@matheusbsbs / matheus-bagliano / commits / 7671b63211

add uploadarchive.allowUnreachable option

In commit ee27ca4, we started restricting remote git-archive invocations to only accessing reachable commits. This matches what upload-pack allows, but does restrict some useful cases (e.g., HEAD:foo). We loosened this in 0f544ee, which allows `foo:bar` as long as `foo` is a ref tip. However, that still doesn't allow many useful things, like: 1. Commits accessible from a ref, like `foo^:bar`, which are reachable 2. Arbitrary sha1s, even if they are reachable. We can do a full object-reachability check for these cases, but it can be quite expensive if the client has sent us the sha1 of a tree; we have to visit every sub-tree of every commit in the worst case. Let's instead give site admins an escape hatch, in case they prefer the more liberal behavior. For many sites, the full object database is public anyway (e.g., if you allow dumb walker access), or the site admin may simply decide the security/convenience tradeoff is not worth it. This patch adds a new config option to disable the restrictions added in ee27ca4. It defaults to off, meaning there is no change in behavior by default. Signed-off-by: Jeff King <peff@peff.net> Signed-off-by: Junio C Hamano <gitster@pobox.com>

Scott J. Goldman committed Feb 28, 2014 at 05:04 UTC 7671b63211712e5163ed46d4c93d0b75680c886c

4 files changed +33 -2

Documentation/config.txt

@@ -2291,6 +2291,13 @@ transfer.unpackLimit::

2291 not set, the value of this variable is used instead.

2292 The default value is 100.

2293

2294 +uploadarchive.allowUnreachable::

2295 + If true, allow clients to use `git archive --remote` to request

2296 + any tree, whether reachable from the ref tips or not. See the

2297 + discussion in the `SECURITY` section of

2298 + linkgit:git-upload-archive[1] for more details. Defaults to

2299 + `false`.

2300 +

2301 uploadpack.hiderefs::

2302 String(s) `upload-pack` uses to decide which refs to omit

2303 from its initial advertisement. Use more than one

Documentation/git-upload-archive.txt

@@ -46,6 +46,12 @@ implications. These rules are subject to change in future versions of

46 git, and the server accessed by `git archive --remote` may or may not

47 follow these exact rules.

49 +If the config option `uploadArchive.allowUnreachable` is true, these

50 +rules are ignored, and clients may use arbitrary sha1 expressions.

51 +This is useful if you do not care about the privacy of unreachable

52 +objects, or if your object database is already publicly available for

53 +access via non-smart-http.

54 +

55 OPTIONS

56 -------

57 <directory>::

archive.c

+11 -2

@@ -17,6 +17,7 @@ static char const * const archive_usage[] = {

17 static const struct archiver **archivers;

18 static int nr_archivers;

19 static int alloc_archivers;

20 +static int remote_allow_unreachable;

22 void register_archiver(struct archiver *ar)

23 {

@@ -257,7 +258,7 @@ static void parse_treeish_arg(const char **argv,

258 unsigned char sha1[20];

259

260 /* Remotes are only allowed to fetch actual refs */

260 - if (remote) {

261 + if (remote && !remote_allow_unreachable) {

262 char *ref = NULL;

263 const char *colon = strchr(name, ':');

264 int refnamelen = colon ? colon - name : strlen(name);

@@ -401,6 +402,14 @@ static int parse_archive_args(int argc, const char **argv,

402 return argc;

403 }

404

405 +static int git_default_archive_config(const char *var, const char *value,

406 + void *cb)

407 +{

408 + if (!strcmp(var, "uploadarchive.allowunreachable"))

409 + remote_allow_unreachable = git_config_bool(var, value);

410 + return git_default_config(var, value, cb);

411 +}

412 +

413 int write_archive(int argc, const char **argv, const char *prefix,

414 int setup_prefix, const char *name_hint, int remote)

415 {

@@ -411,7 +420,7 @@ int write_archive(int argc, const char **argv, const char *prefix,

420 if (setup_prefix && prefix == NULL)

421 prefix = setup_git_directory_gently(&nongit);

422

414 - git_config(git_default_config, NULL);

423 + git_config(git_default_archive_config, NULL);

424 init_tar_archiver();

425 init_zip_archiver();

426

t/t5000-tar-tree.sh

@@ -213,6 +213,15 @@ test_expect_success 'clients cannot access unreachable commits' '

213 test_must_fail git archive --remote=. $sha1 >remote.tar

214 '

215

216 +test_expect_success 'upload-archive can allow unreachable commits' '

217 + test_commit unreachable1 &&

218 + sha1=`git rev-parse HEAD` &&

219 + git reset --hard HEAD^ &&

220 + git archive $sha1 >remote.tar &&

221 + test_config uploadarchive.allowUnreachable true &&

222 + git archive --remote=. $sha1 >remote.tar

223 +'

224 +

225 test_expect_success 'setup tar filters' '

226 git config tar.tar.foo.command "tr ab ba" &&

227 git config tar.bar.command "tr ab ba" &&