@matheusbsbs / matheus-bagliano / commits / 9db05711c9

apply --reject: overwrite existing `.rej` symlink if it exists

The `git apply --reject` is expected to write out `.rej` files in case one or more hunks fail to apply cleanly. Historically, the command overwrites any existing `.rej` files. The idea being that apply/reject/edit cycles are relatively common, and the generated `.rej` files are not considered precious. But the command does not overwrite existing `.rej` symbolic links, and instead follows them. This is unsafe because the same patch could potentially create such a symbolic link and point at arbitrary paths outside the current worktree, and `git apply` would write the contents of the `.rej` file into that location. Therefore, let's make sure that any existing `.rej` file or symbolic link is removed before writing it. Reported-by: RyotaK <ryotak.mail@gmail.com> Helped-by: Taylor Blau <me@ttaylorr.com> Helped-by: Junio C Hamano <gitster@pobox.com> Helped-by: Linus Torvalds <torvalds@linuxfoundation.org> Signed-off-by: Johannes Schindelin <johannes.schindelin@gmx.de>

Johannes Schindelin committed Mar 9, 2023 at 16:02 UTC 9db05711c98efc14f414d4c87135a34c13586e0b

2 files changed +27 -2

apply.c

+12 -2

@@ -4558,7 +4558,7 @@ static int write_out_one_reject(struct apply_state *state, struct patch *patch)

4558 FILE *rej;

4559 char namebuf[PATH_MAX];

4560 struct fragment *frag;

4561 - int cnt = 0;

4561 + int fd, cnt = 0;

4562 struct strbuf sb = STRBUF_INIT;

4563

4564 for (cnt = 0, frag = patch->fragments; frag; frag = frag->next) {

@@ -4598,7 +4598,17 @@ static int write_out_one_reject(struct apply_state *state, struct patch *patch)

4598 memcpy(namebuf, patch->new_name, cnt);

4599 memcpy(namebuf + cnt, ".rej", 5);

4600

4601 - rej = fopen(namebuf, "w");

4601 + fd = open(namebuf, O_CREAT | O_EXCL | O_WRONLY, 0666);

4602 + if (fd < 0) {

4603 + if (errno != EEXIST)

4604 + return error_errno(_("cannot open %s"), namebuf);

4605 + if (unlink(namebuf))

4606 + return error_errno(_("cannot unlink '%s'"), namebuf);

4607 + fd = open(namebuf, O_CREAT | O_EXCL | O_WRONLY, 0666);

4608 + if (fd < 0)

4609 + return error_errno(_("cannot open %s"), namebuf);

4610 + }

4611 + rej = fdopen(fd, "w");

4612 if (!rej)

4613 return error_errno(_("cannot open %s"), namebuf);

4614

t/t4115-apply-symlink.sh

+15

@@ -125,4 +125,19 @@ test_expect_success SYMLINKS 'symlink escape when deleting file' '

125 test_path_is_file .git/delete-me

126 '

127

128 +test_expect_success SYMLINKS '--reject removes .rej symlink if it exists' '

129 + test_when_finished "git reset --hard && git clean -dfx" &&

130 +

131 + test_commit file &&

132 + echo modified >file.t &&

133 + git diff -- file.t >patch &&

134 + echo modified-again >file.t &&

135 +

136 + ln -s foo file.t.rej &&

137 + test_must_fail git apply patch --reject 2>err &&

138 + test_i18ngrep "Rejected hunk" err &&

139 + test_path_is_missing foo &&

140 + test_path_is_file file.t.rej

141 +'

142 +

143 test_done