submodule-config: verify submodule names as paths
Submodule "names" come from the untrusted .gitmodules file,
but we blindly append them to $GIT_DIR/modules to create our
on-disk repo paths. This means you can do bad things by
putting "../" into the name (among other things).
Let's sanity-check these names to avoid building a path that
can be exploited. There are two main decisions:
1. What should the allowed syntax be?
It's tempting to reuse verify_path(), since submodule
names typically come from in-repo paths. But there are
two reasons not to:
a. It's technically more strict than what we need, as
we really care only about breaking out of the
$GIT_DIR/modules/ hierarchy. E.g., having a
submodule named "foo/.git" isn't actually
dangerous, and it's possible that somebody has
manually given such a funny name.
b. Since we'll eventually use this checking logic in
fsck to prevent downstream repositories, it should
be consistent across platforms. Because
verify_path() relies on is_dir_sep(), it wouldn't
block "foo\..\bar" on a non-Windows machine.
2. Where should we enforce it? These days most of the
.gitmodules reads go through submodule-config.c, so
I've put it there in the reading step. That should
cover all of the C code.
We also construct the name for "git submodule add"
inside the git-submodule.sh script. This is probably
not a big deal for security since the name is coming
from the user anyway, but it would be polite to remind
them if the name they pick is invalid (and we need to
expose the name-checker to the shell anyway for our
test scripts).
This patch issues a warning when reading .gitmodules
and just ignores the related config entry completely.
This will generally end up producing a sensible error,
as it works the same as a .gitmodules file which is
missing a submodule entry (so "submodule update" will
barf, but "git clone --recurse-submodules" will print
an error but not abort the clone.
There is one minor oddity, which is that we print the
warning once per malformed config key (since that's how
the config subsystem gives us the entries). So in the
new test, for example, the user would see three
warnings. That's OK, since the intent is that this case
should never come up outside of malicious repositories
(and then it might even benefit the user to see the
message multiple times).
Credit for finding this vulnerability and the proof of
concept from which the test script was adapted goes to
Etienne Stalmans.
Signed-off-by: Jeff King <peff@peff.net>
2018-04-30 07:25:25 +00:00
|
|
|
#!/bin/sh
|
|
|
|
|
|
|
|
|
|
test_description='check handling of .. in submodule names
|
|
|
|
|
|
|
|
|
|
Exercise the name-checking function on a variety of names, and then give a
|
|
|
|
|
real-world setup that confirms we catch this in practice.
|
|
|
|
|
'
|
|
|
|
|
. ./test-lib.sh
|
index-pack: check .gitmodules files with --strict
Now that the internal fsck code has all of the plumbing we
need, we can start checking incoming .gitmodules files.
Naively, it seems like we would just need to add a call to
fsck_finish() after we've processed all of the objects. And
that would be enough to cover the initial test included
here. But there are two extra bits:
1. We currently don't bother calling fsck_object() at all
for blobs, since it has traditionally been a noop. We'd
actually catch these blobs in fsck_finish() at the end,
but it's more efficient to check them when we already
have the object loaded in memory.
2. The second pass done by fsck_finish() needs to access
the objects, but we're actually indexing the pack in
this process. In theory we could give the fsck code a
special callback for accessing the in-pack data, but
it's actually quite tricky:
a. We don't have an internal efficient index mapping
oids to packfile offsets. We only generate it on
the fly as part of writing out the .idx file.
b. We'd still have to reconstruct deltas, which means
we'd basically have to replicate all of the
reading logic in packfile.c.
Instead, let's avoid running fsck_finish() until after
we've written out the .idx file, and then just add it
to our internal packed_git list.
This does mean that the objects are "in the repository"
before we finish our fsck checks. But unpack-objects
already exhibits this same behavior, and it's an
acceptable tradeoff here for the same reason: the
quarantine mechanism means that pushes will be
fully protected.
In addition to a basic push test in t7415, we add a sneaky
pack that reverses the usual object order in the pack,
requiring that index-pack access the tree and blob during
the "finish" step.
This already works for unpack-objects (since it will have
written out loose objects), but we'll check it with this
sneaky pack for good measure.
Signed-off-by: Jeff King <peff@peff.net>
2018-05-04 23:45:01 +00:00
|
|
|
. "$TEST_DIRECTORY"/lib-pack.sh
|
submodule-config: verify submodule names as paths
Submodule "names" come from the untrusted .gitmodules file,
but we blindly append them to $GIT_DIR/modules to create our
on-disk repo paths. This means you can do bad things by
putting "../" into the name (among other things).
Let's sanity-check these names to avoid building a path that
can be exploited. There are two main decisions:
1. What should the allowed syntax be?
It's tempting to reuse verify_path(), since submodule
names typically come from in-repo paths. But there are
two reasons not to:
a. It's technically more strict than what we need, as
we really care only about breaking out of the
$GIT_DIR/modules/ hierarchy. E.g., having a
submodule named "foo/.git" isn't actually
dangerous, and it's possible that somebody has
manually given such a funny name.
b. Since we'll eventually use this checking logic in
fsck to prevent downstream repositories, it should
be consistent across platforms. Because
verify_path() relies on is_dir_sep(), it wouldn't
block "foo\..\bar" on a non-Windows machine.
2. Where should we enforce it? These days most of the
.gitmodules reads go through submodule-config.c, so
I've put it there in the reading step. That should
cover all of the C code.
