@matheusbsbs / matheus-bagliano / commits / 90dce21eb0

remote-curl: unquote incoming push-options

The transport-helper protocol c-style quotes the value of any options passed to the helper via the "option <key> <value>" directive. However, remote-curl doesn't actually unquote the push-option values, meaning that we will send the quoted version to the other side (whereas git-over-ssh would send the raw value). The pack-protocol.txt documentation defines the push-options as a series of VCHARs, which excludes most characters that would need quoting. But: 1. You can still see the bug with a valid push-option that starts with a double-quote (since that triggers quoting). 2. We do currently handle any non-NUL characters correctly in git-over-ssh. So even though the spec does not say that we need to handle most quoted characters, it's nice if our behavior is consistent between protocols. There are two new tests: the "direct" one shows that this already works in the non-http case, and the http one covers this bugfix. Reported-by: Jon Simons <jon@jonsimons.org> Signed-off-by: Jeff King <peff@peff.net> Signed-off-by: Junio C Hamano <gitster@pobox.com>

Jeff King committed Feb 19, 2018 at 14:50 UTC 90dce21eb0fcf28096e661a3dd3b4e93fa0bccb5

2 files changed +28 -1

remote-curl.c

+10 -1

@@ -13,6 +13,7 @@

13 #include "credential.h"

14 #include "sha1-array.h"

15 #include "send-pack.h"

16 +#include "quote.h"

18 static struct remote *remote;

19 /* always ends with a trailing slash */

@@ -142,7 +143,15 @@ static int set_option(const char *name, const char *value)

143 return -1;

144 return 0;

145 } else if (!strcmp(name, "push-option")) {

145 - string_list_append(&options.push_options, value);

146 + if (*value != '"')

147 + string_list_append(&options.push_options, value);

148 + else {

149 + struct strbuf unquoted = STRBUF_INIT;

150 + if (unquote_c_style(&unquoted, value, NULL) < 0)

151 + die("invalid quoting in push-option value");

152 + string_list_append_nodup(&options.push_options,

153 + strbuf_detach(&unquoted, NULL));

154 + }

155 return 0;

156

157 #if LIBCURL_VERSION_NUM >= 0x070a08

t/t5545-push-options.sh

+18

@@ -217,6 +217,15 @@ test_expect_success 'invalid push option in config' '

217 test_refs master HEAD@{1}

218 '

219

220 +test_expect_success 'push options keep quoted characters intact (direct)' '

221 + mk_repo_pair &&

222 + git -C upstream config receive.advertisePushOptions true &&

223 + test_commit -C workbench one &&

224 + git -C workbench push --push-option="\"embedded quotes\"" up master &&

225 + echo "\"embedded quotes\"" >expect &&

226 + test_cmp expect upstream/.git/hooks/pre-receive.push_options

227 +'

228 +

229 . "$TEST_DIRECTORY"/lib-httpd.sh

230 start_httpd

231

@@ -260,6 +269,15 @@ test_expect_success 'push options work properly across http' '

269 test_cmp expect actual

270 '

271

272 +test_expect_success 'push options keep quoted characters intact (http)' '

273 + mk_http_pair true &&

274 +

275 + test_commit -C test_http_clone one &&

276 + git -C test_http_clone push --push-option="\"embedded quotes\"" origin master &&

277 + echo "\"embedded quotes\"" >expect &&

278 + test_cmp expect "$HTTPD_DOCUMENT_ROOT_PATH"/upstream.git/hooks/pre-receive.push_options

279 +'

280 +

281 stop_httpd

282

283 test_done