Verify Content-Type from smart HTTP servers
Before parsing a suspected smart-HTTP response verify the returned Content-Type matches the standard. This protects a client from attempting to process a payload that smells like a smart-HTTP server response. JGit has been doing this check on all responses since the dawn of time. I mistakenly failed to include it in git-core when smart HTTP was introduced. At the time I didn't know how to get the Content-Type from libcurl. I punted, meant to circle back and fix this, and just plain forgot about it. Signed-off-by: Shawn Pearce <spearce@spearce.org> Signed-off-by: Junio C Hamano <gitster@pobox.com>
Shawn Pearce committed
Jan 31, 2013 at 13:02 UTC
4656bf47fca857df51b5d6f4b7b052192b3b2317
8 files changed
+59
-17
http-push.c
+2
-2
@@ -1560,7 +1560,7 @@ static int remote_exists(const char *path)
1560
1561
sprintf(url, "%s%s", repo->url, path);
1562
1563
- switch (http_get_strbuf(url, NULL, 0)) {
1563
+ switch (http_get_strbuf(url, NULL, NULL, 0)) {
1564
case HTTP_OK:
1565
ret = 1;
1566
break;
@@ -1584,7 +1584,7 @@ static void fetch_symref(const char *path, char **symref, unsigned char *sha1)
1584
url = xmalloc(strlen(repo->url) + strlen(path) + 1);
1585
sprintf(url, "%s%s", repo->url, path);
1586
1587
- if (http_get_strbuf(url, &buffer, 0) != HTTP_OK)
1587
+ if (http_get_strbuf(url, NULL, &buffer, 0) != HTTP_OK)
1588
die("Couldn't get %s for remote symref\n%s", url,
1589
curl_errorstr);
1590
free(url);
http.c
+22
-9
@@ -788,7 +788,8 @@ int handle_curl_result(struct slot_results *results)
788
#define HTTP_REQUEST_STRBUF 0
789
#define HTTP_REQUEST_FILE 1
790
791
-static int http_request(const char *url, void *result, int target, int options)
791
+static int http_request(const char *url, struct strbuf *type,
792
+ void *result, int target, int options)
793
{
794
struct active_request_slot *slot;
795
struct slot_results results;
@@ -838,24 +839,36 @@ static int http_request(const char *url, void *result, int target, int options)
839
ret = HTTP_START_FAILED;
840
}
841
842
+ if (type) {
843
+ char *t;
844
+ curl_easy_getinfo(slot->curl, CURLINFO_CONTENT_TYPE, &t);
845
+ if (t)
846
+ strbuf_addstr(type, t);
847
+ }
848
+
849
curl_slist_free_all(headers);
850
strbuf_release(&buf);
851
852
return ret;
853
}
854
847
-static int http_request_reauth(const char *url, void *result, int target,
855
+static int http_request_reauth(const char *url,
856
+ struct strbuf *type,
857
+ void *result, int target,
858
int options)
859
{
850
- int ret = http_request(url, result, target, options);
860
+ int ret = http_request(url, type, result, target, options);
861
if (ret != HTTP_REAUTH)
862
return ret;
853
- return http_request(url, result, target, options);
863
+ return http_request(url, type, result, target, options);
864
}
865
856
-int http_get_strbuf(const char *url, struct strbuf *result, int options)
866
+int http_get_strbuf(const char *url,
867
+ struct strbuf *type,
868
+ struct strbuf *result, int options)
869
{
858
- return http_request_reauth(url, result, HTTP_REQUEST_STRBUF, options);
870
+ return http_request_reauth(url, type, result,
871
+ HTTP_REQUEST_STRBUF, options);
872
}
873
874
/*
@@ -878,7 +891,7 @@ static int http_get_file(const char *url, const char *filename, int options)
891
goto cleanup;
892
}
893
881
- ret = http_request_reauth(url, result, HTTP_REQUEST_FILE, options);
894
+ ret = http_request_reauth(url, NULL, result, HTTP_REQUEST_FILE, options);
895
fclose(result);
896
897
if ((ret == HTTP_OK) && move_temp_to_file(tmpfile.buf, filename))
@@ -904,7 +917,7 @@ int http_fetch_ref(const char *base, struct ref *ref)
917
int ret = -1;
918
919
url = quote_ref_url(base, ref->name);
907
- if (http_get_strbuf(url, &buffer, HTTP_NO_CACHE) == HTTP_OK) {
920
+ if (http_get_strbuf(url, NULL, &buffer, HTTP_NO_CACHE) == HTTP_OK) {
921
strbuf_rtrim(&buffer);
922
if (buffer.len == 40)
923
ret = get_sha1_hex(buffer.buf, ref->old_sha1);
@@ -997,7 +1010,7 @@ int http_get_info_packs(const char *base_url, struct packed_git **packs_head)
1010
strbuf_addstr(&buf, "objects/info/packs");
1011
url = strbuf_detach(&buf, NULL);
1012
1000
- ret = http_get_strbuf(url, &buf, HTTP_NO_CACHE);
1013
+ ret = http_get_strbuf(url, NULL, &buf, HTTP_NO_CACHE);
1014
if (ret != HTTP_OK)
1015
goto cleanup;
1016
http.h
+1
-1
@@ -132,7 +132,7 @@ extern char *get_remote_object_url(const char *url, const char *hex,
132
*
133
* If the result pointer is NULL, a HTTP HEAD request is made instead of GET.
