https://github.com/git/git
Revision 0383bbb9015898cbc79abd7b64316484d7713b44 authored by Jeff King on 30 April 2018, 07:25:25 UTC, committed by Jeff King on 22 May 2018, 03:50:11 UTC
Submodule "names" come from the untrusted .gitmodules file,
but we blindly append them to $GIT_DIR/modules to create our
on-disk repo paths. This means you can do bad things by
putting "../" into the name (among other things).
Let's sanity-check these names to avoid building a path that
can be exploited. There are two main decisions:
1. What should the allowed syntax be?
It's tempting to reuse verify_path(), since submodule
names typically come from in-repo paths. But there are
two reasons not to:
a. It's technically more strict than what we need, as
we really care only about breaking out of the
$GIT_DIR/modules/ hierarchy. E.g., having a
submodule named "foo/.git" isn't actually
dangerous, and it's possible that somebody has
manually given such a funny name.
b. Since we'll eventually use this checking logic in
fsck to prevent downstream repositories, it should
be consistent across platforms. Because
verify_path() relies on is_dir_sep(), it wouldn't
block "foo\..\bar" on a non-Windows machine.
2. Where should we enforce it? These days most of the
.gitmodules reads go through submodule-config.c, so
I've put it there in the reading step. That should
cover all of the C code.
We also construct the name for "git submodule add"
inside the git-submodule.sh script. This is probably
not a big deal for security since the name is coming
from the user anyway, but it would be polite to remind
them if the name they pick is invalid (and we need to
expose the name-checker to the shell anyway for our
test scripts).
This patch issues a warning when reading .gitmodules
and just ignores the related config entry completely.
This will generally end up producing a sensible error,
as it works the same as a .gitmodules file which is
missing a submodule entry (so "submodule update" will
barf, but "git clone --recurse-submodules" will print
an error but not abort the clone.
There is one minor oddity, which is that we print the
warning once per malformed config key (since that's how
the config subsystem gives us the entries). So in the
new test, for example, the user would see three
warnings. That's OK, since the intent is that this case
should never come up outside of malicious repositories
(and then it might even benefit the user to see the
message multiple times).
Credit for finding this vulnerability and the proof of
concept from which the test script was adapted goes to
Etienne Stalmans.
Signed-off-by: Jeff King <peff@peff.net>
1 parent 42e6fde
Tip revision: 0383bbb9015898cbc79abd7b64316484d7713b44 authored by Jeff King on 30 April 2018, 07:25:25 UTC
submodule-config: verify submodule names as paths
submodule-config: verify submodule names as paths
Tip revision: 0383bbb
branch.c
#include "git-compat-util.h"
#include "cache.h"
#include "branch.h"
#include "refs.h"
#include "remote.h"
#include "commit.h"
#include "worktree.h"
struct tracking {
struct refspec spec;
char *src;
const char *remote;
int matches;
};
static int find_tracked_branch(struct remote *remote, void *priv)
{
struct tracking *tracking = priv;
if (!remote_find_tracking(remote, &tracking->spec)) {
if (++tracking->matches == 1) {
tracking->src = tracking->spec.src;
tracking->remote = remote->name;
} else {
free(tracking->spec.src);
if (tracking->src) {
free(tracking->src);
tracking->src = NULL;
}
}
tracking->spec.src = NULL;
}
return 0;
}
static int should_setup_rebase(const char *origin)
{
switch (autorebase) {
case AUTOREBASE_NEVER:
return 0;
case AUTOREBASE_LOCAL:
return origin == NULL;
case AUTOREBASE_REMOTE:
return origin != NULL;
case AUTOREBASE_ALWAYS:
return 1;
}
return 0;
}
static const char tracking_advice[] =
N_("\n"
"After fixing the error cause you may try to fix up\n"
"the remote tracking information by invoking\n"
"\"git branch --set-upstream-to=%s%s%s\".");
int install_branch_config(int flag, const char *local, const char *origin, const char *remote)
{
const char *shortname = NULL;
struct strbuf key = STRBUF_INIT;
int rebasing = should_setup_rebase(origin);
if (skip_prefix(remote, "refs/heads/", &shortname)
&& !strcmp(local, shortname)
&& !origin) {
warning(_("Not setting branch %s as its own upstream."),
local);
return 0;
}
strbuf_addf(&key, "branch.%s.remote", local);
if (git_config_set_gently(key.buf, origin ? origin : ".") < 0)
goto out_err;
strbuf_reset(&key);
strbuf_addf(&key, "branch.%s.merge", local);
if (git_config_set_gently(key.buf, remote) < 0)
goto out_err;
if (rebasing) {
strbuf_reset(&key);
strbuf_addf(&key, "branch.%s.rebase", local);
if (git_config_set_gently(key.buf, "true") < 0)
goto out_err;
}
strbuf_release(&key);
if (flag & BRANCH_CONFIG_VERBOSE) {
if (shortname) {
if (origin)
printf_ln(rebasing ?
