| 1 | #include "git-compat-util.h" |
| 2 | #include "quote.h" |
| 3 | #include "exec-cmd.h" |
| 4 | #include "strbuf.h" |
| 5 | #include "run-command.h" |
| 6 | #include "alias.h" |
| 7 | |
| 8 | #define COMMAND_DIR "git-shell-commands" |
| 9 | #define HELP_COMMAND COMMAND_DIR "/help" |
| 10 | #define NOLOGIN_COMMAND COMMAND_DIR "/no-interactive-login" |
| 11 | |
| 12 | static int do_generic_cmd(const char *me, char *arg) |
| 13 | { |
| 14 | const char *my_argv[4]; |
| 15 | |
| 16 | setup_path(); |
| 17 | if (!arg || !(arg = sq_dequote(arg)) || *arg == '-') |
| 18 | die("bad argument"); |
| 19 | if (!skip_prefix(me, "git-", &me)) |
| 20 | die("bad command"); |
| 21 | |
| 22 | my_argv[0] = me; |
| 23 | my_argv[1] = arg; |
| 24 | my_argv[2] = NULL; |
| 25 | |
| 26 | return execv_git_cmd(my_argv); |
| 27 | } |
| 28 | |
| 29 | static int is_valid_cmd_name(const char *cmd) |
| 30 | { |
| 31 | /* Test command contains no . or / characters */ |
| 32 | return cmd[strcspn(cmd, "./")] == '\0'; |
| 33 | } |
| 34 | |
| 35 | static char *make_cmd(const char *prog) |
| 36 | { |
| 37 | return xstrfmt("%s/%s", COMMAND_DIR, prog); |
| 38 | } |
| 39 | |
| 40 | static void cd_to_homedir(void) |
| 41 | { |
| 42 | const char *home = getenv("HOME"); |
| 43 | if (!home) |
| 44 | die("could not determine user's home directory; HOME is unset"); |
| 45 | if (chdir(home) == -1) |
| 46 | die("could not chdir to user's home directory"); |
| 47 | } |
| 48 | |
| 49 | #define MAX_INTERACTIVE_COMMAND (4*1024*1024) |
| 50 | |
| 51 | static void run_shell(void) |
| 52 | { |
| 53 | int done = 0; |
| 54 | struct child_process help_cmd = CHILD_PROCESS_INIT; |
| 55 | |
| 56 | if (!access(NOLOGIN_COMMAND, F_OK)) { |
| 57 | /* Interactive login disabled. */ |
| 58 | struct child_process nologin_cmd = CHILD_PROCESS_INIT; |
| 59 | int status; |
| 60 | |
| 61 | strvec_push(&nologin_cmd.args, NOLOGIN_COMMAND); |
| 62 | status = run_command(&nologin_cmd); |
| 63 | if (status < 0) |
| 64 | exit(127); |
| 65 | exit(status); |
| 66 | } |
| 67 | |
| 68 | /* Print help if enabled */ |
| 69 | help_cmd.silent_exec_failure = 1; |
| 70 | strvec_push(&help_cmd.args, HELP_COMMAND); |
| 71 | run_command(&help_cmd); |
| 72 | |
| 73 | do { |
| 74 | const char *prog; |
| 75 | char *full_cmd; |
| 76 | char *rawargs; |
| 77 | size_t len; |
| 78 | char *split_args; |
| 79 | const char **argv; |
| 80 | int code; |
| 81 | int count; |
| 82 | |
| 83 | fprintf(stderr, "git> "); |
| 84 | |
| 85 | /* |
| 86 | * Avoid using a strbuf or git_read_line_interactively() here. |
| 87 | * We don't want to allocate arbitrary amounts of memory on |
| 88 | * behalf of a possibly untrusted client, and we're subject to |
| 89 | * OS limits on command length anyway. |
| 90 | */ |
| 91 | fflush(stdout); |
| 92 | rawargs = xmalloc(MAX_INTERACTIVE_COMMAND); |
| 93 | if (!fgets(rawargs, MAX_INTERACTIVE_COMMAND, stdin)) { |
| 94 | fprintf(stderr, "\n"); |
| 95 | free(rawargs); |
| 96 | break; |
| 97 | } |
| 98 | len = strlen(rawargs); |
| 99 | |
| 100 | /* |
| 101 | * If we truncated due to our input buffer size, reject the |
| 102 | * command. That's better than running bogus input, and |
| 103 | * there's a good chance it's just malicious garbage anyway. |
| 104 | */ |
| 105 | if (len >= MAX_INTERACTIVE_COMMAND - 1) |
| 106 | die("invalid command format: input too long"); |
| 107 | |
| 108 | if (len > 0 && rawargs[len - 1] == '\n') { |
| 109 | if (--len > 0 && rawargs[len - 1] == '\r') |
| 110 | --len; |
| 111 | rawargs[len] = '\0'; |
| 112 | } |
| 113 | |
| 114 | split_args = xstrdup(rawargs); |
| 115 | count = split_cmdline(split_args, &argv); |
| 116 | if (count < 0) { |