We also construct the name for "git submodule add"
inside the git-submodule.sh script. This is probably
not a big deal for security since the name is coming
from the user anyway, but it would be polite to remind
them if the name they pick is invalid (and we need to
expose the name-checker to the shell anyway for our
test scripts).
This patch issues a warning when reading .gitmodules
and just ignores the related config entry completely.
This will generally end up producing a sensible error,
as it works the same as a .gitmodules file which is
missing a submodule entry (so "submodule update" will
barf, but "git clone --recurse-submodules" will print
an error but not abort the clone.
There is one minor oddity, which is that we print the
warning once per malformed config key (since that's how
the config subsystem gives us the entries). So in the
new test, for example, the user would see three
warnings. That's OK, since the intent is that this case
should never come up outside of malicious repositories
(and then it might even benefit the user to see the
message multiple times).
Credit for finding this vulnerability and the proof of
concept from which the test script was adapted goes to
Etienne Stalmans.
Signed-off-by: Jeff King <peff@peff.net>
2018-04-30 07:25:25 +00:00
|
|
|
|
|
|
|
|
test_expect_success 'check names' '
|
|
|
|
|
cat >expect <<-\EOF &&
|
|
|
|
|
valid
|
|
|
|
|
valid/with/paths
|
|
|
|
|
EOF
|
|
|
|
|
|
|
|
|
|
git submodule--helper check-name >actual <<-\EOF &&
|
|
|
|
|
valid
|
|
|
|
|
valid/with/paths
|
|
|
|
|
|
|
|
|
|
../foo
|
|
|
|
|
/../foo
|
|
|
|
|
..\foo
|
|
|
|
|
\..\foo
|
|
|
|
|
foo/..
|
|
|
|
|
foo/../
|
|
|
|
|
foo\..
|
|
|
|
|
foo\..\
|
|
|
|
|
foo/../bar
|
|
|
|
|
EOF
|
|
|
|
|
|
|
|
|
|
test_cmp expect actual
|
|
|
|
|
'
|
|
|
|
|
|
|
|
|
|
test_expect_success 'create innocent subrepo' '
|
|
|
|
|
git init innocent &&
|
|
|
|
|
git -C innocent commit --allow-empty -m foo
|
|
|
|
|
'
|
|
|
|
|
|
|
|
|
|
test_expect_success 'submodule add refuses invalid names' '
|
|
|
|
|
test_must_fail \
|
|
|
|
|
git submodule add --name ../../modules/evil "$PWD/innocent" evil
|
|
|
|
|
'
|
|
|
|
|
|
|
|
|
|
test_expect_success 'add evil submodule' '
|
|
|
|
|
git submodule add "$PWD/innocent" evil &&
|
|
|
|
|
|
|
|
|
|
mkdir modules &&
|
|
|
|
|
cp -r .git/modules/evil modules &&
|
|
|
|
|
write_script modules/evil/hooks/post-checkout <<-\EOF &&
|
|
|
|
|
echo >&2 "RUNNING POST CHECKOUT"
|
|
|
|
|
EOF
|
|
|
|
|
|
|
|
|
|
git config -f .gitmodules submodule.evil.update checkout &&
|
|
|
|
|
git config -f .gitmodules --rename-section \
|
|
|
|
|
submodule.evil submodule.../../modules/evil &&
|
|
|
|
|
git add modules &&
|
|
|
|
|
git commit -am evil
|
|
|
|
|
'
|
|
|
|
|
|
|
|
|
|
# This step seems like it shouldn't be necessary, since the payload is
|
|
|
|
|
# contained entirely in the evil submodule. But due to the vagaries of the
|
|
|
|
|
# submodule code, checking out the evil module will fail unless ".git/modules"
|
|
|
|
|
# exists. Adding another submodule (with a name that sorts before "evil") is an
|
|
|
|
|
# easy way to make sure this is the case in the victim clone.
|
|
|
|
|
test_expect_success 'add other submodule' '
|
|
|
|
|
git submodule add "$PWD/innocent" another-module &&
|
|
|
|
|
git add another-module &&
|
|
|
|
|
git commit -am another
|
|
|
|
|
'
|
|
|
|
|
|
|
|
|
|
test_expect_success 'clone evil superproject' '
|
|
|
|
|
git clone --recurse-submodules . victim >output 2>&1 &&
|
|
|
|
|
! grep "RUNNING POST CHECKOUT" output
|
|
|
|
|
'
|
|
|
|
|
|
2018-05-02 21:20:35 +00:00
|
|
|
test_expect_success 'fsck detects evil superproject' '
|
|
|
|
|
test_must_fail git fsck
|
|
|
|
|
'
|
|
|
|
|
|
2018-05-04 23:40:08 +00:00
|
|
|
test_expect_success 'transfer.fsckObjects detects evil superproject (unpack)' '
|
|
|
|
|
rm -rf dst.git &&
|
|
|
|
|
git init --bare dst.git &&
|
|
|
|
|
git -C dst.git config transfer.fsckObjects true &&
|
|
|
|
|
test_must_fail git push dst.git HEAD
|
|
|
|
|
'
|
|
|
|
|
|
index-pack: check .gitmodules files with --strict
Now that the internal fsck code has all of the plumbing we
need, we can start checking incoming .gitmodules files.
