From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.2 (2018-09-13) on dcvr.yhbt.net X-Spam-Level: X-Spam-ASN: AS53758 23.128.96.0/24 X-Spam-Status: No, score=-3.8 required=3.0 tests=AWL,BAYES_00, HEADER_FROM_DIFFERENT_DOMAINS,MAILING_LIST_MULTI,RCVD_IN_DNSWL_NONE, SPF_HELO_PASS,SPF_PASS shortcircuit=no autolearn=ham autolearn_force=no version=3.4.2 Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by dcvr.yhbt.net (Postfix) with ESMTP id 0B2121F8C7 for ; Thu, 1 Jul 2021 16:47:34 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S229759AbhGAQt7 (ORCPT ); Thu, 1 Jul 2021 12:49:59 -0400 Received: from cloud.peff.net ([104.130.231.41]:38938 "EHLO cloud.peff.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S229629AbhGAQt6 (ORCPT ); Thu, 1 Jul 2021 12:49:58 -0400 Received: (qmail 28383 invoked by uid 109); 1 Jul 2021 16:47:27 -0000 Received: from Unknown (HELO peff.net) (10.0.1.2) by cloud.peff.net (qpsmtpd/0.94) with ESMTP; Thu, 01 Jul 2021 16:47:27 +0000 Authentication-Results: cloud.peff.net; auth=none Received: (qmail 17525 invoked by uid 111); 1 Jul 2021 16:47:27 -0000 Received: from coredump.intra.peff.net (HELO sigill.intra.peff.net) (10.0.0.2) by peff.net (qpsmtpd/0.94) with (TLS_AES_256_GCM_SHA384 encrypted) ESMTPS; Thu, 01 Jul 2021 12:47:27 -0400 Authentication-Results: peff.net; auth=none Date: Thu, 1 Jul 2021 12:47:26 -0400 From: Jeff King To: =?utf-8?B?w4Z2YXIgQXJuZmrDtnLDsA==?= Bjarmason Cc: git@vger.kernel.org, Junio C Hamano , Jonathan Tan , Josh Steadmon , Bruno Albuquerque , Eric Sunshine , Christian Couder Subject: Re: [PATCH v2 7/8] serve: add support for a "startup" git_config() callback Message-ID: References: MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Disposition: inline In-Reply-To: Precedence: bulk List-ID: X-Mailing-List: git@vger.kernel.org On Thu, Jul 01, 2021 at 12:43:43PM -0400, Jeff King wrote: > I dunno. Maybe the solution is for ls_refs() to just do a separate > config call to pick up the operation-specific bits, like: By the way, I think both currently and after the patch I showed, ls_refs() has the same "bug" that we fixed for upload_pack_v2() a while ago: in a v2 world, a client could request "ls-refs" over and over, and each time we'd load the hiderefs config, appending duplicate config to the list each time. In practice this doesn't happen because unlike "fetch", which clients must do many rounds of, clients usually issue only a single ls-refs. So it may not be worth worrying too much about. I guess a malicious client could convince us to very slowly allocate an arbitrary amount of memory. -Peff