@matheusbsbs / matheus-bagliano / commits / 49e268e23e
Fork 0

mingw: safeguard better against backslashes in file names

In 224c7d70fa1 (mingw: only test index entries for backslashes, not tree entries, 2019-12-31), we relaxed the check for backslashes in tree entries to check only index entries. However, the code change was incorrect: it was added to `add_index_entry_with_check()`, not to `add_index_entry()`, so under certain circumstances it was possible to side-step the protection. Besides, the description of that commit purported that all index entries would be checked when in fact they were only checked when being added to the index (there are code paths that do not do that, constructing "transient" index entries). In any case, it was pointed out in one insightful review at https://github.com/git-for-windows/git/pull/2437#issuecomment-566771835 that it would be a much better idea to teach `verify_path()` to perform the check for a backslash. This is safer, even if it comes with two notable drawbacks: - `verify_path()` cannot say _what_ is wrong with the path, therefore the user will no longer be told that there was a backslash in the path, only that the path was invalid. - The `git apply` command also calls the `verify_path()` function, and might have been able to handle Windows-style paths (i.e. with backslashes instead of forward slashes). This will no longer be possible unless the user (temporarily) sets `core.protectNTFS=false`. Note that `git add <windows-path>` will _still_ work because `normalize_path_copy_len()` will convert the backslashes to forward slashes before hitting the code path that creates an index entry. The clear advantage is that `verify_path()`'s purpose is to check the validity of the file name, therefore we naturally tap into all the code paths that need safeguarding, also implicitly into future code paths. The benefits of that approach outweigh the downsides, so let's move the check from `add_index_entry_with_check()` to `verify_path()`. Signed-off-by: Johannes Schindelin <johannes.schindelin@gmx.de> Signed-off-by: Junio C Hamano <gitster@pobox.com>

Johannes Schindelin via GitGitGadget committed Jan 9, 2020 at 13:30 UTC 49e268e23e313e8c6b009cd8ebbbaae4316cf6cc
2 files changed +7 -7
read-cache.c
+6 -6
@@ -959,7 +959,7 @@ static int verify_dotfile(const char *rest, unsigned mode)
959
960 int verify_path(const char *path, unsigned mode)
961 {
962 - char c;
962 + char c = 0;
963
964 if (has_dos_drive_prefix(path))
965 return 0;
@@ -974,6 +974,7 @@ int verify_path(const char *path, unsigned mode)
974 if (is_dir_sep(c)) {
975 inside:
976 if (protect_hfs) {
977 +
978 if (is_hfs_dotgit(path))
979 return 0;
980 if (S_ISLNK(mode)) {
@@ -982,6 +983,10 @@ inside:
983 }
984 }
985 if (protect_ntfs) {
986 +#ifdef GIT_WINDOWS_NATIVE
987 + if (c == '\\')
988 + return 0;
989 +#endif
990 if (is_ntfs_dotgit(path))
991 return 0;
992 if (S_ISLNK(mode)) {
@@ -1278,11 +1283,6 @@ static int add_index_entry_with_check(struct index_state *istate, struct cache_e
1283 int skip_df_check = option & ADD_CACHE_SKIP_DFCHECK;
1284 int new_only = option & ADD_CACHE_NEW_ONLY;
1285
1281 -#ifdef GIT_WINDOWS_NATIVE
1282 - if (protect_ntfs && strchr(ce->name, '\\'))
1283 - return error(_("filename in tree entry contains backslash: '%s'"), ce->name);
1284 -#endif
1285 -
1286 if (!(option & ADD_CACHE_KEEP_CACHE_TREE))
1287 cache_tree_invalidate_path(istate, ce->name);
1288
t/t7415-submodule-names.sh
+1 -1
@@ -209,7 +209,7 @@ test_expect_success MINGW 'prevent git~1 squatting on Windows' '
209 hash="$(echo x | git hash-object -w --stdin)" &&
210 test_must_fail git update-index --add \
211 --cacheinfo 160000,$rev,d\\a 2>err &&
212 - test_i18ngrep backslash err &&
212 + test_i18ngrep "Invalid path" err &&
213 git -c core.protectNTFS=false update-index --add \
214 --cacheinfo 100644,$modules,.gitmodules \
215 --cacheinfo 160000,$rev,c \