read_raw_ref(): improve docstring
Among other things, document the (important!) requirement that input refname be checked for safety before calling this function. Signed-off-by: Michael Haggerty <mhagger@alum.mit.edu>
Michael Haggerty committed
Apr 24, 2016 at 08:10 UTC
bb462b00286902f6cdbb66bb418c59b5c7894e0d
1 file changed
+24
-17
refs/files-backend.c
+24
-17
@@ -1389,33 +1389,40 @@ static int resolve_missing_loose_ref(const char *refname,
1389
}
1390
1391
/*
1392
- * Read a raw ref from the filesystem or packed refs file.
1392
+ * Read the specified reference from the filesystem or packed refs
1393
+ * file, non-recursively. Set type to describe the reference, and:
1394
*
1394
- * If the ref is a sha1, fill in sha1 and return 0.
1395
+ * - If refname is the name of a normal reference, fill in sha1
1396
+ * (leaving referent unchanged).
1397
*
1396
- * If the ref is symbolic, fill in *referent with the name of the
1397
- * branch to which it refers (e.g. "refs/heads/master") and return 0.
1398
- * The caller is responsible for validating the referent. Set
1399
- * REF_ISSYMREF in type.
1398
+ * - If refname is the name of a symbolic reference, write the full
1399
+ * name of the reference to which it refers (e.g.
1400
+ * "refs/heads/master") to referent and set the REF_ISSYMREF bit in
1401
+ * type (leaving sha1 unchanged). The caller is responsible for
1402
+ * validating that referent is a valid reference name.
1403
*
1401
- * If the ref doesn't exist, set errno to ENOENT and return -1.
1404
+ * WARNING: refname might be used as part of a filename, so it is
1405
+ * important from a security standpoint that it be safe in the sense
1406
+ * of refname_is_safe(). Moreover, for symrefs this function sets
1407
+ * referent to whatever the repository says, which might not be a
1408
+ * properly-formatted or even safe reference name. NEITHER INPUT NOR
1409
+ * OUTPUT REFERENCE NAMES ARE VALIDATED WITHIN THIS FUNCTION.
1410
*
1403
- * If the ref exists but is neither a symbolic ref nor a sha1, it is
1404
- * broken. Set REF_ISBROKEN in type, set errno to EINVAL, and return
1405
- * -1.
1406
- *
1407
- * If there is another error reading the ref, set errno appropriately and
1408
- * return -1.
1411
+ * Return 0 on success. If the ref doesn't exist, set errno to ENOENT
1412
+ * and return -1. If the ref exists but is neither a symbolic ref nor
1413
+ * a sha1, it is broken; set REF_ISBROKEN in type, set errno to
1414
+ * EINVAL, and return -1. If there is another error reading the ref,
1415
+ * set errno appropriately and return -1.
1416
*
1417
* Backend-specific flags might be set in type as well, regardless of
1418
* outcome.
1419
*
1413
- * sb_path is workspace: the caller should allocate and free it.
1420
+ * It is OK for refname to point into referent. If so:
1421
*
1415
- * It is OK for refname to point into referent. In this case:
1422
* - if the function succeeds with REF_ISSYMREF, referent will be
1417
- * overwritten and the memory pointed to by refname might be changed
1418
- * or even freed.
1423
+ * overwritten and the memory formerly pointed to by it might be
1424
+ * changed or even freed.
1425
+ *
1426
* - in all other cases, referent will be untouched, and therefore
1427
* refname will still be valid and unchanged.
1428
*/