Naively, it seems like we would just need to add a call to
fsck_finish() after we've processed all of the objects. And
that would be enough to cover the initial test included
here. But there are two extra bits:
1. We currently don't bother calling fsck_object() at all
for blobs, since it has traditionally been a noop. We'd
actually catch these blobs in fsck_finish() at the end,
but it's more efficient to check them when we already
have the object loaded in memory.
2. The second pass done by fsck_finish() needs to access
the objects, but we're actually indexing the pack in
this process. In theory we could give the fsck code a
special callback for accessing the in-pack data, but
it's actually quite tricky:
a. We don't have an internal efficient index mapping
oids to packfile offsets. We only generate it on
the fly as part of writing out the .idx file.
b. We'd still have to reconstruct deltas, which means
we'd basically have to replicate all of the
reading logic in packfile.c.
Instead, let's avoid running fsck_finish() until after
we've written out the .idx file, and then just add it
to our internal packed_git list.
This does mean that the objects are "in the repository"
before we finish our fsck checks. But unpack-objects
already exhibits this same behavior, and it's an
acceptable tradeoff here for the same reason: the
quarantine mechanism means that pushes will be
fully protected.
In addition to a basic push test in t7415, we add a sneaky
pack that reverses the usual object order in the pack,
requiring that index-pack access the tree and blob during
the "finish" step.
This already works for unpack-objects (since it will have
written out loose objects), but we'll check it with this
sneaky pack for good measure.
Signed-off-by: Jeff King <peff@peff.net>
2018-05-04 23:45:01 +00:00
|
|
|
test_expect_success 'transfer.fsckObjects detects evil superproject (index)' '
|
|
|
|
|
rm -rf dst.git &&
|
|
|
|
|
git init --bare dst.git &&
|
|
|
|
|
git -C dst.git config transfer.fsckObjects true &&
|
|
|
|
|
git -C dst.git config transfer.unpackLimit 1 &&
|
|
|
|
|
test_must_fail git push dst.git HEAD
|
|
|
|
|
'
|
|
|
|
|
|
|
|
|
|
# Normally our packs contain commits followed by trees followed by blobs. This
|
|
|
|
|
# reverses the order, which requires backtracking to find the context of a
|
|
|
|
|
# blob. We'll start with a fresh gitmodules-only tree to make it simpler.
|
|
|
|
|
test_expect_success 'create oddly ordered pack' '
|
|
|
|
|
git checkout --orphan odd &&
|
|
|
|
|
git rm -rf --cached . &&
|
|
|
|
|
git add .gitmodules &&
|
|
|
|
|
git commit -m odd &&
|
|
|
|
|
{
|
|
|
|
|
pack_header 3 &&
|
|
|
|
|
pack_obj $(git rev-parse HEAD:.gitmodules) &&
|
|
|
|
|
pack_obj $(git rev-parse HEAD^{tree}) &&
|
|
|
|
|
pack_obj $(git rev-parse HEAD)
|
|
|
|
|
} >odd.pack &&
|
|
|
|
|
pack_trailer odd.pack
|
|
|
|
|
'
|
|
|
|
|
|
|
|
|
|
test_expect_success 'transfer.fsckObjects handles odd pack (unpack)' '
|
|
|
|
|
rm -rf dst.git &&
|
|
|
|
|
git init --bare dst.git &&
|
|
|
|
|
test_must_fail git -C dst.git unpack-objects --strict <odd.pack
|
|
|
|
|
'
|
|
|
|
|
|
|
|
|
|
test_expect_success 'transfer.fsckObjects handles odd pack (index)' '
|
|
|
|
|
rm -rf dst.git &&
|
|
|
|
|
git init --bare dst.git &&
|
|
|
|
|
test_must_fail git -C dst.git index-pack --strict --stdin <odd.pack
|
|
|
|
|
'
|
|
|
|
|
|
index-pack: handle --strict checks of non-repo packs
Commit 73c3f0f704 (index-pack: check .gitmodules files with
--strict, 2018-05-04) added a call to add_packed_git(), with
the intent that the newly-indexed objects would be available
to the process when we run fsck_finish(). But that's not
what add_packed_git() does. It only allocates the struct,
and you must install_packed_git() on the result. So that
call was effectively doing nothing (except leaking a
struct).
But wait, we passed all of the tests! Does that mean we
don't need the call at all?
For normal cases, no. When we run "index-pack --stdin"
inside a repository, we write the new pack into the object
directory. If fsck_finish() needs to access one of the new
objects, then our initial lookup will fail to find it, but
we'll follow up by running reprepare_packed_git() and
looking again. That logic was meant to handle somebody else
repacking simultaneously, but it ends up working for us
here.
But there is a case that does need this, that we were not
testing. You can run "git index-pack foo.pack" on any file,
even when it is not inside the object directory. Or you may
not even be in a repository at all! This case fails without
doing the proper install_packed_git() call.
We can make this work by adding the install call.
Note that we should be prepared to handle add_packed_git()
failing. We can just silently ignore this case, though. If
fsck_finish() later needs the objects and they're not
available, it will complain itself. And if it doesn't
(because we were able to resolve the whole fsck in the first
pass), then it actually isn't an interesting error at all.
