fsck: detect gitmodules URLs with embedded newlines
The credential protocol can't handle values with newlines. We already detect and block any such URLs from being used with credential helpers, but let's also add an fsck check to detect and block gitmodules files with such URLs. That will let us notice the problem earlier when transfer.fsckObjects is turned on. And in particular it will prevent bad objects from spreading, which may protect downstream users running older versions of Git. We'll file this under the existing gitmodulesUrl flag, which covers URLs with option injection. There's really no need to distinguish the exact flaw in the URL in this context. Likewise, I've expanded the description of t7416 to cover all types of bogus URLs.
Jeff King committed
Mar 11, 2020 at 18:48 UTC
07259e74ec1237c836874342c65650bdee8a3993
2 files changed
+32
-2
fsck.c
+15
-1
@@ -14,6 +14,7 @@
14
#include "packfile.h"
15
#include "submodule-config.h"
16
#include "config.h"
17
+#include "credential.h"
18
19
static struct oidset gitmodules_found = OIDSET_INIT;
20
static struct oidset gitmodules_done = OIDSET_INIT;
@@ -941,6 +942,19 @@ static int fsck_tag(struct tag *tag, const char *data,
942
return fsck_tag_buffer(tag, data, size, options);
943
}
944
945
+static int check_submodule_url(const char *url)
946
+{
947
+ struct credential c = CREDENTIAL_INIT;
948
+ int ret;
949
+
950
+ if (looks_like_command_line_option(url))
951
+ return -1;
952
+
953
+ ret = credential_from_url_gently(&c, url, 1);
954
+ credential_clear(&c);
955
+ return ret;
956
+}
957
+
958
struct fsck_gitmodules_data {
959
struct object *obj;
960
struct fsck_options *options;
@@ -965,7 +979,7 @@ static int fsck_gitmodules_fn(const char *var, const char *value, void *vdata)
979
"disallowed submodule name: %s",
980
name);
981
if (!strcmp(key, "url") && value &&
968
- looks_like_command_line_option(value))
982
+ check_submodule_url(value) < 0)
983
data->ret |= report(data->options, data->obj,
984
FSCK_MSG_GITMODULES_URL,
985
"disallowed submodule url: %s",
t/t7416-submodule-dash-url.sh
+17
-1
@@ -1,6 +1,6 @@
1
#!/bin/sh
2
3
-test_description='check handling of .gitmodule url with dash'
3
+test_description='check handling of disallowed .gitmodule urls'
4
. ./test-lib.sh
5
6
test_expect_success 'create submodule with protected dash in url' '
@@ -60,4 +60,20 @@ test_expect_success 'trailing backslash is handled correctly' '
60
test_i18ngrep ! "unknown option" err
61
'
62
63
+test_expect_success 'fsck rejects embedded newline in url' '
64
+ # create an orphan branch to avoid existing .gitmodules objects
65
+ git checkout --orphan newline &&
66
+ cat >.gitmodules <<-\EOF &&
67
+ [submodule "foo"]
68
+ url = "https://one.example.com?%0ahost=two.example.com/foo.git"
69
+ EOF
70
+ git add .gitmodules &&
71
+ git commit -m "gitmodules with newline" &&
72
+ test_when_finished "rm -rf dst" &&
73
+ git init --bare dst &&
74
+ git -C dst config transfer.fsckObjects true &&
75
+ test_must_fail git push dst HEAD 2>err &&
76
+ grep gitmodulesUrl err
77
+'
78
+
79
test_done