search

hashicorp / go-getter

Package for downloading things from a string URL using a variety of protocols.
Mozilla Public License 2.0
1.62k stars 227 forks source link

Backport fix from https://github.com/hashicorp/go-getter/pull/497 to v2 #498

Open nywilken opened 1 week ago

nywilken commented 1 week ago

Recreate git config during update to prevent git config alteration

Related to: #497

nywilken commented 1 week ago

Thanks a lot for the backport 🙌

Should we also backport the fix we did here too (maybe in another PR)

When presented with this PR in Slack @sylviamoss and @mcollao-hc validated that v2 is not susceptible to the vulnerability because v2 does not have a function called findRemoteDefaultBranch nor does it execute a command similar to exec.CommandContext(ctx, "git", "ls-remote", "--symref", "--", u.String(), "HEAD")

Please advise if your testing is showing different results.