Signed-off-by: Jeff King <peff@peff.net>
Signed-off-by: Junio C Hamano <gitster@pobox.com>
2018-05-31 22:45:31 +00:00
|
|
|
test_expect_success 'index-pack --strict works for non-repo pack' '
|
|
|
|
|
rm -rf dst.git &&
|
|
|
|
|
git init --bare dst.git &&
|
|
|
|
|
cp odd.pack dst.git &&
|
|
|
|
|
test_must_fail git -C dst.git index-pack --strict odd.pack 2>output &&
|
|
|
|
|
# Make sure we fail due to bad gitmodules content, not because we
|
|
|
|
|
# could not read the blob in the first place.
|
|
|
|
|
grep gitmodulesName output
|
|
|
|
|
'
|
|
|
|
|
|
2018-05-05 00:03:35 +00:00
|
|
|
test_expect_success 'fsck detects symlinked .gitmodules file' '
|
|
|
|
|
git init symlink &&
|
|
|
|
|
(
|
|
|
|
|
cd symlink &&
|
|
|
|
|
|
|
|
|
|
# Make the tree directly to avoid index restrictions.
|
|
|
|
|
#
|
|
|
|
|
# Because symlinks store the target as a blob, choose
|
|
|
|
|
# a pathname that could be parsed as a .gitmodules file
|
|
|
|
|
# to trick naive non-symlink-aware checking.
|
|
|
|
|
tricky="[foo]bar=true" &&
|
|
|
|
|
content=$(git hash-object -w ../.gitmodules) &&
|
|
|
|
|
target=$(printf "$tricky" | git hash-object -w --stdin) &&
|
2018-06-11 08:35:40 +00:00
|
|
|
{
|
|
|
|
|
printf "100644 blob $content\t$tricky\n" &&
|
|
|
|
|
printf "120000 blob $target\t.gitmodules\n"
|
|
|
|
|
} | git mktree &&
|
2018-05-05 00:03:35 +00:00
|
|
|
|
|
|
|
|
# Check not only that we fail, but that it is due to the
|
|
|
|
|
# symlink detector; this grep string comes from the config
|
|
|
|
|
# variable name and will not be translated.
|
|
|
|
|
test_must_fail git fsck 2>output &&
|
|
|
|
|
grep gitmodulesSymlink output
|
|
|
|
|
)
|
|
|
|
|
'
|
|
|
|
|
|
2018-06-11 08:35:45 +00:00
|
|
|
test_expect_success 'fsck detects non-blob .gitmodules' '
|
|
|
|
|
git init non-blob &&
|
|
|
|
|
(
|
|
|
|
|
cd non-blob &&
|
|
|
|
|
|
|
|
|
|
# As above, make the funny tree directly to avoid index
|
|
|
|
|
# restrictions.
|
|
|
|
|
mkdir subdir &&
|
|
|
|
|
cp ../.gitmodules subdir/file &&
|
|
|
|
|
git add subdir/file &&
|
|
|
|
|
git commit -m ok &&
|
|
|
|
|
git ls-tree HEAD | sed s/subdir/.gitmodules/ | git mktree &&
|
|
|
|
|
|
|
|
|
|
test_must_fail git fsck 2>output &&
|
|
|
|
|
grep gitmodulesBlob output
|
|
|
|
|
)
|
|
|
|
|
'
|
|
|
|
|
|
clone --recurse-submodules: prevent name squatting on Windows
In addition to preventing `.git` from being tracked by Git, on Windows
we also have to prevent `git~1` from being tracked, as the default NTFS
short name (also known as the "8.3 filename") for the file name `.git`
is `git~1`, otherwise it would be possible for malicious repositories to
write directly into the `.git/` directory, e.g. a `post-checkout` hook
that would then be executed _during_ a recursive clone.
When we implemented appropriate protections in 2b4c6efc821 (read-cache:
optionally disallow NTFS .git variants, 2014-12-16), we had analyzed
carefully that the `.git` directory or file would be guaranteed to be
the first directory entry to be written. Otherwise it would be possible
e.g. for a file named `..git` to be assigned the short name `git~1` and
subsequently, the short name generated for `.git` would be `git~2`. Or
`git~3`. Or even `~9999999` (for a detailed explanation of the lengths
we have to go to protect `.gitmodules`, see the commit message of
e7cb0b4455c (is_ntfs_dotgit: match other .git files, 2018-05-11)).
However, by exploiting two issues (that will be addressed in a related
patch series close by), it is currently possible to clone a submodule
into a non-empty directory:
- On Windows, file names cannot end in a space or a period (for
historical reasons: the period separating the base name from the file
extension was not actually written to disk, and the base name/file
extension was space-padded to the full 8/3 characters, respectively).
Helpfully, when creating a directory under the name, say, `sub.`, that
trailing period is trimmed automatically and the actual name on disk
is `sub`.
This means that while Git thinks that the submodule names `sub` and
`sub.` are different, they both access `.git/modules/sub/`.
- While the backslash character is a valid file name character on Linux,
it is not so on Windows. As Git tries to be cross-platform, it
therefore allows backslash characters in the file names stored in tree
objects.
Which means that it is totally possible that a submodule `c` sits next
to a file `c\..git`, and on Windows, during recursive clone a file
called `..git` will be written into `c/`, of course _before_ the
submodule is cloned.
