git submodule: update=!command

[Ryan Lortie <desrt@desrt.ca>]

karaj,

'man git-submodule' contains mention (in one place) that:

    Setting the key submodule.$name.update to !command
    will cause command to be run.

This is not documented in 'man gitmodules' (which documents the other
possible values for the 'update' key) nor in 'man git-config' which also
mentions the 'update' key (but refers readers to the two other pages).

This feature is scary.  The idea that arbitrary code could be executed
on my machine when I run innocent-looking git commands, based on the
content of the .gitmodules file is enough to  give pause to anybody.

Fortunately, it seems that (for now?) this is not really the case.  'git
submodule init' will copy the values of the 'update' key from
.gitmodules to your local git config, but only if they are one of
"none", "checkout", "merge" or "rebase".

So, I guess I'm asking two things.

The first is a question about git's basic policy with respect to things
like this.  I hope that it's safe to assume that running 'git' commands
on repositories downloaded from potentially-hostile places will never
result in the authors of those repositories being able to run code on my
machine.

If that is true then, the second request would be to spell this out more
explicitly in the relevant documentation.  I'm happy to write a patch to
do that, if it is deemed appropriate.

Thanks in advance.

Cheers