fast-import: disallow "feature import-marks" by default
As with export-marks in the previous commit, import-marks can access the filesystem. This is significantly less dangerous than export-marks because it only involves reading from arbitrary paths, rather than writing them. However, it could still be surprising and have security implications (e.g., exfiltrating data from a service that accepts fast-import streams). Let's lump it (and its "if-exists" counterpart) in with export-marks, and enable the in-stream version only if --allow-unsafe-features is set. Signed-off-by: Jeff King <peff@peff.net>
Jeff King committed
Aug 29, 2019 at 15:08 UTC
a52ed76142f6e8d993bb4c50938a408966eb2b7c
3 files changed
+21
-6
Documentation/git-fast-import.txt
+2
-1
@@ -57,7 +57,8 @@ OPTIONS
57
allowing fast-import to access the filesystem outside of the
58
repository). These options are disabled by default, but can be
59
allowed by providing this option on the command line. This
60
- currently impacts only the `feature export-marks` command.
60
+ currently impacts only the `export-marks`, `import-marks`, and
61
+ `import-marks-if-exists` feature commands.
62
+
63
Only enable this option if you trust the program generating the
64
fast-import stream! This option is enabled automatically for
fast-import.c
+2
@@ -3344,8 +3344,10 @@ static int parse_one_feature(const char *feature, int from_stream)
3344
if (skip_prefix(feature, "date-format=", &arg)) {
3345
option_date_format(arg);
3346
} else if (skip_prefix(feature, "import-marks=", &arg)) {
3347
+ check_unsafe_feature("import-marks", from_stream);
3348
option_import_marks(arg, from_stream, 0);
3349
} else if (skip_prefix(feature, "import-marks-if-exists=", &arg)) {
3350
+ check_unsafe_feature("import-marks-if-exists", from_stream);
3351
option_import_marks(arg, from_stream, 1);
3352
} else if (skip_prefix(feature, "export-marks=", &arg)) {
3353
check_unsafe_feature(feature, from_stream);
t/t9300-fast-import.sh
+17
-5
@@ -2106,6 +2106,14 @@ test_expect_success 'R: abort on receiving feature after data command' '
2106
test_must_fail git fast-import <input
2107
'
2108
2109
+test_expect_success 'R: import-marks features forbidden by default' '
2110
+ >git.marks &&
2111
+ echo "feature import-marks=git.marks" >input &&
2112
+ test_must_fail git fast-import <input &&
2113
+ echo "feature import-marks-if-exists=git.marks" >input &&
2114
+ test_must_fail git fast-import <input
2115
+'
2116
+
2117
test_expect_success 'R: only one import-marks feature allowed per stream' '
2118
>git.marks &&
2119
>git2.marks &&
@@ -2114,7 +2122,7 @@ test_expect_success 'R: only one import-marks feature allowed per stream' '
2122
feature import-marks=git2.marks
2123
EOF
2124
2117
- test_must_fail git fast-import <input
2125
+ test_must_fail git fast-import --allow-unsafe-features <input
2126
'
2127
2128
test_expect_success 'R: export-marks feature forbidden by default' '
@@ -2210,7 +2218,8 @@ test_expect_success 'R: feature import-marks-if-exists' '
2218
rm -f io.marks &&
2219
>expect &&
2220
2213
- git fast-import --export-marks=io.marks <<-\EOF &&
2221
+ git fast-import --export-marks=io.marks \
2222
+ --allow-unsafe-features <<-\EOF &&
2223
feature import-marks-if-exists=not_io.marks
2224
EOF
2225
test_cmp expect io.marks &&
@@ -2221,7 +2230,8 @@ test_expect_success 'R: feature import-marks-if-exists' '
2230
echo ":1 $blob" >expect &&
2231
echo ":2 $blob" >>expect &&
2232
2224
- git fast-import --export-marks=io.marks <<-\EOF &&
2233
+ git fast-import --export-marks=io.marks \
2234
+ --allow-unsafe-features <<-\EOF &&
2235
feature import-marks-if-exists=io.marks
2236
blob
2237
mark :2
@@ -2234,7 +2244,8 @@ test_expect_success 'R: feature import-marks-if-exists' '
2244
echo ":3 $blob" >>expect &&
2245
2246
git fast-import --import-marks=io.marks \
2237
- --export-marks=io.marks <<-\EOF &&
2247
+ --export-marks=io.marks \
2248
+ --allow-unsafe-features <<-\EOF &&
2249
feature import-marks-if-exists=not_io.marks
2250
blob
2251
mark :3
@@ -2247,7 +2258,8 @@ test_expect_success 'R: feature import-marks-if-exists' '
2258
>expect &&
2259
2260
git fast-import --import-marks-if-exists=not_io.marks \
2250
- --export-marks=io.marks <<-\EOF &&
2261
+ --export-marks=io.marks \
2262
+ --allow-unsafe-features <<-\EOF &&
2263
feature import-marks-if-exists=io.marks
2264
EOF
2265
test_cmp expect io.marks