Note that the actual exploit is not quite as simple as having a
submodule `c` next to a file `c\..git`, as we have to make sure that the
directory `.git/modules/b` already exists when the submodule is checked
out, otherwise a different code path is taken in `module_clone()` that
does _not_ allow a non-empty submodule directory to exist already.
Even if we will address both issues nearby (the next commit will
disallow backslash characters in tree entries' file names on Windows,
and another patch will disallow creating directories/files with trailing
spaces or periods), it is a wise idea to defend in depth against this
sort of attack vector: when submodules are cloned recursively, we now
_require_ the directory to be empty, addressing CVE-2019-1349.
Note: the code path we patch is shared with the code path of `git
submodule update --init`, which must not expect, in general, that the
directory is empty. Hence we have to introduce the new option
`--force-init` and hand it all the way down from `git submodule` to the
actual `git submodule--helper` process that performs the initial clone.
Reported-by: Nicolas Joly <Nicolas.Joly@microsoft.com>
Signed-off-by: Johannes Schindelin <johannes.schindelin@gmx.de>
2019-09-12 12:20:39 +00:00
|
|
|
test_expect_success MINGW 'prevent git~1 squatting on Windows' '
|
|
|
|
|
git init squatting &&
|
|
|
|
|
(
|
|
|
|
|
cd squatting &&
|
|
|
|
|
mkdir a &&
|
|
|
|
|
touch a/..git &&
|
|
|
|
|
git add a/..git &&
|
|
|
|
|
test_tick &&
|
|
|
|
|
git commit -m initial &&
|
|
|
|
|
|
|
|
|
|
modules="$(test_write_lines \
|
|
|
|
|
"[submodule \"b.\"]" "url = ." "path = c" \
|
|
|
|
|
"[submodule \"b\"]" "url = ." "path = d\\\\a" |
|
|
|
|
|
git hash-object -w --stdin)" &&
|
|
|
|
|
rev="$(git rev-parse --verify HEAD)" &&
|
|
|
|
|
hash="$(echo x | git hash-object -w --stdin)" &&
|
2019-09-12 12:54:05 +00:00
|
|
|
git -c core.protectNTFS=false update-index --add \
|
clone --recurse-submodules: prevent name squatting on Windows
In addition to preventing `.git` from being tracked by Git, on Windows
we also have to prevent `git~1` from being tracked, as the default NTFS
short name (also known as the "8.3 filename") for the file name `.git`
is `git~1`, otherwise it would be possible for malicious repositories to
write directly into the `.git/` directory, e.g. a `post-checkout` hook
that would then be executed _during_ a recursive clone.
When we implemented appropriate protections in 2b4c6efc821 (read-cache:
optionally disallow NTFS .git variants, 2014-12-16), we had analyzed
carefully that the `.git` directory or file would be guaranteed to be
the first directory entry to be written. Otherwise it would be possible
e.g. for a file named `..git` to be assigned the short name `git~1` and
subsequently, the short name generated for `.git` would be `git~2`. Or
`git~3`. Or even `~9999999` (for a detailed explanation of the lengths
we have to go to protect `.gitmodules`, see the commit message of
e7cb0b4455c (is_ntfs_dotgit: match other .git files, 2018-05-11)).
However, by exploiting two issues (that will be addressed in a related
patch series close by), it is currently possible to clone a submodule
into a non-empty directory:
- On Windows, file names cannot end in a space or a period (for
historical reasons: the period separating the base name from the file
extension was not actually written to disk, and the base name/file
extension was space-padded to the full 8/3 characters, respectively).
Helpfully, when creating a directory under the name, say, `sub.`, that
trailing period is trimmed automatically and the actual name on disk
is `sub`.
This means that while Git thinks that the submodule names `sub` and
`sub.` are different, they both access `.git/modules/sub/`.
- While the backslash character is a valid file name character on Linux,
it is not so on Windows. As Git tries to be cross-platform, it
therefore allows backslash characters in the file names stored in tree
objects.
Which means that it is totally possible that a submodule `c` sits next
to a file `c\..git`, and on Windows, during recursive clone a file
called `..git` will be written into `c/`, of course _before_ the
submodule is cloned.
Note that the actual exploit is not quite as simple as having a
submodule `c` next to a file `c\..git`, as we have to make sure that the
directory `.git/modules/b` already exists when the submodule is checked
out, otherwise a different code path is taken in `module_clone()` that
does _not_ allow a non-empty submodule directory to exist already.
Even if we will address both issues nearby (the next commit will
disallow backslash characters in tree entries' file names on Windows,
and another patch will disallow creating directories/files with trailing
spaces or periods), it is a wise idea to defend in depth against this
sort of attack vector: when submodules are cloned recursively, we now
_require_ the directory to be empty, addressing CVE-2019-1349.
Note: the code path we patch is shared with the code path of `git
submodule update --init`, which must not expect, in general, that the
directory is empty. Hence we have to introduce the new option
`--force-init` and hand it all the way down from `git submodule` to the
actual `git submodule--helper` process that performs the initial clone.
