@matheusbsbs / matheus-bagliano / commits / 9a42c03cb7

shell: drop git-cvsserver support by default

The git-cvsserver script is old and largely unmaintained these days. But git-shell allows untrusted users to run it out of the box, significantly increasing its attack surface. Let's drop it from git-shell's list of internal handlers so that it cannot be run by default. This is not backwards compatible. But given the age and development activity on CVS-related parts of Git, this is likely to impact very few users, while helping many more (i.e., anybody who runs git-shell and had no intention of supporting CVS). There's no configuration mechanism in git-shell for us to add a boolean and flip it to "off". But there is a mechanism for adding custom commands, and adding CVS support here is fairly trivial. Let's document it to give guidance to anybody who really is still running cvsserver. Signed-off-by: Jeff King <peff@peff.net> Signed-off-by: Junio C Hamano <gitster@pobox.com>

Jeff King committed Sep 11, 2017 at 11:27 UTC 9a42c03cb71eaa9d41ba67275de38c997a791c32
3 files changed +64 -14
Documentation/git-shell.txt
+16
@@ -79,6 +79,22 @@ EOF
79 $ chmod +x $HOME/git-shell-commands/no-interactive-login
80 ----------------
81
82 +To enable git-cvsserver access (which should generally have the
83 +`no-interactive-login` example above as a prerequisite, as creating
84 +the git-shell-commands directory allows interactive logins):
85 +
86 +----------------
87 +$ cat >$HOME/git-shell-commands/cvs <<\EOF
88 +if ! test $# = 1 && test "$1" = "server"
89 +then
90 + echo >&2 "git-cvsserver only handles \"server\""
91 + exit 1
92 +fi
93 +exec git cvsserver server
94 +EOF
95 +$ chmod +x $HOME/git-shell-commands/cvs
96 +----------------
97 +
98 SEE ALSO
99 --------
100 ssh(1),
shell.c
-14
@@ -25,19 +25,6 @@ static int do_generic_cmd(const char *me, char *arg)
25 return execv_git_cmd(my_argv);
26 }
27
28 -static int do_cvs_cmd(const char *me, char *arg)
29 -{
30 - const char *cvsserver_argv[3] = {
31 - "cvsserver", "server", NULL
32 - };
33 -
34 - if (!arg || strcmp(arg, "server"))
35 - die("git-cvsserver only handles server: %s", arg);
36 -
37 - setup_path();
38 - return execv_git_cmd(cvsserver_argv);
39 -}
40 -
28 static int is_valid_cmd_name(const char *cmd)
29 {
30 /* Test command contains no . or / characters */
@@ -134,7 +121,6 @@ static struct commands {
121 { "git-receive-pack", do_generic_cmd },
122 { "git-upload-pack", do_generic_cmd },
123 { "git-upload-archive", do_generic_cmd },
137 - { "cvs", do_cvs_cmd },
124 { NULL },
125 };
126
t/t9400-git-cvsserver-server.sh
+48
@@ -588,4 +588,52 @@ test_expect_success 'cvs annotate' '
588 test_cmp ../expect ../actual
589 '
590
591 +#------------
592 +# running via git-shell
593 +#------------
594 +
595 +cd "$WORKDIR"
596 +
597 +test_expect_success 'create remote-cvs helper' '
598 + write_script remote-cvs <<-\EOF
599 + exec git shell -c "cvs server"
600 + EOF
601 +'
602 +
603 +test_expect_success 'cvs server does not run with vanilla git-shell' '
604 + (
605 + cd cvswork &&
606 + CVS_SERVER=$WORKDIR/remote-cvs &&
607 + export CVS_SERVER &&
608 + test_must_fail cvs log merge
609 + )
610 +'
611 +
612 +test_expect_success 'configure git shell to run cvs server' '
613 + mkdir "$HOME"/git-shell-commands &&
614 +
615 + write_script "$HOME"/git-shell-commands/cvs <<-\EOF &&
616 + if ! test $# = 1 && test "$1" = "server"
617 + then
618 + echo >&2 "git-cvsserver only handles \"server\""
619 + exit 1
620 + fi
621 + exec git cvsserver server
622 + EOF
623 +
624 + # Should not be used, but part of the recommended setup
625 + write_script "$HOME"/git-shell-commands/no-interactive-login <<-\EOF
626 + echo Interactive login forbidden
627 + EOF
628 +'
629 +
630 +test_expect_success 'cvs server can run with recommended config' '
631 + (
632 + cd cvswork &&
633 + CVS_SERVER=$WORKDIR/remote-cvs &&
634 + export CVS_SERVER &&
635 + cvs log merge
636 + )
637 +'
638 +
639 test_done