safe.directory: use git_protected_config()
Use git_protected_config() to read `safe.directory` instead of read_very_early_config(), making it 'protected configuration only'. As a result, `safe.directory` now respects "-c", so update the tests and docs accordingly. It used to ignore "-c" due to how it was implemented, not because of security or correctness concerns [1]. [1] https://lore.kernel.org/git/xmqqlevabcsu.fsf@gitster.g/ Signed-off-by: Glen Choo <chooglen@google.com> Signed-off-by: Junio C Hamano <gitster@pobox.com>
Glen Choo committed
Jul 14, 2022 at 21:28 UTC
6061601d9f1f1c95da5f9304c319218f7cc3ec75
3 files changed
+14
-18
Documentation/config/safe.txt
+3
-3
@@ -12,9 +12,9 @@ via `git config --add`. To reset the list of safe directories (e.g. to
12
override any such directories specified in the system config), add a
13
`safe.directory` entry with an empty value.
14
+
15
-This config setting is only respected when specified in a system or global
16
-config, not when it is specified in a repository config, via the command
17
-line option `-c safe.directory=<path>`, or in environment variables.
15
+This config setting is only respected in protected configuration (see
16
+<<SCOPES>>). This prevents the untrusted repository from tampering with this
17
+value.
18
+
19
The value of this setting is interpolated, i.e. `~/<path>` expands to a
20
path relative to the home directory and `%(prefix)/<path>` expands to a
setup.c
+1
-1
@@ -1155,7 +1155,7 @@ static int ensure_valid_ownership(const char *gitfile,
1155
* constant regardless of what failed above. data.is_safe should be
1156
* initialized to false, and might be changed by the callback.
1157
*/
1158
- read_very_early_config(safe_directory_cb, &data);
1158
+ git_protected_config(safe_directory_cb, &data);
1159
1160
return data.is_safe;
1161
}
t/t0033-safe-directory.sh
+10
-14
@@ -16,24 +16,20 @@ test_expect_success 'safe.directory is not set' '
16
expect_rejected_dir
17
'
18
19
-test_expect_success 'ignoring safe.directory on the command line' '
20
- test_must_fail git -c safe.directory="$(pwd)" status 2>err &&
21
- grep "dubious ownership" err
19
+test_expect_success 'safe.directory on the command line' '
20
+ git -c safe.directory="$(pwd)" status
21
'
22
24
-test_expect_success 'ignoring safe.directory in the environment' '
25
- test_must_fail env GIT_CONFIG_COUNT=1 \
26
- GIT_CONFIG_KEY_0="safe.directory" \
27
- GIT_CONFIG_VALUE_0="$(pwd)" \
28
- git status 2>err &&
29
- grep "dubious ownership" err
23
+test_expect_success 'safe.directory in the environment' '
24
+ env GIT_CONFIG_COUNT=1 \
25
+ GIT_CONFIG_KEY_0="safe.directory" \
26
+ GIT_CONFIG_VALUE_0="$(pwd)" \
27
+ git status
28
'
29
32
-test_expect_success 'ignoring safe.directory in GIT_CONFIG_PARAMETERS' '
33
- test_must_fail env \
34
- GIT_CONFIG_PARAMETERS="${SQ}safe.directory${SQ}=${SQ}$(pwd)${SQ}" \
35
- git status 2>err &&
36
- grep "dubious ownership" err
30
+test_expect_success 'safe.directory in GIT_CONFIG_PARAMETERS' '
31
+ env GIT_CONFIG_PARAMETERS="${SQ}safe.directory${SQ}=${SQ}$(pwd)${SQ}" \
32
+ git status
33
'
34
35
test_expect_success 'ignoring safe.directory in repo config' '