Reported-by: Nicolas Joly <Nicolas.Joly@microsoft.com>
Signed-off-by: Johannes Schindelin <johannes.schindelin@gmx.de>
2019-09-12 12:20:39 +00:00
|
|
|
--cacheinfo 100644,$modules,.gitmodules \
|
|
|
|
|
--cacheinfo 160000,$rev,c \
|
|
|
|
|
--cacheinfo 160000,$rev,d\\a \
|
|
|
|
|
--cacheinfo 100644,$hash,d./a/x \
|
|
|
|
|
--cacheinfo 100644,$hash,d./a/..git &&
|
|
|
|
|
test_tick &&
|
2019-09-12 12:54:05 +00:00
|
|
|
git -c core.protectNTFS=false commit -m "module" &&
|
|
|
|
|
test_must_fail git show HEAD: 2>err &&
|
|
|
|
|
test_i18ngrep backslash err
|
clone --recurse-submodules: prevent name squatting on Windows
In addition to preventing `.git` from being tracked by Git, on Windows
we also have to prevent `git~1` from being tracked, as the default NTFS
short name (also known as the "8.3 filename") for the file name `.git`
is `git~1`, otherwise it would be possible for malicious repositories to
write directly into the `.git/` directory, e.g. a `post-checkout` hook
that would then be executed _during_ a recursive clone.
When we implemented appropriate protections in 2b4c6efc821 (read-cache:
optionally disallow NTFS .git variants, 2014-12-16), we had analyzed
carefully that the `.git` directory or file would be guaranteed to be
the first directory entry to be written. Otherwise it would be possible
e.g. for a file named `..git` to be assigned the short name `git~1` and
subsequently, the short name generated for `.git` would be `git~2`. Or
`git~3`. Or even `~9999999` (for a detailed explanation of the lengths
we have to go to protect `.gitmodules`, see the commit message of
e7cb0b4455c (is_ntfs_dotgit: match other .git files, 2018-05-11)).
However, by exploiting two issues (that will be addressed in a related
patch series close by), it is currently possible to clone a submodule
into a non-empty directory:
- On Windows, file names cannot end in a space or a period (for
historical reasons: the period separating the base name from the file
extension was not actually written to disk, and the base name/file
extension was space-padded to the full 8/3 characters, respectively).
Helpfully, when creating a directory under the name, say, `sub.`, that
trailing period is trimmed automatically and the actual name on disk
is `sub`.
This means that while Git thinks that the submodule names `sub` and
`sub.` are different, they both access `.git/modules/sub/`.
- While the backslash character is a valid file name character on Linux,
it is not so on Windows. As Git tries to be cross-platform, it
therefore allows backslash characters in the file names stored in tree
objects.
Which means that it is totally possible that a submodule `c` sits next
to a file `c\..git`, and on Windows, during recursive clone a file
called `..git` will be written into `c/`, of course _before_ the
submodule is cloned.
Note that the actual exploit is not quite as simple as having a
submodule `c` next to a file `c\..git`, as we have to make sure that the
directory `.git/modules/b` already exists when the submodule is checked
out, otherwise a different code path is taken in `module_clone()` that
does _not_ allow a non-empty submodule directory to exist already.
Even if we will address both issues nearby (the next commit will
disallow backslash characters in tree entries' file names on Windows,
and another patch will disallow creating directories/files with trailing
spaces or periods), it is a wise idea to defend in depth against this
sort of attack vector: when submodules are cloned recursively, we now
_require_ the directory to be empty, addressing CVE-2019-1349.
Note: the code path we patch is shared with the code path of `git
submodule update --init`, which must not expect, in general, that the
directory is empty. Hence we have to introduce the new option
`--force-init` and hand it all the way down from `git submodule` to the
actual `git submodule--helper` process that performs the initial clone.
Reported-by: Nicolas Joly <Nicolas.Joly@microsoft.com>
Signed-off-by: Johannes Schindelin <johannes.schindelin@gmx.de>
2019-09-12 12:20:39 +00:00
|
|
|
) &&
|
2019-09-12 12:54:05 +00:00
|
|
|
test_must_fail git -c core.protectNTFS=false \
|
clone --recurse-submodules: prevent name squatting on Windows
In addition to preventing `.git` from being tracked by Git, on Windows
we also have to prevent `git~1` from being tracked, as the default NTFS
short name (also known as the "8.3 filename") for the file name `.git`
is `git~1`, otherwise it would be possible for malicious repositories to
write directly into the `.git/` directory, e.g. a `post-checkout` hook
that would then be executed _during_ a recursive clone.
When we implemented appropriate protections in 2b4c6efc821 (read-cache:
optionally disallow NTFS .git variants, 2014-12-16), we had analyzed
carefully that the `.git` directory or file would be guaranteed to be
the first directory entry to be written. Otherwise it would be possible
e.g. for a file named `..git` to be assigned the short name `git~1` and
subsequently, the short name generated for `.git` would be `git~2`. Or
`git~3`. Or even `~9999999` (for a detailed explanation of the lengths
we have to go to protect `.gitmodules`, see the commit message of
e7cb0b4455c (is_ntfs_dotgit: match other .git files, 2018-05-11)).
However, by exploiting two issues (that will be addressed in a related
patch series close by), it is currently possible to clone a submodule
into a non-empty directory:
- On Windows, file names cannot end in a space or a period (for
historical reasons: the period separating the base name from the file
extension was not actually written to disk, and the base name/file
extension was space-padded to the full 8/3 characters, respectively).
Helpfully, when creating a directory under the name, say, `sub.`, that
trailing period is trimmed automatically and the actual name on disk
is `sub`.
