https://github.com/git/git
Revision 0383bbb9015898cbc79abd7b64316484d7713b44 authored by Jeff King on 30 April 2018, 07:25:25 UTC, committed by Jeff King on 22 May 2018, 03:50:11 UTC
Submodule "names" come from the untrusted .gitmodules file,
but we blindly append them to $GIT_DIR/modules to create our
on-disk repo paths. This means you can do bad things by
putting "../" into the name (among other things).
Let's sanity-check these names to avoid building a path that
can be exploited. There are two main decisions:
1. What should the allowed syntax be?
It's tempting to reuse verify_path(), since submodule
names typically come from in-repo paths. But there are
two reasons not to:
a. It's technically more strict than what we need, as
we really care only about breaking out of the
$GIT_DIR/modules/ hierarchy. E.g., having a
submodule named "foo/.git" isn't actually
dangerous, and it's possible that somebody has
manually given such a funny name.
b. Since we'll eventually use this checking logic in
fsck to prevent downstream repositories, it should
be consistent across platforms. Because
verify_path() relies on is_dir_sep(), it wouldn't
block "foo\..\bar" on a non-Windows machine.
2. Where should we enforce it? These days most of the
.gitmodules reads go through submodule-config.c, so
I've put it there in the reading step. That should
cover all of the C code.
We also construct the name for "git submodule add"
inside the git-submodule.sh script. This is probably
not a big deal for security since the name is coming
from the user anyway, but it would be polite to remind
them if the name they pick is invalid (and we need to
expose the name-checker to the shell anyway for our
test scripts).
This patch issues a warning when reading .gitmodules
and just ignores the related config entry completely.
This will generally end up producing a sensible error,
as it works the same as a .gitmodules file which is
missing a submodule entry (so "submodule update" will
barf, but "git clone --recurse-submodules" will print
an error but not abort the clone.
There is one minor oddity, which is that we print the
warning once per malformed config key (since that's how
the config subsystem gives us the entries). So in the
new test, for example, the user would see three
warnings. That's OK, since the intent is that this case
should never come up outside of malicious repositories
(and then it might even benefit the user to see the
message multiple times).
Credit for finding this vulnerability and the proof of
concept from which the test script was adapted goes to
Etienne Stalmans.
Signed-off-by: Jeff King <peff@peff.net>
1 parent 42e6fde
Tip revision: 0383bbb9015898cbc79abd7b64316484d7713b44 authored by Jeff King on 30 April 2018, 07:25:25 UTC
submodule-config: verify submodule names as paths
submodule-config: verify submodule names as paths
Tip revision: 0383bbb
usage.c
/*
* GIT - The information manager from hell
*
* Copyright (C) Linus Torvalds, 2005
*/
#include "git-compat-util.h"
#include "cache.h"
void vreportf(const char *prefix, const char *err, va_list params)
{
char msg[4096];
char *p;
vsnprintf(msg, sizeof(msg), err, params);
for (p = msg; *p; p++) {
if (iscntrl(*p) && *p != '\t' && *p != '\n')
*p = '?';
}
fprintf(stderr, "%s%s\n", prefix, msg);
}
static NORETURN void usage_builtin(const char *err, va_list params)
{
vreportf("usage: ", err, params);
exit(129);
}
static NORETURN void die_builtin(const char *err, va_list params)
{
vreportf("fatal: ", err, params);
exit(128);
}
static void error_builtin(const char *err, va_list params)
{
vreportf("error: ", err, params);
}
static void warn_builtin(const char *warn, va_list params)
{
vreportf("warning: ", warn, params);
}
static int die_is_recursing_builtin(void)
{
static int dying;
return dying++;
}
/* If we are in a dlopen()ed .so write to a global variable would segfault
* (ugh), so keep things static. */
static NORETURN_PTR void (*usage_routine)(const char *err, va_list params) = usage_builtin;
static NORETURN_PTR void (*die_routine)(const char *err, va_list params) = die_builtin;
static void (*error_routine)(const char *err, va_list params) = error_builtin;
static void (*warn_routine)(const char *err, va_list params) = warn_builtin;
static int (*die_is_recursing)(void) = die_is_recursing_builtin;
void set_die_routine(NORETURN_PTR void (*routine)(const char *err, va_list params))
{
die_routine = routine;
}
void set_error_routine(void (*routine)(const char *err, va_list params))
{
error_routine = routine;
}
void (*get_error_routine(void))(const char *err, va_list params)
{
return error_routine;
}
void set_warn_routine(void (*routine)(const char *warn, va_list params))
{
warn_routine = routine;
}
void (*get_warn_routine(void))(const char *warn, va_list params)
{
return warn_routine;
}
void set_die_is_recursing_routine(int (*routine)(void))
{
die_is_recursing = routine;
}
void NORETURN usagef(const char *err, ...)
