Re: [RFC PATCH 6/6] hex: allow only lowercase object IDs in breaking changes mode

--WH+Sa9E1M4r9gjFg
Content-Type: text/plain; charset=utf-8
Content-Disposition: inline
Content-Transfer-Encoding: quoted-printable

On 2026-07-31 at 07:48:14, Junio C Hamano wrote:
> "brian m. carlson" <[email protected]> writes:
>=20
> > Git has historically allowed either lowercase or uppercase hex for
> > object IDs, but it has always emitted only lowercase.  This has caused
> > people to expect only lowercase and not handle uppercase.
>=20
> It is violation of Postel's Law by other people.  We do not
> necessarily have to follow suit.

Postel's Law was a great idea on the early Internet, but it is
unfortunately no longer a good idea.  The problem is that being liberal
in what you accept these days usually has security implications.

TLS cannot be liberal in what it accepts because that means potentially
allowing attacker-controlled data.  Even HTTP cannot do that because
we've seen where refusing to reject requests with both Content-Length
and Transfer-Encoding: chunked means that two parts of a backend can
disagree on the content, allowing request smuggling.

We've seen these problems in our code where not caring about CR comes
back to bite us on Windows in a security-sensitive way.

Modern development effectively requires being clear and definitive about
what data is accepted and what is not, as well as what meaning is given
to the data that is accepted.

> Even though I said throwing object names in a single category makes
> sense, it may make sense to treat the object names that we locally
> use to access our own object database and those that we use when
> talking with _other_ people on the net separately for the Robustness
> principle, we keep being strict in what we produce and stick to
> lowercase, while accepting uppercase produced by those third-party
> reimplementations of Git.

Unfortunately, that also doesn't fix most of the security problems I've
seen, which involve object IDs that get passed on the command line when
tools invoke Git.  It does fix the problem with round-tripping objects
between hash algorithms, though, but I don't really want to audit every
use of oid_to_hex in our codebase to half-fix this situation.
--=20
brian m. carlson (they/them)
Toronto, Ontario, CA

--WH+Sa9E1M4r9gjFg
Content-Type: application/pgp-signature; name=signature.asc

-----BEGIN PGP SIGNATURE-----

wr0EABYKAG8FgmpvwC8JEHwMSWKIh6KBRxQAAAAAAB4AIHNhbHRAbm90YXRpb25z
LnNlcXVvaWEtcGdwLm9yZxW2zu1XLiKuC98LSRXkftSgylUmsqCmpHVrck3cfe2D
FiEECCzmip28ZfuD0cORfAxJYoiHooEAAOfZAQClcDhyWV2IkgVewqQlt8db25wt
RntVxVPKR1ihZjASJwD/ZmObOV9daqNj/Y73QI8p57p8rM1fh9pg5xGwVHq/VQk=
=GvKK
-----END PGP SIGNATURE-----

--WH+Sa9E1M4r9gjFg--