| 117 | fprintf(stderr, "invalid command format '%s': %s\n", rawargs, |
| 118 | split_cmdline_strerror(count)); |
| 119 | free(split_args); |
| 120 | free(rawargs); |
| 121 | continue; |
| 122 | } |
| 123 | |
| 124 | prog = argv[0]; |
| 125 | if (!strcmp(prog, "")) { |
| 126 | } else if (!strcmp(prog, "quit") || !strcmp(prog, "logout") || |
| 127 | !strcmp(prog, "exit") || !strcmp(prog, "bye")) { |
| 128 | done = 1; |
| 129 | } else if (is_valid_cmd_name(prog)) { |
| 130 | struct child_process cmd = CHILD_PROCESS_INIT; |
| 131 | |
| 132 | full_cmd = make_cmd(prog); |
| 133 | argv[0] = full_cmd; |
| 134 | cmd.silent_exec_failure = 1; |
| 135 | strvec_pushv(&cmd.args, argv); |
| 136 | code = run_command(&cmd); |
| 137 | if (code == -1 && errno == ENOENT) { |
| 138 | fprintf(stderr, "unrecognized command '%s'\n", prog); |
| 139 | } |
| 140 | free(full_cmd); |
| 141 | } else { |
| 142 | fprintf(stderr, "invalid command format '%s'\n", prog); |
| 143 | } |
| 144 | |
| 145 | free(argv); |
| 146 | free(split_args); |
| 147 | free(rawargs); |
| 148 | } while (!done); |
| 149 | } |
| 150 | |
| 151 | static struct commands { |
| 152 | const char *name; |
| 153 | int (*exec)(const char *me, char *arg); |
| 154 | } cmd_list[] = { |
| 155 | { "git-receive-pack", do_generic_cmd }, |
| 156 | { "git-upload-pack", do_generic_cmd }, |
| 157 | { "git-upload-archive", do_generic_cmd }, |
| 158 | { NULL }, |
| 159 | }; |
| 160 | |
| 161 | int cmd_main(int argc, const char **argv) |
| 162 | { |
| 163 | char *prog; |
| 164 | const char **user_argv; |
| 165 | struct commands *cmd; |
| 166 | int count; |
| 167 | |
| 168 | /* |
| 169 | * Special hack to pretend to be a CVS server |
| 170 | */ |
| 171 | if (argc == 2 && !strcmp(argv[1], "cvs server")) { |
| 172 | argv--; |
| 173 | } else if (argc == 1) { |
| 174 | /* Allow the user to run an interactive shell */ |
| 175 | cd_to_homedir(); |
| 176 | if (access(COMMAND_DIR, R_OK | X_OK) == -1) { |
| 177 | die("Interactive git shell is not enabled.\n" |
| 178 | "hint: ~/" COMMAND_DIR " should exist " |
| 179 | "and have read and execute access."); |
| 180 | } |
| 181 | run_shell(); |
| 182 | exit(0); |
| 183 | } else if (argc != 3 || strcmp(argv[1], "-c")) { |
| 184 | /* |
| 185 | * We do not accept any other modes except "-c" followed by |
| 186 | * "cmd arg", where "cmd" is a very limited subset of git |
| 187 | * commands or a command in the COMMAND_DIR |
| 188 | */ |
| 189 | die("Run with no arguments or with -c cmd"); |
| 190 | } |
| 191 | |
| 192 | prog = xstrdup(argv[2]); |
| 193 | if (!strncmp(prog, "git", 3) && isspace(prog[3])) |
| 194 | /* Accept "git foo" as if the caller said "git-foo". */ |
| 195 | prog[3] = '-'; |
| 196 | |
| 197 | for (cmd = cmd_list ; cmd->name ; cmd++) { |
| 198 | int len = strlen(cmd->name); |
| 199 | char *arg; |
| 200 | if (strncmp(cmd->name, prog, len)) |
| 201 | continue; |
| 202 | arg = NULL; |
| 203 | switch (prog[len]) { |
| 204 | case '\0': |
| 205 | arg = NULL; |
| 206 | break; |
| 207 | case ' ': |
| 208 | arg = prog + len + 1; |
| 209 | break; |
| 210 | default: |
| 211 | continue; |
| 212 | } |
| 213 | return cmd->exec(cmd->name, arg); |
| 214 | } |
| 215 | |
| 216 | cd_to_homedir(); |
| 217 | count = split_cmdline(prog, &user_argv); |
| 218 | if (count >= 0) { |
| 219 | if (is_valid_cmd_name(user_argv[0])) { |
| 220 | char *cmd = make_cmd(user_argv[0]); |
| 221 | execv(cmd, (char *const *) user_argv); |
| 222 | } |
| 223 | free(prog); |
| 224 | free(user_argv); |
| 225 | die("unrecognized command '%s'", argv[2]); |
| 226 | } else { |
| 227 | free(prog); |
| 228 | die("invalid command format '%s': %s", argv[2], |
| 229 | split_cmdline_strerror(count)); |
| 230 | } |
| 231 | } |