{
va_list params;
va_start(params, err);
usage_routine(err, params);
va_end(params);
}
void NORETURN usage(const char *err)
{
usagef("%s", err);
}
void NORETURN die(const char *err, ...)
{
va_list params;
if (die_is_recursing()) {
fputs("fatal: recursion detected in die handler\n", stderr);
exit(128);
}
va_start(params, err);
die_routine(err, params);
va_end(params);
}
static const char *fmt_with_err(char *buf, int n, const char *fmt)
{
char str_error[256], *err;
int i, j;
err = strerror(errno);
for (i = j = 0; err[i] && j < sizeof(str_error) - 1; ) {
if ((str_error[j++] = err[i++]) != '%')
continue;
if (j < sizeof(str_error) - 1) {
str_error[j++] = '%';
} else {
/* No room to double the '%', so we overwrite it with
* '\0' below */
j--;
break;
}
}
str_error[j] = 0;
snprintf(buf, n, "%s: %s", fmt, str_error);
return buf;
}
void NORETURN die_errno(const char *fmt, ...)
{
char buf[1024];
va_list params;
if (die_is_recursing()) {
fputs("fatal: recursion detected in die_errno handler\n",
stderr);
exit(128);
}
va_start(params, fmt);
die_routine(fmt_with_err(buf, sizeof(buf), fmt), params);
va_end(params);
}
#undef error_errno
int error_errno(const char *fmt, ...)
{
char buf[1024];
va_list params;
va_start(params, fmt);
error_routine(fmt_with_err(buf, sizeof(buf), fmt), params);
va_end(params);
return -1;
}
#undef error
int error(const char *err, ...)
{
va_list params;
va_start(params, err);
error_routine(err, params);
va_end(params);
return -1;
}
void warning_errno(const char *warn, ...)
{
char buf[1024];
va_list params;
va_start(params, warn);
warn_routine(fmt_with_err(buf, sizeof(buf), warn), params);
va_end(params);
}
void warning(const char *warn, ...)
{
va_list params;
va_start(params, warn);
warn_routine(warn, params);
va_end(params);
}
static NORETURN void BUG_vfl(const char *file, int line, const char *fmt, va_list params)
{
char prefix[256];
/* truncation via snprintf is OK here */
if (file)
snprintf(prefix, sizeof(prefix), "BUG: %s:%d: ", file, line);
else
snprintf(prefix, sizeof(prefix), "BUG: ");
vreportf(prefix, fmt, params);
abort();
}
#ifdef HAVE_VARIADIC_MACROS
NORETURN void BUG_fl(const char *file, int line, const char *fmt, ...)
{
va_list ap;
va_start(ap, fmt);
BUG_vfl(file, line, fmt, ap);
va_end(ap);
}
#else
NORETURN void BUG(const char *fmt, ...)
{
va_list ap;
va_start(ap, fmt);
BUG_vfl(NULL, 0, fmt, ap);
va_end(ap);
}
#endif
Computing file changes ...
