@matheusbsbs / matheus-bagliano / commits / cd85b447bf
Fork 0

remote-curl: make --force-with-lease work with non-ASCII ref names

When we invoke a remote transport helper and pass an option with an argument, we quote the argument as a C-style string if necessary. This is the case for the cas option, which implements the --force-with-lease command-line flag, when we're passing a non-ASCII refname. However, the remote curl helper isn't designed to parse such an argument, meaning that if we try to use --force-with-lease with an HTTP push and a non-ASCII refname, we get an error like this: error: cannot parse expected object name '0000000000000000000000000000000000000000"' Note the double quote, which get_oid has reminded us is not valid in an hex object ID. Even if we had been able to parse it, we would send the wrong data to the server: we'd send an escaped ref, which would not behave as the user wanted and might accidentally result in updating or deleting a ref we hadn't intended. Since we need to expect a quoted C-style string here, just check if the first argument is a double quote, and if so, unquote it. Note that if the refname contains a double quote, then we will have double-quoted it already, so there is no ambiguity. We test for this case only in the smart protocol, since the DAV-based protocol is not capable of handling this capability. We use UTF-8 because this is nicer in our tests and friendlier to Windows, but the code should work for all non-ASCII refs. While we're at it, since the name of the option is now well established and isn't going to change, let's inline it instead of using the #define constant. Reported-by: Frej Bjon <frej.bjon@nemit.fi> Signed-off-by: brian m. carlson <sandals@crustytoothpaste.net> Signed-off-by: Junio C Hamano <gitster@pobox.com>

brian m. carlson committed Jul 21, 2020 at 01:15 UTC cd85b447bfc09ddfab660048883de6a07d893097
2 files changed +20 -1
remote-curl.c
+5 -1
@@ -119,7 +119,11 @@ static int set_option(const char *name, const char *value)
119 }
120 else if (!strcmp(name, "cas")) {
121 struct strbuf val = STRBUF_INIT;
122 - strbuf_addf(&val, "--" CAS_OPT_NAME "=%s", value);
122 + strbuf_addstr(&val, "--force-with-lease=");
123 + if (*value != '"')
124 + strbuf_addstr(&val, value);
125 + else if (unquote_c_style(&val, value, NULL))
126 + return -1;
127 string_list_append(&cas_options, val.buf);
128 strbuf_release(&val);
129 return 0;
t/t5541-http-push-smart.sh
+15
@@ -456,6 +456,21 @@ test_expect_success 'push status output scrubs password' '
456 grep "^To $HTTPD_URL/smart/test_repo.git" status
457 '
458
459 +test_expect_success 'Non-ASCII branch name can be used with --force-with-lease' '
460 + cd "$ROOT_PATH" &&
461 + git clone "$HTTPD_URL_USER_PASS/smart/test_repo.git" non-ascii &&
462 + cd non-ascii &&
463 + git checkout -b rama-de-árbol &&
464 + test_commit F &&
465 + git push --force-with-lease origin rama-de-árbol &&
466 + git ls-remote origin refs/heads/rama-de-árbol >actual &&
467 + git ls-remote . refs/heads/rama-de-árbol >expect &&
468 + test_cmp expect actual &&
469 + git push --delete --force-with-lease origin rama-de-árbol &&
470 + git ls-remote origin refs/heads/rama-de-árbol >actual &&
471 + test_must_be_empty actual
472 +'
473 +
474 test_expect_success 'colorize errors/hints' '
475 cd "$ROOT_PATH"/test_repo_clone &&
476 test_must_fail git -c color.transport=always -c color.advice=always \