@matheusbsbs / matheus-bagliano / commits / e1d911dd4c

Fork 0

mingw: disallow backslash characters in tree objects' file names

The backslash character is not a valid part of a file name on Windows. Hence it is dangerous to allow writing files that were unpacked from tree objects, when the stored file name contains a backslash character: it will be misinterpreted as directory separator. This not only causes ambiguity when a tree contains a blob `a\b` and a tree `a` that contains a blob `b`, but it also can be used as part of an attack vector to side-step the careful protections against writing into the `.git/` directory during a clone of a maliciously-crafted repository. Let's prevent that, addressing CVE-2019-1354. Note: we guard against backslash characters in tree objects' file names _only_ on Windows (because on other platforms, even on those where NTFS volumes can be mounted, the backslash character is _not_ a directory separator), and _only_ when `core.protectNTFS = true` (because users might need to generate tree objects for other platforms, of course without touching the worktree, e.g. using `git update-index --cacheinfo`). Signed-off-by: Johannes Schindelin <johannes.schindelin@gmx.de>

Johannes Schindelin committed Sep 12, 2019 at 14:54 UTC e1d911dd4c7b76a5a8cec0f5c8de15981e34da83

4 files changed +13 -3

t/t1450-fsck.sh

@@ -419,6 +419,7 @@ while read name path pretty; do

419 (

420 git init $name-$type &&

421 cd $name-$type &&

422 + git config core.protectNTFS false &&

423 echo content >file &&

424 git add file &&

425 git commit -m base &&

t/t7415-submodule-names.sh

+5 -3

@@ -89,16 +89,18 @@ test_expect_success MINGW 'prevent git~1 squatting on Windows' '

89 git hash-object -w --stdin)" &&

90 rev="$(git rev-parse --verify HEAD)" &&

91 hash="$(echo x | git hash-object -w --stdin)" &&

92 - git update-index --add \

92 + git -c core.protectNTFS=false update-index --add \

93 --cacheinfo 100644,$modules,.gitmodules \

94 --cacheinfo 160000,$rev,c \

95 --cacheinfo 160000,$rev,d\\a \

96 --cacheinfo 100644,$hash,d./a/x \

97 --cacheinfo 100644,$hash,d./a/..git &&

98 test_tick &&

99 - git commit -m "module"

99 + git -c core.protectNTFS=false commit -m "module" &&

100 + test_must_fail git show HEAD: 2>err &&

101 + test_i18ngrep backslash err

102 ) &&

101 - test_must_fail git \

103 + test_must_fail git -c core.protectNTFS=false \

104 clone --recurse-submodules squatting squatting-clone 2>err &&

105 test_i18ngrep "directory not empty" err &&

106 ! grep gitdir squatting-clone/d/a/git~2

t/t9350-fast-export.sh

@@ -421,6 +421,7 @@ test_expect_success 'directory becomes symlink' '

421

422 test_expect_success 'fast-export quotes pathnames' '

423 git init crazy-paths &&

424 + test_config -C crazy-paths core.protectNTFS false &&

425 (cd crazy-paths &&

426 blob=$(echo foo | git hash-object -w --stdin) &&

427 git update-index --add \

tree-walk.c

@@ -41,6 +41,12 @@ static int decode_tree_entry(struct tree_desc *desc, const char *buf, unsigned l

41 strbuf_addstr(err, _("empty filename in tree entry"));

42 return -1;

43 }

44 +#ifdef GIT_WINDOWS_NATIVE

45 + if (protect_ntfs && strchr(path, '\\')) {

46 + strbuf_addf(err, _("filename in tree entry contains backslash: '%s'"), path);

47 + return -1;

48 + }

49 +#endif

50 len = strlen(path) + 1;

52 /* Initialize the descriptor entry */