path: also guard `.gitmodules` against NTFS Alternate Data Streams
We just safe-guarded `.git` against NTFS Alternate Data Stream-related attack vectors, and now it is time to do the same for `.gitmodules`. Note: In the added regression test, we refrain from verifying all kinds of variations between short names and NTFS Alternate Data Streams: as the new code disallows _all_ Alternate Data Streams of `.gitmodules`, it is enough to test one in order to know that all of them are guarded against. Signed-off-by: Johannes Schindelin <johannes.schindelin@gmx.de>
Johannes Schindelin committed
Aug 28, 2019 at 12:22 UTC
91bd46588e6959e6903e275f78b10bd07830d547
2 files changed
+7
-2
path.c
+1
-1
@@ -1369,7 +1369,7 @@ static int is_ntfs_dot_generic(const char *name,
1369
only_spaces_and_periods:
1370
for (;;) {
1371
char c = name[i++];
1372
- if (!c)
1372
+ if (!c || c == ':')
1373
return 1;
1374
if (c != ' ' && c != '.')
1375
return 0;
t/t0060-path-utils.sh
+6
-1
@@ -408,6 +408,9 @@ test_expect_success 'match .gitmodules' '
408
~1000000 \
409
~9999999 \
410
\
411
+ .gitmodules:\$DATA \
412
+ "gitmod~4 . :\$DATA" \
413
+ \
414
--not \
415
".gitmodules x" \
416
".gitmodules .x" \
@@ -432,7 +435,9 @@ test_expect_success 'match .gitmodules' '
435
\
436
GI7EB~1 \
437
GI7EB~01 \
435
- GI7EB~1X
438
+ GI7EB~1X \
439
+ \
440
+ .gitmodules,:\$DATA
441
'
442
443
test_done