fsck: reject submodule.update = !command in .gitmodules
This allows hosting providers to detect whether they are being used to attack users using malicious 'update = !command' settings in .gitmodules. Since ac1fbbda2013 (submodule: do not copy unknown update mode from .gitmodules, 2013-12-02), in normal cases such settings have been treated as 'update = none', so forbidding them should not produce any collateral damage to legitimate uses. A quick search does not reveal any repositories making use of this construct, either. Reported-by: Joern Schneeweisz <jschneeweisz@gitlab.com> Signed-off-by: Jonathan Nieder <jrnieder@gmail.com> Signed-off-by: Johannes Schindelin <johannes.schindelin@gmx.de>
Jonathan Nieder committed
Dec 5, 2019 at 01:30 UTC
bb92255ebe6bccd76227e023d6d0bc997e318ad0
2 files changed
+21
fsck.c
+7
@@ -66,6 +66,7 @@ static struct oidset gitmodules_done = OIDSET_INIT;
66
FUNC(GITMODULES_SYMLINK, ERROR) \
67
FUNC(GITMODULES_URL, ERROR) \
68
FUNC(GITMODULES_PATH, ERROR) \
69
+ FUNC(GITMODULES_UPDATE, ERROR) \
70
/* warnings */ \
71
FUNC(BAD_FILEMODE, WARN) \
72
FUNC(EMPTY_NAME, WARN) \
@@ -975,6 +976,12 @@ static int fsck_gitmodules_fn(const char *var, const char *value, void *vdata)
976
FSCK_MSG_GITMODULES_PATH,
977
"disallowed submodule path: %s",
978
value);
979
+ if (!strcmp(key, "update") && value &&
980
+ parse_submodule_update_type(value) == SM_UPDATE_COMMAND)
981
+ data->ret |= report(data->options, data->obj,
982
+ FSCK_MSG_GITMODULES_UPDATE,
983
+ "disallowed submodule update setting: %s",
984
+ value);
985
free(name);
986
987
return 0;
t/t7406-submodule-update.sh
+14
@@ -414,6 +414,20 @@ test_expect_success 'submodule update - command in .gitmodules is rejected' '
414
test_must_fail git -C super submodule update submodule
415
'
416
417
+test_expect_success 'fsck detects command in .gitmodules' '
418
+ git init command-in-gitmodules &&
419
+ (
420
+ cd command-in-gitmodules &&
421
+ git submodule add ../submodule submodule &&
422
+ test_commit adding-submodule &&
423
+
424
+ git config -f .gitmodules submodule.submodule.update "!false" &&
425
+ git add .gitmodules &&
426
+ test_commit configuring-update &&
427
+ test_must_fail git fsck
428
+ )
429
+'
430
+
431
cat << EOF >expect
432
Execution of 'false $submodulesha1' failed in submodule path 'submodule'
433
EOF