_("Branch %s set up to track remote branch %s from %s by rebasing.") :
_("Branch %s set up to track remote branch %s from %s."),
local, shortname, origin);
else
printf_ln(rebasing ?
_("Branch %s set up to track local branch %s by rebasing.") :
_("Branch %s set up to track local branch %s."),
local, shortname);
} else {
if (origin)
printf_ln(rebasing ?
_("Branch %s set up to track remote ref %s by rebasing.") :
_("Branch %s set up to track remote ref %s."),
local, remote);
else
printf_ln(rebasing ?
_("Branch %s set up to track local ref %s by rebasing.") :
_("Branch %s set up to track local ref %s."),
local, remote);
}
}
return 0;
out_err:
strbuf_release(&key);
error(_("Unable to write upstream branch configuration"));
advise(_(tracking_advice),
origin ? origin : "",
origin ? "/" : "",
shortname ? shortname : remote);
return -1;
}
/*
* This is called when new_ref is branched off of orig_ref, and tries
* to infer the settings for branch.<new_ref>.{remote,merge} from the
* config.
*/
static void setup_tracking(const char *new_ref, const char *orig_ref,
enum branch_track track, int quiet)
{
struct tracking tracking;
int config_flags = quiet ? 0 : BRANCH_CONFIG_VERBOSE;
memset(&tracking, 0, sizeof(tracking));
tracking.spec.dst = (char *)orig_ref;
if (for_each_remote(find_tracked_branch, &tracking))
return;
if (!tracking.matches)
switch (track) {
case BRANCH_TRACK_ALWAYS:
case BRANCH_TRACK_EXPLICIT:
case BRANCH_TRACK_OVERRIDE:
break;
default:
return;
}
if (tracking.matches > 1)
die(_("Not tracking: ambiguous information for ref %s"),
orig_ref);
if (install_branch_config(config_flags, new_ref, tracking.remote,
tracking.src ? tracking.src : orig_ref) < 0)
exit(-1);
free(tracking.src);
}
int read_branch_desc(struct strbuf *buf, const char *branch_name)
{
char *v = NULL;
struct strbuf name = STRBUF_INIT;
strbuf_addf(&name, "branch.%s.description", branch_name);
if (git_config_get_string(name.buf, &v)) {
strbuf_release(&name);
return -1;
}
strbuf_addstr(buf, v);
free(v);
strbuf_release(&name);
return 0;
}
int validate_new_branchname(const char *name, struct strbuf *ref,
int force, int attr_only)
{
if (strbuf_check_branch_ref(ref, name))
die(_("'%s' is not a valid branch name."), name);
if (!ref_exists(ref->buf))
return 0;
else if (!force && !attr_only)
die(_("A branch named '%s' already exists."), ref->buf + strlen("refs/heads/"));
if (!attr_only) {
const char *head;
unsigned char sha1[20];
head = resolve_ref_unsafe("HEAD", 0, sha1, NULL);
if (!is_bare_repository() && head && !strcmp(head, ref->buf))
die(_("Cannot force update the current branch."));
}
return 1;
}
static int check_tracking_branch(struct remote *remote, void *cb_data)
{
char *tracking_branch = cb_data;
struct refspec query;
memset(&query, 0, sizeof(struct refspec));
query.dst = tracking_branch;
return !remote_find_tracking(remote, &query);
}
static int validate_remote_tracking_branch(char *ref)
{
return !for_each_remote(check_tracking_branch, ref);
}
static const char upstream_not_branch[] =
N_("Cannot setup tracking information; starting point '%s' is not a branch.");
static const char upstream_missing[] =
N_("the requested upstream branch '%s' does not exist");
static const char upstream_advice[] =
N_("\n"
"If you are planning on basing your work on an upstream\n"
"branch that already exists at the remote, you may need to\n"
"run \"git fetch\" to retrieve it.\n"
"\n"
"If you are planning to push out a new local branch that\n"