This means that while Git thinks that the submodule names `sub` and
`sub.` are different, they both access `.git/modules/sub/`.
- While the backslash character is a valid file name character on Linux,
it is not so on Windows. As Git tries to be cross-platform, it
therefore allows backslash characters in the file names stored in tree
objects.
Which means that it is totally possible that a submodule `c` sits next
to a file `c\..git`, and on Windows, during recursive clone a file
called `..git` will be written into `c/`, of course _before_ the
submodule is cloned.
Note that the actual exploit is not quite as simple as having a
submodule `c` next to a file `c\..git`, as we have to make sure that the
directory `.git/modules/b` already exists when the submodule is checked
out, otherwise a different code path is taken in `module_clone()` that
does _not_ allow a non-empty submodule directory to exist already.
Even if we will address both issues nearby (the next commit will
disallow backslash characters in tree entries' file names on Windows,
and another patch will disallow creating directories/files with trailing
spaces or periods), it is a wise idea to defend in depth against this
sort of attack vector: when submodules are cloned recursively, we now
_require_ the directory to be empty, addressing CVE-2019-1349.
Note: the code path we patch is shared with the code path of `git
submodule update --init`, which must not expect, in general, that the
directory is empty. Hence we have to introduce the new option
`--force-init` and hand it all the way down from `git submodule` to the
actual `git submodule--helper` process that performs the initial clone.
Reported-by: Nicolas Joly <Nicolas.Joly@microsoft.com>
Signed-off-by: Johannes Schindelin <johannes.schindelin@gmx.de>
2019-09-12 12:20:39 +00:00
|
|
|
clone --recurse-submodules squatting squatting-clone 2>err &&
|
mingw: refuse to access paths with trailing spaces or periods
When creating a directory on Windows whose path ends in a space or a
period (or chains thereof), the Win32 API "helpfully" trims those. For
example, `mkdir("abc ");` will return success, but actually create a
directory called `abc` instead.
This stems back to the DOS days, when all file names had exactly 8
characters plus exactly 3 characters for the file extension, and the
only way to have shorter names was by padding with spaces.
Sadly, this "helpful" behavior is a bit inconsistent: after a successful
`mkdir("abc ");`, a `mkdir("abc /def")` will actually _fail_ (because
the directory `abc ` does not actually exist).
Even if it would work, we now have a serious problem because a Git
repository could contain directories `abc` and `abc `, and on Windows,
they would be "merged" unintentionally.
As these paths are illegal on Windows, anyway, let's disallow any
accesses to such paths on that Operating System.
For practical reasons, this behavior is still guarded by the
config setting `core.protectNTFS`: it is possible (and at least two
regression tests make use of it) to create commits without involving the
worktree. In such a scenario, it is of course possible -- even on
Windows -- to create such file names.
Among other consequences, this patch disallows submodules' paths to end
in spaces on Windows (which would formerly have confused Git enough to
try to write into incorrect paths, anyway).
While this patch does not fix a vulnerability on its own, it prevents an
attack vector that was exploited in demonstrations of a number of
recently-fixed security bugs.
The regression test added to `t/t7417-submodule-path-url.sh` reflects
that attack vector.
Note that we have to adjust the test case "prevent git~1 squatting on
Windows" in `t/t7415-submodule-names.sh` because of a very subtle issue.
It tries to clone two submodules whose names differ only in a trailing
period character, and as a consequence their git directories differ in
the same way. Previously, when Git tried to clone the second submodule,
it thought that the git directory already existed (because on Windows,
when you create a directory with the name `b.` it actually creates `b`),
but with this patch, the first submodule's clone will fail because of
the illegal name of the git directory. Therefore, when cloning the
second submodule, Git will take a different code path: a fresh clone
(without an existing git directory). Both code paths fail to clone the
second submodule, both because the the corresponding worktree directory
exists and is not empty, but the error messages are worded differently.
Signed-off-by: Johannes Schindelin <johannes.schindelin@gmx.de>
2019-09-05 11:27:53 +00:00
|
|
|
test_i18ngrep -e "directory not empty" -e "not an empty directory" err &&
|
clone --recurse-submodules: prevent name squatting on Windows
In addition to preventing `.git` from being tracked by Git, on Windows
we also have to prevent `git~1` from being tracked, as the default NTFS
short name (also known as the "8.3 filename") for the file name `.git`
is `git~1`, otherwise it would be possible for malicious repositories to
write directly into the `.git/` directory, e.g. a `post-checkout` hook
that would then be executed _during_ a recursive clone.
When we implemented appropriate protections in 2b4c6efc821 (read-cache:
optionally disallow NTFS .git variants, 2014-12-16), we had analyzed
carefully that the `.git` directory or file would be guaranteed to be
the first directory entry to be written. Otherwise it would be possible
e.g. for a file named `..git` to be assigned the short name `git~1` and
subsequently, the short name generated for `.git` would be `git~2`. Or
`git~3`. Or even `~9999999` (for a detailed explanation of the lengths
we have to go to protect `.gitmodules`, see the commit message of
e7cb0b4455c (is_ntfs_dotgit: match other .git files, 2018-05-11)).
However, by exploiting two issues (that will be addressed in a related
patch series close by), it is currently possible to clone a submodule
into a non-empty directory:
- On Windows, file names cannot end in a space or a period (for
historical reasons: the period separating the base name from the file
extension was not actually written to disk, and the base name/file
extension was space-padded to the full 8/3 characters, respectively).
