@matheusbsbs / matheus-bagliano / commits / ee27ca4a78

archive: don't let remote clients get unreachable commits

Usually git is careful not to allow clients to fetch arbitrary objects from the database; for example, objects received via upload-pack must be reachable from a ref. Upload-archive breaks this by feeding the client's tree-ish directly to get_sha1, which will accept arbitrary hex sha1s, reflogs, etc. This is not a problem if all of your objects are publicly reachable anyway (or at least public to anybody who can run upload-archive). Or if you are making the repo available by dumb protocols like http or rsync (in which case the client can read your whole object db directly). But for sites which allow access only through smart protocols, clients may be able to fetch trees from commits that exist in the server's object database but are not referenced (e.g., because history was rewound). This patch tightens upload-archive's lookup to use dwim_ref rather than get_sha1. This means a remote client can only fetch the tip of a named ref, not an arbitrary sha1 or reflog entry. This also restricts some legitimate requests, too: 1. Reachable non-tip commits, like: git archive --remote=$url v1.0~5 2. Sub-trees of reachable commits, like: git archive --remote=$url v1.7.7:Documentation Local requests continue to use get_sha1, and are not restricted at all. Signed-off-by: Jeff King <peff@peff.net> Signed-off-by: Junio C Hamano <gitster@pobox.com>

Jeff King committed Nov 17, 2011 at 18:04 UTC ee27ca4a781844ddbf556ec64daae24d748a7c5a

5 files changed +27 -8

archive.c

+15 -5

@@ -196,7 +196,8 @@ static void parse_pathspec_arg(const char **pathspec,

196 }

197

198 static void parse_treeish_arg(const char **argv,

199 - struct archiver_args *ar_args, const char *prefix)

199 + struct archiver_args *ar_args, const char *prefix,

200 + int remote)

201 {

202 const char *name = argv[0];

203 const unsigned char *commit_sha1;

@@ -205,8 +206,17 @@ static void parse_treeish_arg(const char **argv,

206 const struct commit *commit;

207 unsigned char sha1[20];

208

208 - if (get_sha1(name, sha1))

209 - die("Not a valid object name");

209 + /* Remotes are only allowed to fetch actual refs */

210 + if (remote) {

211 + char *ref = NULL;

212 + if (!dwim_ref(name, strlen(name), sha1, &ref))

213 + die("no such ref: %s", name);

214 + free(ref);

215 + }

216 + else {

217 + if (get_sha1(name, sha1))

218 + die("Not a valid object name");

219 + }

220

221 commit = lookup_commit_reference_gently(sha1, 1);

222 if (commit) {

@@ -324,7 +334,7 @@ static int parse_archive_args(int argc, const char **argv,

334 }

335

336 int write_archive(int argc, const char **argv, const char *prefix,

327 - int setup_prefix)

337 + int setup_prefix, int remote)

338 {

339 const struct archiver *ar = NULL;

340 struct archiver_args args;

@@ -333,7 +343,7 @@ int write_archive(int argc, const char **argv, const char *prefix,

343 if (setup_prefix && prefix == NULL)

344 prefix = setup_git_directory();

345

336 - parse_treeish_arg(argv, &args, prefix);

346 + parse_treeish_arg(argv, &args, prefix, remote);

347 parse_pathspec_arg(argv + 1, &args);

348

349 git_config(git_default_config, NULL);

archive.h

+2 -1

@@ -24,6 +24,7 @@ extern int write_tar_archive(struct archiver_args *);

24 extern int write_zip_archive(struct archiver_args *);

26 extern int write_archive_entries(struct archiver_args *args, write_archive_entry_fn_t write_entry);

27 -extern int write_archive(int argc, const char **argv, const char *prefix, int setup_prefix);

27 +extern int write_archive(int argc, const char **argv, const char *prefix,

28 + int setup_prefix, int remote);

30 #endif /* ARCHIVE_H */

builtin-archive.c

+1 -1

@@ -117,5 +117,5 @@ int cmd_archive(int argc, const char **argv, const char *prefix)

117

118 setvbuf(stderr, NULL, _IOLBF, BUFSIZ);

119

120 - return write_archive(argc, argv, prefix, 1);

120 + return write_archive(argc, argv, prefix, 1, 0);

121 }

builtin-upload-archive.c

+1 -1

@@ -64,7 +64,7 @@ static int run_upload_archive(int argc, const char **argv, const char *prefix)

64 sent_argv[sent_argc] = NULL;

66 /* parse all options sent by the client */

67 - return write_archive(sent_argc, sent_argv, prefix, 0);

67 + return write_archive(sent_argc, sent_argv, prefix, 0, 1);

68 }

70 static void error_clnt(const char *fmt, ...)

t/t5000-tar-tree.sh

@@ -213,4 +213,12 @@ test_expect_success \

213 'git archive --list outside of a git repo' \

214 'GIT_DIR=some/non-existing/directory git archive --list'

215

216 +test_expect_success 'clients cannot access unreachable commits' '

217 + test_commit unreachable &&

218 + sha1=`git rev-parse HEAD` &&

219 + git reset --hard HEAD^ &&

220 + git archive $sha1 >remote.tar &&

221 + test_must_fail git archive --remote=. $sha1 >remote.tar

222 +'

223 +

224 test_done