t7406: submodule.<name>.update command must not be run from .gitmodules
submodule.<name>.update can be assigned an arbitrary command via setting it to "!command". When this command is found in the regular config, Git ought to just run that command instead of other update mechanisms. However if that command is just found in the .gitmodules file, it is potentially untrusted, which is why we do not run it. Add a test confirming the behavior. Suggested-by: Jonathan Nieder <jrnieder@gmail.com> Signed-off-by: Stefan Beller <sbeller@google.com> Signed-off-by: Junio C Hamano <gitster@pobox.com>
Stefan Beller committed
Sep 26, 2017 at 12:54 UTC
83a17fa83b24ed713e2c2647bf89dae171971b73
1 file changed
+8
t/t7406-submodule-update.sh
+8
@@ -406,6 +406,14 @@ test_expect_success 'submodule update - command in .git/config' '
406
)
407
'
408
409
+test_expect_success 'submodule update - command in .gitmodules is ignored' '
410
+ test_when_finished "git -C super reset --hard HEAD^" &&
411
+ git -C super config -f .gitmodules submodule.submodule.update "!false" &&
412
+ git -C super commit -a -m "add command to .gitmodules file" &&
413
+ git -C super/submodule reset --hard $submodulesha1^ &&
414
+ git -C super submodule update submodule
415
+'
416
+
417
cat << EOF >expect
418
Execution of 'false $submodulesha1' failed in submodule path 'submodule'
419
EOF