path: safeguard `.git` against NTFS Alternate Streams Accesses

Probably inspired by HFS' resource streams, NTFS supports "Alternate Data Streams": by appending `:<stream-name>` to the file name, information in addition to the file contents can be written and read, information that is copied together with the file (unless copied to a non-NTFS location). These Alternate Data Streams are typically used for things like marking an executable as having just been downloaded from the internet (and hence not necessarily being trustworthy). In addition to a stream name, a stream type can be appended, like so: `:<stream-name>:<stream-type>`. Unless specified, the default stream type is `$DATA` for files and `$INDEX_ALLOCATION` for directories. In other words, `.git::$INDEX_ALLOCATION` is a valid way to reference the `.git` directory! In our work in Git v2.2.1 to protect Git on NTFS drives under `core.protectNTFS`, we focused exclusively on NTFS short names, unaware of the fact that NTFS Alternate Data Streams offer a similar attack vector. Let's fix this. Seeing as it is better to be safe than sorry, we simply disallow paths referring to *any* NTFS Alternate Data Stream of `.git`, not just `::$INDEX_ALLOCATION`. This also simplifies the implementation. This closes CVE-2019-1352. Further reading about NTFS Alternate Data Streams: https://docs.microsoft.com/en-us/openspecs/windows_protocols/ms-fscc/c54dec26-1551-4d3a-a0ea-4fa40f848eb3 Reported-by: Nicolas Joly <Nicolas.Joly@microsoft.com> Signed-off-by: Johannes Schindelin <johannes.schindelin@gmx.de>

Johannes Schindelin committed Aug 28, 2019 at 12:22 UTC 7c3745fc6185495d5765628b4dfe1bd2c25a2981

2 files changed +12 -1

path.c

+11 -1

@@ -1321,10 +1321,19 @@ static int only_spaces_and_periods(const char *path, size_t len, size_t skip)

1321 * `.git` is the first item in a directory, therefore it will be associated

1322 * with the short name `git~1` (unless short names are disabled).

1323 *

1324 + * - For yet other historical reasons, NTFS supports so-called "Alternate Data

1325 + * Streams", i.e. metadata associated with a given file, referred to via

1326 + * `<filename>:<stream-name>:<stream-type>`. There exists a default stream

1327 + * type for directories, allowing `.git/` to be accessed via

1328 + * `.git::$INDEX_ALLOCATION/`.

1329 + *

1330 * When this function returns 1, it indicates that the specified file/directory

1331 * name refers to a `.git` file or directory, or to any of these synonyms, and

1332 * Git should therefore not track it.

1333 *

1334 + * For performance reasons, _all_ Alternate Data Streams of `.git/` are

1335 + * forbidden, not just `::$INDEX_ALLOCATION`.

1336 + *

1337 * This function is intended to be used by `git fsck` even on platforms where

1338 * the backslash is a regular filename character, therefore it needs to handle

1339 * backlash characters in the provided `name` specially: they are interpreted

@@ -1335,7 +1344,8 @@ int is_ntfs_dotgit(const char *name)

1344 size_t len;

1345

1346 for (len = 0; ; len++)

1338 - if (!name[len] || name[len] == '\\' || is_dir_sep(name[len])) {

1347 + if (!name[len] || name[len] == '\\' || is_dir_sep(name[len]) ||

1348 + name[len] == ':') {

1349 if (only_spaces_and_periods(name, len, 4) &&

1350 !strncasecmp(name, ".git", 4))

1351 return 1;

t/t1014-read-tree-confusing.sh

@@ -49,6 +49,7 @@ git~1

49 .git.SPACE .git.{space}

50 .\\\\.GIT\\\\foobar backslashes

51 .git\\\\foobar backslashes2

52 +.git...:alternate-stream

53 EOF

55 test_expect_success 'utf-8 paths allowed with core.protectHFS off' '