Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

[BUG] DO NOT use short hash for commit versions (DOS attack) #783

Open
4 tasks done
Leptopoda opened this issue Sep 16, 2024 · 2 comments
Open
4 tasks done

[BUG] DO NOT use short hash for commit versions (DOS attack) #783

Leptopoda opened this issue Sep 16, 2024 · 2 comments
Assignees
Labels
bug Something isn't working

Comments

@Leptopoda
Copy link

Before creating a bug report please make check the following

  • You have read our FAQ
  • If you have used flutter. Please install correctly, run pub cache repair. Close the terminal and try again.
  • If you are on Windows. Make sure you are running the terminal as administrator or with developer permissions.
  • Run fvm doctor if possible and add the output to the issue.

Describe the bug
Using a commit version of flutter will specify the short hash in the .fvmrc (and vscode config) files.
This can easily be DOSed as commit hashes are shared between forks of the repo.
You can read more about it in: https://blog.teddykatz.com/2019/11/12/github-actions-dos.html

To Reproduce
run fvm use 6d04a162109d07876230709adf4013db113b16a3
see the content of .fvmrc

{
  "flutter": "6d04a16210"
}

Expected behavior
The full commit hash is used in the config file.
Also when just the short commit was specified in the first place

Logs
N.A.

Desktop (please complete the following information):
N.A.

Additional context
Short hashes should only ever be used to display a nice version to the user.
Never to refer to any particular commit (especially on GitHub).

@Leptopoda Leptopoda added the bug Something isn't working label Sep 16, 2024
@leoafarias
Copy link
Owner

@Leptopoda, thank you for opening this issue. Do you think you would be able to create a PR addressing this? I believe this should be fairly straightforward, but I am still trying to catch up on the issues and PRs in fvm.

@Leptopoda
Copy link
Author

I'm fairly caught up in work myself, so don't count on me.
I'll take a shot at it once I have more time.

@leoafarias leoafarias self-assigned this Nov 4, 2024
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
bug Something isn't working
Projects
None yet
Development

No branches or pull requests

2 participants