vuln/detail/CVE-2023-29007)
in local code execution and remote code execution. In the end, if you don't
trust the origin, don't use it.
## Installation