connect: reject paths that look like command line options
If we get a repo path like "-repo.git", we may try to invoke "git-upload-pack -repo.git". This is going to fail, since upload-pack will interpret it as a set of bogus options. But let's reject this before we even run the sub-program, since we would not want to allow any mischief with repo names that actually are real command-line options. You can still ask for such a path via git-daemon, but there's no security problem there, because git-daemon enters the repo itself and then passes "." on the command line. Signed-off-by: Jeff King <peff@peff.net> Reviewed-by: Jonathan Nieder <jrnieder@gmail.com> Signed-off-by: Junio C Hamano <gitster@pobox.com>
Jeff King committed
Jul 28, 2017 at 15:28 UTC
aeeb2d496859419ac1ba1da1162d6f3610f7f1f3
3 files changed
+40
connect.c
+3
@@ -727,6 +727,9 @@ struct child_process *git_connect(int fd[2], const char *url,
727
conn = xmalloc(sizeof(*conn));
728
child_process_init(conn);
729
730
+ if (looks_like_command_line_option(path))
731
+ die("strange pathname '%s' blocked", path);
732
+
733
strbuf_addstr(&cmd, prog);
734
strbuf_addch(&cmd, ' ');
735
sq_quote_buf(&cmd, path);
t/t5810-proto-disable-local.sh
+23
@@ -11,4 +11,27 @@ test_expect_success 'setup repository to clone' '
11
test_proto "file://" file "file://$PWD"
12
test_proto "path" file .
13
14
+test_expect_success 'setup repo with dash' '
15
+ git init --bare repo.git &&
16
+ git push repo.git HEAD &&
17
+ mv repo.git "$PWD/-repo.git"
18
+'
19
+
20
+# This will fail even without our rejection because upload-pack will
21
+# complain about the bogus option. So let's make sure that GIT_TRACE
22
+# doesn't show us even running upload-pack.
23
+#
24
+# We must also be sure to use "fetch" and not "clone" here, as the latter
25
+# actually canonicalizes our input into an absolute path (which is fine
26
+# to allow).
27
+test_expect_success 'repo names starting with dash are rejected' '
28
+ rm -f trace.out &&
29
+ test_must_fail env GIT_TRACE="$PWD/trace.out" git fetch -- -repo.git &&
30
+ ! grep upload-pack trace.out
31
+'
32
+
33
+test_expect_success 'full paths still work' '
34
+ git fetch "$PWD/-repo.git"
35
+'
36
+
37
test_done
t/t5813-proto-disable-ssh.sh
+14
@@ -26,4 +26,18 @@ test_expect_success 'hostnames starting with dash are rejected' '
26
! grep ^ssh: stderr
27
'
28
29
+test_expect_success 'setup repo with dash' '
30
+ git init --bare remote/-repo.git &&
31
+ git push remote/-repo.git HEAD
32
+'
33
+
34
+test_expect_success 'repo names starting with dash are rejected' '
35
+ test_must_fail git clone remote:-repo.git dash-path 2>stderr &&
36
+ ! grep ^ssh: stderr
37
+'
38
+
39
+test_expect_success 'full paths still work' '
40
+ git clone "remote:$PWD/remote/-repo.git" dash-path
41
+'
42
+
43
test_done