@matheusbsbs / matheus-bagliano / commits / e7cb0b4455

is_ntfs_dotgit: match other .git files

When we started to catch NTFS short names that clash with .git, we only looked for GIT~1. This is sufficient because we only ever clone into an empty directory, so .git is guaranteed to be the first subdirectory or file in that directory. However, even with a fresh clone, .gitmodules is *not* necessarily the first file to be written that would want the NTFS short name GITMOD~1: a malicious repository can add .gitmodul0000 and friends, which sorts before `.gitmodules` and is therefore checked out *first*. For that reason, we have to test not only for ~1 short names, but for others, too. It's hard to just adapt the existing checks in is_ntfs_dotgit(): since Windows 2000 (i.e., in all Windows versions still supported by Git), NTFS short names are only generated in the <prefix>~<number> form up to number 4. After that, a *different* prefix is used, calculated from the long file name using an undocumented, but stable algorithm. For example, the short name of .gitmodules would be GITMOD~1, but if it is taken, and all of ~2, ~3 and ~4 are taken, too, the short name GI7EBA~1 will be used. From there, collisions are handled by incrementing the number, shortening the prefix as needed (until ~9999999 is reached, in which case NTFS will not allow the file to be created). We'd also want to handle .gitignore and .gitattributes, which suffer from a similar problem, using the fall-back short names GI250A~1 and GI7D29~1, respectively. To accommodate for that, we could reimplement the hashing algorithm, but it is just safer and simpler to provide the known prefixes. This algorithm has been reverse-engineered and described at https://usn.pw/blog/gen/2015/06/09/filenames/, which is defunct but still available via https://web.archive.org/. These can be recomputed by running the following Perl script: -- snip -- use warnings; use strict; sub compute_short_name_hash ($) { my $checksum = 0; foreach (split('', $_[0])) { $checksum = ($checksum * 0x25 + ord($_)) & 0xffff; } $checksum = ($checksum * 314159269) & 0xffffffff; $checksum = 1 + (~$checksum & 0x7fffffff) if ($checksum & 0x80000000); $checksum -= (($checksum * 1152921497) >> 60) * 1000000007; return scalar reverse sprintf("%x", $checksum & 0xffff); } print compute_short_name_hash($ARGV[0]); -- snap -- E.g., running that with the argument ".gitignore" will result in "250a" (which then becomes "gi250a" in the code). Signed-off-by: Johannes Schindelin <johannes.schindelin@gmx.de> Signed-off-by: Jeff King <peff@peff.net>

Johannes Schindelin committed May 11, 2018 at 16:03 UTC e7cb0b4455c85b53aeba40f88ffddcf6d4002498
2 files changed +93 -1
cache.h
+9 -1
@@ -1188,7 +1188,15 @@ int normalize_path_copy(char *dst, const char *src);
1188 int longest_ancestor_length(const char *path, struct string_list *prefixes);
1189 char *strip_path_suffix(const char *path, const char *suffix);
1190 int daemon_avoid_alias(const char *path);
1191 -extern int is_ntfs_dotgit(const char *name);
1191 +
1192 +/*
1193 + * These functions match their is_hfs_dotgit() counterparts; see utf8.h for
1194 + * details.
1195 + */
1196 +int is_ntfs_dotgit(const char *name);
1197 +int is_ntfs_dotgitmodules(const char *name);
1198 +int is_ntfs_dotgitignore(const char *name);
1199 +int is_ntfs_dotgitattributes(const char *name);
1200
1201 /*
1202 * Returns true iff "str" could be confused as a command-line option when
path.c
+84
@@ -1241,6 +1241,90 @@ int is_ntfs_dotgit(const char *name)
1241 }
1242 }
1243
1244 +static int is_ntfs_dot_generic(const char *name,
1245 + const char *dotgit_name,
1246 + size_t len,
1247 + const char *dotgit_ntfs_shortname_prefix)
1248 +{
1249 + int saw_tilde;
1250 + size_t i;
1251 +
1252 + if ((name[0] == '.' && !strncasecmp(name + 1, dotgit_name, len))) {
1253 + i = len + 1;
1254 +only_spaces_and_periods:
1255 + for (;;) {
1256 + char c = name[i++];
1257 + if (!c)
1258 + return 1;
1259 + if (c != ' ' && c != '.')
1260 + return 0;
1261 + }
1262 + }
1263 +
1264 + /*
1265 + * Is it a regular NTFS short name, i.e. shortened to 6 characters,
1266 + * followed by ~1, ... ~4?
1267 + */
1268 + if (!strncasecmp(name, dotgit_name, 6) && name[6] == '~' &&
1269 + name[7] >= '1' && name[7] <= '4') {
1270 + i = 8;
1271 + goto only_spaces_and_periods;
1272 + }
1273 +
1274 + /*
1275 + * Is it a fall-back NTFS short name (for details, see
1276 + * https://en.wikipedia.org/wiki/8.3_filename?
1277 + */
1278 + for (i = 0, saw_tilde = 0; i < 8; i++)
1279 + if (name[i] == '\0')
1280 + return 0;
1281 + else if (saw_tilde) {
1282 + if (name[i] < '0' || name[i] > '9')
1283 + return 0;
1284 + } else if (name[i] == '~') {
1285 + if (name[++i] < '1' || name[i] > '9')
1286 + return 0;
1287 + saw_tilde = 1;
1288 + } else if (i >= 6)
1289 + return 0;
1290 + else if (name[i] < 0) {
1291 + /*
1292 + * We know our needles contain only ASCII, so we clamp
1293 + * here to make the results of tolower() sane.
1294 + */
1295 + return 0;
1296 + } else if (tolower(name[i]) != dotgit_ntfs_shortname_prefix[i])
1297 + return 0;
1298 +
1299 + goto only_spaces_and_periods;
1300 +}
1301 +
1302 +/*
1303 + * Inline helper to make sure compiler resolves strlen() on literals at
1304 + * compile time.
1305 + */
1306 +static inline int is_ntfs_dot_str(const char *name, const char *dotgit_name,
1307 + const char *dotgit_ntfs_shortname_prefix)
1308 +{
1309 + return is_ntfs_dot_generic(name, dotgit_name, strlen(dotgit_name),
1310 + dotgit_ntfs_shortname_prefix);
1311 +}
1312 +
1313 +int is_ntfs_dotgitmodules(const char *name)
1314 +{
1315 + return is_ntfs_dot_str(name, "gitmodules", "gi7eba");
1316 +}
1317 +
1318 +int is_ntfs_dotgitignore(const char *name)
1319 +{
1320 + return is_ntfs_dot_str(name, "gitignore", "gi250a");
1321 +}
1322 +
1323 +int is_ntfs_dotgitattributes(const char *name)
1324 +{
1325 + return is_ntfs_dot_str(name, "gitattributes", "gi7d29");
1326 +}
1327 +
1328 int looks_like_command_line_option(const char *str)
1329 {
1330 return str && str[0] == '-';