[go: up one dir, main page]

Skip to content

Prevent malformed git-lfs pointers from being pushed to a repository

Description

When using git-lfs, files in the local repository are replaced with a pointer to the file in LFS.

version https://git-lfs.github.com/spec/v1
oid sha256:1ab1a2bb8502820a83881a5b66910b819121bafe336d76374637aa4ea7ba2616
size 14

If a user clones a repository using LFS without LFS installed, these pointers are not replaced with the true contents of the file (as expected). If a user then edits one of these files, they can push the malformed pointer back to the repository, and break LFS for other users.

Proposal

All modifications to LFS pointers should be validated. If the pointer is malformed, or if the reference it points to is invalid, gitlab should reject the commit and display a warning to the user.

Feature checklist

Make sure these are completed before closing the issue, with a link to the relevant commit.