Revision 820d7650cc670d3e4195aad3a5343158c316e8fa authored by Junio C Hamano on 26 July 2017, 17:24:20 UTC, committed by Junio C Hamano on 28 July 2017, 22:51:14 UTC
When commands like "git fetch" talk with ssh://$rest_of_URL/, the code splits $rest_of_URL into components like host, port, etc., and then spawns the underlying "ssh" program by formulating argv[] array that has: - the path to ssh command taken from GIT_SSH_COMMAND, etc. - dashed options like '-batch' (for Tortoise), '-p <port>' as needed. - ssh_host, which is supposed to be the hostname parsed out of $rest_of_URL. - then the command to be run on the other side, e.g. git upload-pack. If the ssh_host ends up getting '-<anything>', the argv[] that is used to spawn the command becomes something like: { "ssh", "-p", "22", "-<anything>", "command", "to", "run", NULL } which obviously is bogus, but depending on the actual value of "<anything>", will make "ssh" parse and use it as an option. Prevent this by forbidding ssh_host that begins with a "-". Noticed-by: Joern Schneeweisz of Recurity Labs Reported-by: Brian at GitLab Signed-off-by: Junio C Hamano <gitster@pobox.com> Reviewed-by: Jeff King <peff@peff.net> Signed-off-by: Junio C Hamano <gitster@pobox.com>
1 parent c8dd1e3
File | Mode | Size |
---|---|---|
.gitattributes | -rw-r--r-- | 98 bytes |
embed-from.expect | -rw-r--r-- | 111 bytes |
embed-from.in | -rw-r--r-- | 376 bytes |
empty | -rw-r--r-- | 0 bytes |
info-from.expect | -rw-r--r-- | 133 bytes |
info-from.in | -rw-r--r-- | 211 bytes |
info0001 | -rw-r--r-- | 118 bytes |
info0002 | -rw-r--r-- | 106 bytes |
info0003 | -rw-r--r-- | 104 bytes |
info0004 | -rw-r--r-- | 171 bytes |
info0005 | -rw-r--r-- | 140 bytes |
info0006 | -rw-r--r-- | 102 bytes |
info0007 | -rw-r--r-- | 106 bytes |
info0008 | -rw-r--r-- | 108 bytes |
info0009 | -rw-r--r-- | 99 bytes |
info0010 | -rw-r--r-- | 156 bytes |
info0011 | -rw-r--r-- | 105 bytes |
info0012 | -rw-r--r-- | 178 bytes |
info0012--message-id | -rw-r--r-- | 178 bytes |
info0013 | -rw-r--r-- | 100 bytes |
info0014 | -rw-r--r-- | 100 bytes |
info0014--scissors | -rw-r--r-- | 153 bytes |
info0015 | -rw-r--r-- | 95 bytes |
info0015--no-inbody-headers | -rw-r--r-- | 123 bytes |
info0016 | -rw-r--r-- | 99 bytes |
info0016--no-inbody-headers | -rw-r--r-- | 123 bytes |
info0017 | -rw-r--r-- | 103 bytes |
msg0001 | -rw-r--r-- | 32 bytes |
msg0002 | -rw-r--r-- | 649 bytes |
msg0003 | -rw-r--r-- | 245 bytes |
msg0004 | -rw-r--r-- | 147 bytes |
msg0005 | -rw-r--r-- | 438 bytes |
msg0006 | -rw-r--r-- | 32 bytes |
msg0007 | -rw-r--r-- | 39 bytes |
msg0008 | -rw-r--r-- | 67 bytes |
msg0009 | -rw-r--r-- | 43 bytes |
msg0010 | -rw-r--r-- | 218 bytes |
msg0011 | -rw-r--r-- | 62 bytes |
msg0012 | -rw-r--r-- | 317 bytes |
msg0012--message-id | -rw-r--r-- | 379 bytes |
msg0013 | -rw-r--r-- | 0 bytes |
msg0014 | -rw-r--r-- | 628 bytes |
msg0014--scissors | -rw-r--r-- | 163 bytes |
msg0015 | -rw-r--r-- | 24 bytes |
msg0015--no-inbody-headers | -rw-r--r-- | 39 bytes |
msg0016 | -rw-r--r-- | 18 bytes |
msg0016--no-inbody-headers | -rw-r--r-- | 31 bytes |
msg0017 | -rw-r--r-- | 18 bytes |
nul-b64.expect | -rw-r--r-- | 1.6 KB |
nul-b64.in | -rw-r--r-- | 2.4 KB |
nul-plain | -rw-r--r-- | 91 bytes |
patch0001 | -rw-r--r-- | 229 bytes |
patch0002 | -rw-r--r-- | 229 bytes |
patch0003 | -rw-r--r-- | 229 bytes |
patch0004 | -rw-r--r-- | 2.2 KB |
patch0005 | -rw-r--r-- | 2.4 KB |
patch0006 | -rw-r--r-- | 229 bytes |
patch0007 | -rw-r--r-- | 0 bytes |
patch0008 | -rw-r--r-- | 0 bytes |
patch0009 | -rw-r--r-- | 511 bytes |
patch0010 | -rw-r--r-- | 606 bytes |
patch0011 | -rw-r--r-- | 501 bytes |
patch0012 | -rw-r--r-- | 865 bytes |
patch0012--message-id | -rw-r--r-- | 865 bytes |
patch0013 | -rw-r--r-- | 0 bytes |
patch0014 | -rw-r--r-- | 1.5 KB |
patch0014--scissors | -rw-r--r-- | 1.5 KB |
patch0015 | -rw-r--r-- | 101 bytes |
patch0015--no-inbody-headers | -rw-r--r-- | 101 bytes |
patch0016 | -rw-r--r-- | 101 bytes |
patch0016--no-inbody-headers | -rw-r--r-- | 101 bytes |
patch0017 | -rw-r--r-- | 100 bytes |
quoted-from.expect | -rw-r--r-- | 71 bytes |
quoted-from.in | -rw-r--r-- | 270 bytes |
rfc2047-info-0001 | -rw-r--r-- | 103 bytes |
rfc2047-info-0002 | -rw-r--r-- | 82 bytes |
rfc2047-info-0003 | -rw-r--r-- | 85 bytes |
rfc2047-info-0004 | -rw-r--r-- | 127 bytes |
rfc2047-info-0005 | -rw-r--r-- | 14 bytes |
rfc2047-info-0006 | -rw-r--r-- | 16 bytes |
rfc2047-info-0007 | -rw-r--r-- | 15 bytes |
rfc2047-info-0008 | -rw-r--r-- | 15 bytes |
rfc2047-info-0009 | -rw-r--r-- | 15 bytes |
rfc2047-info-0010 | -rw-r--r-- | 16 bytes |
rfc2047-info-0011 | -rw-r--r-- | 16 bytes |
rfc2047-samples.mbox | -rw-r--r-- | 1.6 KB |
sample.mbox | -rw-r--r-- | 20.0 KB |
![swh spinner](/static/img/swh-spinner.gif)
Computing file changes ...