134
*/
135
-int http_get_strbuf(const char *url, struct strbuf *result, int options);
135
+int http_get_strbuf(const char *url, struct strbuf *content_type, struct strbuf *result, int options);
136
137
/*
138
* Prints an error message using error() containing url and curl_errorstr,
remote-curl.c
+12
-5
@@ -92,6 +92,8 @@ static void free_discovery(struct discovery *d)
92
93
static struct discovery* discover_refs(const char *service)
94
{
95
+ struct strbuf exp = STRBUF_INIT;
96
+ struct strbuf type = STRBUF_INIT;
97
struct strbuf buffer = STRBUF_INIT;
98
struct discovery *last = last_discovery;
99
char *refs_url;
@@ -113,7 +115,7 @@ static struct discovery* discover_refs(const char *service)
115
}
116
refs_url = strbuf_detach(&buffer, NULL);
117
116
- http_ret = http_get_strbuf(refs_url, &buffer, HTTP_NO_CACHE);
118
+ http_ret = http_get_strbuf(refs_url, &type, &buffer, HTTP_NO_CACHE);
119
switch (http_ret) {
120
case HTTP_OK:
121
break;
@@ -132,17 +134,20 @@ static struct discovery* discover_refs(const char *service)
134
last->buf_alloc = strbuf_detach(&buffer, &last->len);
135
last->buf = last->buf_alloc;
136
135
- if (maybe_smart && 5 <= last->len && last->buf[4] == '#') {
136
- /* smart HTTP response; validate that the service
137
+ strbuf_addf(&exp, "application/x-%s-advertisement", service);
138
+ if (maybe_smart &&
139
+ (5 <= last->len && last->buf[4] == '#') &&
140
+ !strbuf_cmp(&exp, &type)) {
141
+ /*
142
+ * smart HTTP response; validate that the service
143
* pkt-line matches our request.
144
*/
139
- struct strbuf exp = STRBUF_INIT;
140
-
145
if (packet_get_line(&buffer, &last->buf, &last->len) <= 0)
146
die("%s has invalid packet header", refs_url);
147
if (buffer.len && buffer.buf[buffer.len - 1] == '\n')
148
strbuf_setlen(&buffer, buffer.len - 1);
149
150
+ strbuf_reset(&exp);
151
strbuf_addf(&exp, "# service=%s", service);
152
if (strbuf_cmp(&exp, &buffer))
153
die("invalid server response; got '%s'", buffer.buf);
@@ -160,6 +165,8 @@ static struct discovery* discover_refs(const char *service)
165
}
166
167
free(refs_url);
168
+ strbuf_release(&exp);
169
+ strbuf_release(&type);
170
strbuf_release(&buffer);
171
last_discovery = last;
172
return last;
t/lib-httpd.sh
+1
@@ -80,6 +80,7 @@ fi
80
prepare_httpd() {
81
mkdir -p "$HTTPD_DOCUMENT_ROOT_PATH"
82
cp "$TEST_PATH"/passwd "$HTTPD_ROOT_PATH"
83
+ cp "$TEST_PATH"/broken-smart-http.sh "$HTTPD_ROOT_PATH"
84
85
ln -s "$LIB_HTTPD_MODULE_PATH" "$HTTPD_ROOT_PATH/modules"
86
t/lib-httpd/apache.conf
+4
@@ -62,9 +62,13 @@ Alias /auth/dumb/ www/auth/dumb/
62
SetEnv GIT_COMMITTER_EMAIL custom@example.com
63
</LocationMatch>
64
ScriptAliasMatch /smart_*[^/]*/(.*) ${GIT_EXEC_PATH}/git-http-backend/$1
65
+ScriptAlias /broken_smart/ broken-smart-http.sh/
66
<Directory ${GIT_EXEC_PATH}>
67
Options FollowSymlinks
68
</Directory>
69
+<Files broken-smart-http.sh>
70
+ Options ExecCGI
71
+</Files>
72
<Files ${GIT_EXEC_PATH}/git-http-backend>
73
Options ExecCGI
74
</Files>
t/lib-httpd/broken-smart-http.sh
new
+11
@@ -0,0 +1,11 @@
1
+#!/bin/sh
2
+printf "Content-Type: text/%s\n" "html"
3
+echo
4
+printf "%s\n" "001e# service=git-upload-pack"
5
+printf "%s" "0000"
6
+printf "%s%c%s%s\n" \
7
+ "00a58681d9f286a48b08f37b3a095330da16689e3693 HEAD" \
8
+ 0 \
9
+ " include-tag multi_ack_detailed multi_ack ofs-delta" \
10
+ " side-band side-band-64k thin-pack no-progress shallow no-done "
11
+printf "%s" "0000"
t/t5551-http-fetch.sh
+6
@@ -157,6 +157,12 @@ test_expect_success 'GIT_SMART_HTTP can disable smart http' '
157
test_must_fail git fetch)
158
'
159
160
+test_expect_success 'invalid Content-Type rejected' '
161
+ echo "fatal: invalid content-type text/html" >expect
162
+ test_must_fail git clone $HTTPD_URL/broken_smart/repo.git 2>actual
163
+ test_cmp expect actual
164
+'
165
+
166
test -n "$GIT_TEST_LONG" && test_set_prereq EXPENSIVE
167
168
test_expect_success EXPENSIVE 'create 50,000 tags in the repo' '