Helpfully, when creating a directory under the name, say, `sub.`, that
trailing period is trimmed automatically and the actual name on disk
is `sub`.
This means that while Git thinks that the submodule names `sub` and
`sub.` are different, they both access `.git/modules/sub/`.
- While the backslash character is a valid file name character on Linux,
it is not so on Windows. As Git tries to be cross-platform, it
therefore allows backslash characters in the file names stored in tree
objects.
Which means that it is totally possible that a submodule `c` sits next
to a file `c\..git`, and on Windows, during recursive clone a file
called `..git` will be written into `c/`, of course _before_ the
submodule is cloned.
Note that the actual exploit is not quite as simple as having a
submodule `c` next to a file `c\..git`, as we have to make sure that the
directory `.git/modules/b` already exists when the submodule is checked
out, otherwise a different code path is taken in `module_clone()` that
does _not_ allow a non-empty submodule directory to exist already.
Even if we will address both issues nearby (the next commit will
disallow backslash characters in tree entries' file names on Windows,
and another patch will disallow creating directories/files with trailing
spaces or periods), it is a wise idea to defend in depth against this
sort of attack vector: when submodules are cloned recursively, we now
_require_ the directory to be empty, addressing CVE-2019-1349.
Note: the code path we patch is shared with the code path of `git
submodule update --init`, which must not expect, in general, that the
directory is empty. Hence we have to introduce the new option
`--force-init` and hand it all the way down from `git submodule` to the
actual `git submodule--helper` process that performs the initial clone.
Reported-by: Nicolas Joly <Nicolas.Joly@microsoft.com>
Signed-off-by: Johannes Schindelin <johannes.schindelin@gmx.de>
2019-09-12 12:20:39 +00:00
|
|
|
! grep gitdir squatting-clone/d/a/git~2
|
|
|
|
|
'
|
|
|
|
|
|
2019-10-01 21:27:18 +00:00
|
|
|
test_expect_success 'git dirs of sibling submodules must not be nested' '
|
|
|
|
|
git init nested &&
|
|
|
|
|
test_commit -C nested nested &&
|
|
|
|
|
(
|
|
|
|
|
cd nested &&
|
|
|
|
|
cat >.gitmodules <<-EOF &&
|
|
|
|
|
[submodule "hippo"]
|
|
|
|
|
url = .
|
|
|
|
|
path = thing1
|
|
|
|
|
[submodule "hippo/hooks"]
|
|
|
|
|
url = .
|
|
|
|
|
path = thing2
|
|
|
|
|
EOF
|
|
|
|
|
git clone . thing1 &&
|
|
|
|
|
git clone . thing2 &&
|
|
|
|
|
git add .gitmodules thing1 thing2 &&
|
|
|
|
|
test_tick &&
|
|
|
|
|
git commit -m nested
|
|
|
|
|
) &&
|
|
|
|
|
test_must_fail git clone --recurse-submodules nested clone 2>err &&
|
|
|
|
|
test_i18ngrep "is inside git dir" err
|
|
|
|
|
'
|
|
|
|
|
|
submodule-config: verify submodule names as paths
Submodule "names" come from the untrusted .gitmodules file,
but we blindly append them to $GIT_DIR/modules to create our
on-disk repo paths. This means you can do bad things by
putting "../" into the name (among other things).
Let's sanity-check these names to avoid building a path that
can be exploited. There are two main decisions:
1. What should the allowed syntax be?
It's tempting to reuse verify_path(), since submodule
names typically come from in-repo paths. But there are
two reasons not to:
a. It's technically more strict than what we need, as
we really care only about breaking out of the
$GIT_DIR/modules/ hierarchy. E.g., having a
submodule named "foo/.git" isn't actually
dangerous, and it's possible that somebody has
manually given such a funny name.
b. Since we'll eventually use this checking logic in
fsck to prevent downstream repositories, it should
be consistent across platforms. Because
verify_path() relies on is_dir_sep(), it wouldn't
block "foo\..\bar" on a non-Windows machine.
2. Where should we enforce it? These days most of the
.gitmodules reads go through submodule-config.c, so
I've put it there in the reading step. That should
cover all of the C code.
We also construct the name for "git submodule add"
inside the git-submodule.sh script. This is probably
not a big deal for security since the name is coming
from the user anyway, but it would be polite to remind
them if the name they pick is invalid (and we need to
expose the name-checker to the shell anyway for our
test scripts).
This patch issues a warning when reading .gitmodules
and just ignores the related config entry completely.
This will generally end up producing a sensible error,
as it works the same as a .gitmodules file which is
missing a submodule entry (so "submodule update" will
barf, but "git clone --recurse-submodules" will print
an error but not abort the clone.
There is one minor oddity, which is that we print the
warning once per malformed config key (since that's how
the config subsystem gives us the entries). So in the
new test, for example, the user would see three
warnings. That's OK, since the intent is that this case
should never come up outside of malicious repositories
(and then it might even benefit the user to see the
message multiple times).
Credit for finding this vulnerability and the proof of
concept from which the test script was adapted goes to
Etienne Stalmans.
Signed-off-by: Jeff King <peff@peff.net>
2018-04-30 07:25:25 +00:00
|
|
|
test_done
|