Revision 8db1e8743c0f1ed241f6a1b8bf55b6fef07d6751 authored by Johannes Schindelin on 28 March 2024, 18:21:06 UTC, committed by Johannes Schindelin on 19 April 2024, 10:38:23 UTC
Critical security issues typically combine relatively common vulnerabilities such as case confusion in file paths with other weaknesses in order to raise the severity of the attack. One such weakness that has haunted the Git project in many a submodule-related CVE is that any hooks that are found are executed during a clone operation. Examples are the `post-checkout` and `fsmonitor` hooks. However, Git's design calls for hooks to be disabled by default, as only disabled example hooks are copied over from the templates in `<prefix>/share/git-core/templates/`. As a defense-in-depth measure, let's prevent those hooks from running. Obviously, administrators can choose to drop enabled hooks into the template directory, though, _and_ it is also possible to override `core.hooksPath`, in which case the new check needs to be disabled. Signed-off-by: Johannes Schindelin <johannes.schindelin@gmx.de>
1 parent 584de0b
merge-ort-wrappers.c
#include "cache.h"
#include "merge-ort.h"
#include "merge-ort-wrappers.h"
#include "commit.h"
static int unclean(struct merge_options *opt, struct tree *head)
{
/* Sanity check on repo state; index must match head */
struct strbuf sb = STRBUF_INIT;
if (head && repo_index_has_changes(opt->repo, head, &sb)) {
error(_("Your local changes to the following files would be overwritten by merge:\n %s"),
sb.buf);
strbuf_release(&sb);
return -1;
}
return 0;
}
int merge_ort_nonrecursive(struct merge_options *opt,
struct tree *head,
struct tree *merge,
struct tree *merge_base)
{
struct merge_result result;
if (unclean(opt, head))
return -1;
if (oideq(&merge_base->object.oid, &merge->object.oid)) {
printf_ln(_("Already up to date."));
return 1;
}
memset(&result, 0, sizeof(result));
merge_incore_nonrecursive(opt, merge_base, head, merge, &result);
merge_switch_to_result(opt, head, &result, 1, 1);
return result.clean;
}
int merge_ort_recursive(struct merge_options *opt,
struct commit *side1,
struct commit *side2,
struct commit_list *merge_bases,
struct commit **result)
{
struct tree *head = repo_get_commit_tree(opt->repo, side1);
struct merge_result tmp;
if (unclean(opt, head))
return -1;
memset(&tmp, 0, sizeof(tmp));
merge_incore_recursive(opt, merge_bases, side1, side2, &tmp);
merge_switch_to_result(opt, head, &tmp, 1, 1);
*result = NULL;
return tmp.clean;
}
![swh spinner](/static/img/swh-spinner.gif)
Computing file changes ...