/ 
Git-XS-0.02
River stage zero No dependents
/ Git::XS
Security Advisories (6)
CVE-2018-7159 (2018-05-17)

The HTTP parser in all current versions of Node.js ignores spaces in the `Content-Length` header, allowing input such as `Content-Length: 1 2` to be interpreted as having a value of `12`. The HTTP specification does not allow for spaces in the `Content-Length` value and the Node.js HTTP parser has been brought into line on this particular difference. The security risk of this flaw to Node.js users is considered to be VERY LOW as it is difficult, and may be impossible, to craft an attack that makes use of this flaw in a way that could not already be achieved by supplying an incorrect value for `Content-Length`. Vulnerabilities may exist in user-code that make incorrect assumptions about the potential accuracy of this value compared to the actual length of the data supplied. Node.js users crafting lower-level HTTP utilities are advised to re-check the length of any input supplied after parsing is complete.'

CVE-2018-12121 (2018-11-28)

Denial of Service with large HTTP headers by using a combination of many requests with maximum sized headers (almost 80 KB per connection), and carefully timed completion of the headers, it is possible to cause the HTTP server to abort from heap allocation failure. Attack potential is mitigated by the use of a load balancer or other proxy layer.

CVE-2018-25032 (2022-03-25)

zlib before 1.2.12 allows memory corruption when deflating (i.e., when compressing) if the input has many distant matches.

CVE-2016-10128 (2017-03-24)

Buffer overflow in the git_pkt_parse_line function in transports/smart_pkt.c in the Git Smart Protocol support in libgit2 before 0.24.6 and 0.25.x before 0.25.1 allows remote attackers to have unspecified impact via a crafted non-flush packet.

CVE-2016-10129 (2017-03-24)

The Git Smart Protocol support in libgit2 before 0.24.6 and 0.25.x before 0.25.1 allows remote attackers to cause a denial of service (NULL pointer dereference) via an empty packet line.

CVE-2016-10130 (2017-03-24)

The http_connect function in transports/http.c in libgit2 before 0.24.6 and 0.25.x before 0.25.1 might allow man-in-the-middle attackers to spoof servers by leveraging clobbering of the error variable.

NAME

Git::XS - Perl XS binding to libgit2

SYNOPSIS

use Git::XS;

my $git = Git::XS->new(
    repo => "path/to/git/repo",
);

$git->init;

print $git->status;

$git->add('file.name');

$git->commit(-m => 'It works');

$git->fetch;

$git->push('--all');

DESCRIPTION

This module is a Perl binding to libgit2. It attempts to make a clean OO API for dealing with git repositories from Perl. It should be very fast.

STATUS

WARNING: This module is still in the "proof of concept" phase. Come back later.

So far new() and init() are working. Kind of.

Find me online if you have good ideas for this module.

INSTALLATION

You can install this module like any other CPAN module, but you will need 2 programs in your PATH:

git - to clone the libgit2 repository from GitHub
cmake - to build libgit2

In the future, this module might use your system's copy of libgit2.

METHODS

Git::XS->new(repo => $repo)

Create a new Git::XS object for dealing with a git repository.

$git->init([-bare])

Initialize a repo if it doesn't exist. You can pass '-bare' to create a bare repo.

AUTHOR

Ingy döt Net <ingy@cpan.org>

COPYRIGHT AND LICENSE

Copyright (c) 2011. Ingy döt Net.

This program is free software; you can redistribute it and/or modify it under the same terms as Perl itself.

See http://www.perl.com/perl/misc/Artistic.html

1 POD Error

The following errors were encountered while parsing the POD:

Around line 64:

You forgot a '=back' before '=head1'