t5510: verify that D/F confusion cannot lead to an RCE
The most critical vulnerabilities in Git lead to a Remote Code Execution ("RCE"), i.e. the ability for an attacker to have malicious code being run as part of a Git operation that is not expected to run said code, such has hooks delivered as part of a `git clone`. A couple of parent commits ago, a bug was fixed that let Git be confused by the presence of a path `a-` to mistakenly assume that a directory `a/` can safely be created without removing an existing `a` that is a symbolic link. This bug did not represent an exploitable vulnerability on its own; Let's make sure it stays that way. Signed-off-by: Johannes Schindelin <johannes.schindelin@gmx.de>
Johannes Schindelin committed
Mar 24, 2024 at 14:13 UTC
e4930e86c0d521aa6c3c3da9f590e852f6eeac21
1 file changed
+24
t/t5510-fetch.sh
+24
@@ -1240,6 +1240,30 @@ EOF
1240
test_cmp fatal-expect fatal-actual
1241
'
1242
1243
+test_expect_success SYMLINKS 'clone does not get confused by a D/F conflict' '
1244
+ git init df-conflict &&
1245
+ (
1246
+ cd df-conflict &&
1247
+ ln -s .git a &&
1248
+ git add a &&
1249
+ test_tick &&
1250
+ git commit -m symlink &&
1251
+ test_commit a- &&
1252
+ rm a &&
1253
+ mkdir -p a/hooks &&
1254
+ write_script a/hooks/post-checkout <<-EOF &&
1255
+ echo WHOOPSIE >&2
1256
+ echo whoopsie >"$TRASH_DIRECTORY"/whoops
1257
+ EOF
1258
+ git add a/hooks/post-checkout &&
1259
+ test_tick &&
1260
+ git commit -m post-checkout
1261
+ ) &&
1262
+ git clone df-conflict clone 2>err &&
1263
+ ! grep WHOOPS err &&
1264
+ test_path_is_missing whoops
1265
+'
1266
+
1267
. "$TEST_DIRECTORY"/lib-httpd.sh
1268
start_httpd
1269