"will track its remote counterpart, you may want to use\n"
"\"git push -u\" to set the upstream config as you push.");
void create_branch(const char *name, const char *start_name,
int force, int reflog, int clobber_head,
int quiet, enum branch_track track)
{
struct commit *commit;
unsigned char sha1[20];
char *real_ref;
struct strbuf ref = STRBUF_INIT;
int forcing = 0;
int dont_change_ref = 0;
int explicit_tracking = 0;
if (track == BRANCH_TRACK_EXPLICIT || track == BRANCH_TRACK_OVERRIDE)
explicit_tracking = 1;
if (validate_new_branchname(name, &ref, force,
track == BRANCH_TRACK_OVERRIDE ||
clobber_head)) {
if (!force)
dont_change_ref = 1;
else
forcing = 1;
}
real_ref = NULL;
if (get_sha1(start_name, sha1)) {
if (explicit_tracking) {
if (advice_set_upstream_failure) {
error(_(upstream_missing), start_name);
advise(_(upstream_advice));
exit(1);
}
die(_(upstream_missing), start_name);
}
die(_("Not a valid object name: '%s'."), start_name);
}
switch (dwim_ref(start_name, strlen(start_name), sha1, &real_ref)) {
case 0:
/* Not branching from any existing branch */
if (explicit_tracking)
die(_(upstream_not_branch), start_name);
break;
case 1:
/* Unique completion -- good, only if it is a real branch */
if (!starts_with(real_ref, "refs/heads/") &&
validate_remote_tracking_branch(real_ref)) {
if (explicit_tracking)
die(_(upstream_not_branch), start_name);
else
real_ref = NULL;
}
break;
default:
die(_("Ambiguous object name: '%s'."), start_name);
break;
}
if ((commit = lookup_commit_reference(sha1)) == NULL)
die(_("Not a valid branch point: '%s'."), start_name);
hashcpy(sha1, commit->object.oid.hash);
if (reflog)
log_all_ref_updates = LOG_REFS_NORMAL;
if (!dont_change_ref) {
struct ref_transaction *transaction;
struct strbuf err = STRBUF_INIT;
char *msg;
if (forcing)
msg = xstrfmt("branch: Reset to %s", start_name);
else
msg = xstrfmt("branch: Created from %s", start_name);
transaction = ref_transaction_begin(&err);
if (!transaction ||
ref_transaction_update(transaction, ref.buf,
sha1, forcing ? NULL : null_sha1,
0, msg, &err) ||
ref_transaction_commit(transaction, &err))
die("%s", err.buf);
ref_transaction_free(transaction);
strbuf_release(&err);
free(msg);
}
if (real_ref && track)
setup_tracking(ref.buf + 11, real_ref, track, quiet);
strbuf_release(&ref);
free(real_ref);
}
void remove_branch_state(void)
{
unlink(git_path_cherry_pick_head());
unlink(git_path_revert_head());
unlink(git_path_merge_head());
unlink(git_path_merge_rr());
unlink(git_path_merge_msg());
unlink(git_path_merge_mode());
unlink(git_path_squash_msg());
}
void die_if_checked_out(const char *branch, int ignore_current_worktree)
{
const struct worktree *wt;
wt = find_shared_symref("HEAD", branch);
if (!wt || (ignore_current_worktree && wt->is_current))
return;
skip_prefix(branch, "refs/heads/", &branch);
die(_("'%s' is already checked out at '%s'"),
branch, wt->path);
}
int replace_each_worktree_head_symref(const char *oldref, const char *newref,
const char *logmsg)
{
int ret = 0;
struct worktree **worktrees = get_worktrees(0);
int i;
for (i = 0; worktrees[i]; i++) {
if (worktrees[i]->is_detached)
continue;
if (strcmp(oldref, worktrees[i]->head_ref))
continue;
if (set_worktree_head_symref(get_worktree_git_dir(worktrees[i]),
newref, logmsg)) {
ret = -1;
error(_("HEAD of working tree %s is not updated"),
worktrees[i]->path);
}
}
free_worktrees(worktrees);
return ret;
}
Computing file changes ...
