Repository navigation
Found a possible security concern #1409
Description
Activity
Thanks a lot for looking into GitPython!
According to the recommendation, I have added a SECURITY.md file that should help @theWorstComrade to reach out.
We can use this ticket to track the overall progress on resolving the issue.
And yes, I am very curious what that could be, can't wait to hear about the issue.
Hey @Byron - thanks for your response. You should have received an e-mail from us about 1 hour ago!
You can use the magic URL in our e-mail to view the report or you can see the report directly here:
https://huntr.dev/bounties/8549d81f-dc45-4af7-9f2a-2d70752d8524It is private and only accessible to maintainers with repository write permissions!
Reacted by Sebastian Thiel and Manuel KaufmannAfter giving it a shot myself, I failed to fix it without breaking tests. It probably needs more work than I am able to commit right now, or somebody more familiar with the matter at hand.
@theWorstComrade - would you be able to support with a fix?
A fix landed with the release of 3.1.27, resolving this issue. Thanks everyone for the initiative and support.
Reacted by Manuel Kaufmann- added a commit that references this issue
on Feb 21, 2022 - added a commit that references this issue
on Feb 21, 2022
Hey there!
I belong to an open source security research community, and a member (@theWorstComrade) has found an issue, but doesn’t know the best way to disclose it.
If not a hassle, might you kindly add a
SECURITY.mdfile with an email, or another contact method? GitHub recommends this best practice to ensure security issues are responsibly disclosed, and it would serve as a simple instruction for security researchers in the future.Thank you for your consideration, and I look forward to hearing from you!
(cc @huntr-helper)