refs: reject ref updates while GIT_QUARANTINE_PATH is set
As documented in git-receive-pack(1), updating a ref from within the pre-receive hook is dangerous and can corrupt your repo. This patch forbids ref updates entirely during the hook to make it harder for adventurous hook writers to shoot themselves in the foot. Signed-off-by: Jeff King <peff@peff.net> Signed-off-by: Junio C Hamano <gitster@pobox.com>
Jeff King committed
Apr 10, 2017 at 18:14 UTC
d8f4481c4f03132174b514f428cd67d2cc0dc997
3 files changed
+19
-1
Documentation/git-receive-pack.txt
+2
-1
@@ -239,7 +239,8 @@ This has a few user-visible effects and caveats:
239
3. The `pre-receive` hook MUST NOT update any refs to point to
240
quarantined objects. Other programs accessing the repository will
241
not be able to see the objects (and if the pre-receive hook fails,
242
- those refs would become corrupted).
242
+ those refs would become corrupted). For safety, any ref updates
243
+ from within `pre-receive` are automatically rejected.
244
245
246
SEE ALSO
refs.c
+6
@@ -1465,6 +1465,12 @@ int ref_transaction_commit(struct ref_transaction *transaction,
1465
{
1466
struct ref_store *refs = get_ref_store(NULL);
1467
1468
+ if (getenv(GIT_QUARANTINE_ENVIRONMENT)) {
1469
+ strbuf_addstr(err,
1470
+ _("ref updates forbidden inside quarantine environment"));
1471
+ return -1;
1472
+ }
1473
+
1474
return refs->be->transaction_commit(refs, transaction, err);
1475
}
1476
t/t5547-push-quarantine.sh
+11
@@ -33,4 +33,15 @@ test_expect_success 'rejected objects are removed' '
33
test_cmp expect actual
34
'
35
36
+test_expect_success 'updating a ref from quarantine is forbidden' '
37
+ git init --bare update.git &&
38
+ write_script update.git/hooks/pre-receive <<-\EOF &&
39
+ read old new refname
40
+ git update-ref refs/heads/unrelated $new
41
+ exit 1
42
+ EOF
43
+ test_must_fail git push update.git HEAD &&
44
+ git -C update.git fsck
45
+'
46
+
47
test_done