TE
科技回声
首页24小时热榜最新最佳问答展示工作
GitHubTwitter
首页

科技回声

基于 Next.js 构建的科技新闻平台,提供全球科技新闻和讨论内容。

GitHubTwitter

首页

首页最新最佳问答展示工作

资源链接

HackerNews API原版 HackerNewsNext.js

© 2025 科技回声. 版权所有。

Adding a SHA1 collision vulnerability test hoses WebKit's source repository

292 点作者 raingrove超过 8 年前

10 条评论

fanf2超过 8 年前
OK, this is quite a serious vulnerability in Subversion. SVN depends more on raw file SHA1 hashes than git because git prepends a header which prevents raw SHA1 collisions from translating directly into easy svn-style repository corruption.<p>The reason svn is broken is its &quot;rep-sharing&quot; feature, i.e. file content deduplication. It uses a SQLite database to share the representation of files based on their raw SHA1 checksum - for details see <a href="http:&#x2F;&#x2F;svn.apache.org&#x2F;repos&#x2F;asf&#x2F;subversion&#x2F;trunk&#x2F;subversion&#x2F;libsvn_fs_fs&#x2F;structure" rel="nofollow">http:&#x2F;&#x2F;svn.apache.org&#x2F;repos&#x2F;asf&#x2F;subversion&#x2F;trunk&#x2F;subversion&#x2F;...</a><p>You can mitigate this vulnerability by setting enable-rep-sharing = false in fsfs.conf - see documentation in that file or in the source at <a href="http:&#x2F;&#x2F;svn.apache.org&#x2F;viewvc&#x2F;subversion&#x2F;trunk&#x2F;subversion&#x2F;libsvn_fs_fs&#x2F;fs_fs.c?revision=1737356&amp;view=markup#l862" rel="nofollow">http:&#x2F;&#x2F;svn.apache.org&#x2F;viewvc&#x2F;subversion&#x2F;trunk&#x2F;subversion&#x2F;lib...</a><p>This feature was introduced in svn 1.6 released 2009, and made more aggressive in svn 1.8 released 2013 <a href="https:&#x2F;&#x2F;subversion.apache.org&#x2F;docs&#x2F;release-notes&#x2F;" rel="nofollow">https:&#x2F;&#x2F;subversion.apache.org&#x2F;docs&#x2F;release-notes&#x2F;</a><p>SVN exposes the SHA1 checksum as part of its external API, but its deduplication could easily have been built on a more secure foundation. Their decision to double down on SHA1 in 2013 was foolish.
评论 #13727300 未加载
评论 #13731084 未加载
phaemon超过 8 年前
As mentioned in a previous comment ( <a href="https:&#x2F;&#x2F;news.ycombinator.com&#x2F;item?id=13722469" rel="nofollow">https:&#x2F;&#x2F;news.ycombinator.com&#x2F;item?id=13722469</a> ) git doesn&#x27;t see these the same as it hashes the header+content which breaks the identical SHA trick.<p>Of course, I first tested this on our main production repository at work because...oh, wait, I didn&#x27;t because <i>what were you thinking</i>?!
评论 #13726916 未加载
评论 #13725585 未加载
jmount超过 8 年前
(from the link) &quot;For the record: the commits have been deleted, but the SVN is still hosed.&quot; That is pretty much my memory of working with SVN. I remember SVN fouling its database a few times. Sure I&#x27;ve broken git a few times, but I am always able to (as Jenny Bryan says) &quot;burn the whole thing down&quot; and take state from another copy of the repository.<p>I really tried with SVN (wanted something better than CVS) for quite a long time.
评论 #13726301 未加载
评论 #13725795 未加载
lumisota超过 8 年前
Isn&#x27;t it the SVN repo that&#x27;s &quot;hosed&quot;, not the Git repo as suggested by the title?
评论 #13725210 未加载
评论 #13725201 未加载
afandian超过 8 年前
Reminds me of when I worked at an antivirus company. We had be careful with the EICAR file in test code because it would set off AV alarms. <a href="http:&#x2F;&#x2F;www.eicar.org&#x2F;86-0-Intended-use.html" rel="nofollow">http:&#x2F;&#x2F;www.eicar.org&#x2F;86-0-Intended-use.html</a>
isp超过 8 年前
New SVN attack category: denial-of-service by SHA-1 collision.
评论 #13725566 未加载
raziel2p超过 8 年前
A bit hard for me to tell what happened here, maybe because I don&#x27;t know anything about SVN. The two PDFs with equal SHA1 hashes were git commited to the repository, but converting that to an SVN commit failed because... SVN can&#x27;t handle two separate files with the same SHA1 hash?
评论 #13725312 未加载
评论 #13725350 未加载
评论 #13725567 未加载
fapjacks超过 8 年前
I have to just say here that WebKit is one of the most over-the-top software projects I&#x27;ve ever tried to dig into, in my twenty years of programming. Building it inside a vanilla container was impossible following their directions exactly and required <i>so much</i> research on my part to get working. I&#x27;m used to a bit of back-and-forth with just about every project, but WebKit was ridiculous. After two workdays of trying, I&#x27;d been able to build a WebKit from the source, but at that point had to concede to the universe the futility of trying to build a golang-based Phantom, as my friend and former coworker originally wanted. And that also gave me <i>mad</i> respect for Phantom&#x27;s author and immediately taught me why they do not often incorporate new WebKit versions into the project instead of just pegging to the first one they can get to build.
paulddraper超过 8 年前
Site is down.
sigjuice超过 8 年前
This is why a git clone is not a real backup.