Attached: 4 images

PSA: Did you know that it’s **unsafe** to put code diffs into your commit messages?

Like https://github.com/i3/i3/pull/6564 for example

Such diffs will be applied by patch(1) (also git-am(1)) as part of the code change!

This is how a sleep(1) made it into i3 4.25-2 in Debian unstable.

Lobsters is a community-driven platform for sharing and discussing links to articles, tutorials, and projects related to technology and programming. Readers can learn about a wide range of topics, from software development and system administration to cybersecurity and artificial intelligence. With user submissions, comments, and voting, Lobsters provides a platform for collaborative learning and knowledge sharing among technology enthusiasts.

Lobsters

The patch(1) and git-am(1) tools have a dangerous behavior: they apply code diffs found anywhere in commit messages as actual code changes. This happened in i3 4.25-2 in Debian unstable, where a sleep(1) call from a commit message diff was unintentionally applied to the codebase. The issue stems from patch's design to skip "garbage" lines and apply anything resembling a diff, combined with git's lack of proper delimitation between commit messages and patches. While git cherry-pick works correctly, using git format-patch and git-am can introduce unintended code changes, creating a potential security vulnerability.

Michael Stapelberg 🐧🐹😺: "PSA: Did you know that it’s **…"