mirror of
https://github.com/git/git
synced 2024-09-12 21:04:12 +00:00
a02ea57717
When we connect to a git:// server, we send an initial request that looks something like: 002dgit-upload-pack repo.git\0host=example.com If the repo path contains a newline, then it's included literally, and we get: 002egit-upload-pack repo .git\0host=example.com This works fine if you really do have a newline in your repository name; the server side uses the pktline framing to parse the string, not newlines. However, there are many _other_ protocols in the wild that do parse on newlines, such as HTTP. So a carefully constructed git:// URL can actually turn into a valid HTTP request. For example: git://localhost:1234/%0d%0a%0d%0aGET%20/%20HTTP/1.1 %0d%0aHost:localhost%0d%0a%0d%0a becomes: 0050git-upload-pack / GET / HTTP/1.1 Host:localhost host=localhost:1234 on the wire. Again, this isn't a problem for a real Git server, but it does mean that feeding a malicious URL to Git (e.g., through a submodule) can cause it to make unexpected cross-protocol requests. Since repository names with newlines are presumably quite rare (and indeed, we already disallow them in git-over-http), let's just disallow them over this protocol. Hostnames could likewise inject a newline, but this is unlikely a problem in practice; we'd try resolving the hostname with a newline in it, which wouldn't work. Still, it doesn't hurt to err on the side of caution there, since we would not expect them to work in the first place. The ssh and local code paths are unaffected by this patch. In both cases we're trying to run upload-pack via a shell, and will quote the newline so that it makes it intact. An attacker can point an ssh url at an arbitrary port, of course, but unless there's an actual ssh server there, we'd never get as far as sending our shell command anyway. We _could_ similarly restrict newlines in those protocols out of caution, but there seems little benefit to doing so. The new test here is run alongside the git-daemon tests, which cover the same protocol, but it shouldn't actually contact the daemon at all. In theory we could make the test more robust by setting up an actual repository with a newline in it (so that our clone would succeed if our new check didn't kick in). But a repo directory with newline in it is likely not portable across all filesystems. Likewise, we could check git-daemon's log that it was not contacted at all, but we do not currently record the log (and anyway, it would make the test racy with the daemon's log write). We'll just check the client-side stderr to make sure we hit the expected code path. Reported-by: Harold Kim <h.kim@flatt.tech> Signed-off-by: Jeff King <peff@peff.net> Signed-off-by: Junio C Hamano <gitster@pobox.com>
221 lines
6.4 KiB
Bash
Executable file
221 lines
6.4 KiB
Bash
Executable file
#!/bin/sh
|
|
|
|
test_description='test fetching over git protocol'
|
|
. ./test-lib.sh
|
|
|
|
. "$TEST_DIRECTORY"/lib-git-daemon.sh
|
|
start_git_daemon
|
|
|
|
check_verbose_connect () {
|
|
test_i18ngrep -F "Looking up 127.0.0.1 ..." stderr &&
|
|
test_i18ngrep -F "Connecting to 127.0.0.1 (port " stderr &&
|
|
test_i18ngrep -F "done." stderr
|
|
}
|
|
|
|
test_expect_success 'setup repository' '
|
|
git config push.default matching &&
|
|
echo content >file &&
|
|
git add file &&
|
|
git commit -m one
|
|
'
|
|
|
|
test_expect_success 'create git-accessible bare repository' '
|
|
mkdir "$GIT_DAEMON_DOCUMENT_ROOT_PATH/repo.git" &&
|
|
(cd "$GIT_DAEMON_DOCUMENT_ROOT_PATH/repo.git" &&
|
|
git --bare init &&
|
|
: >git-daemon-export-ok
|
|
) &&
|
|
git remote add public "$GIT_DAEMON_DOCUMENT_ROOT_PATH/repo.git" &&
|
|
git push public master:master
|
|
'
|
|
|
|
test_expect_success 'clone git repository' '
|
|
git clone -v "$GIT_DAEMON_URL/repo.git" clone 2>stderr &&
|
|
check_verbose_connect &&
|
|
test_cmp file clone/file
|
|
'
|
|
|
|
test_expect_success 'fetch changes via git protocol' '
|
|
echo content >>file &&
|
|
git commit -a -m two &&
|
|
git push public &&
|
|
(cd clone && git pull -v) 2>stderr &&
|
|
check_verbose_connect &&
|
|
test_cmp file clone/file
|
|
'
|
|
|
|
test_expect_success 'no-op fetch -v stderr is as expected' '
|
|
(cd clone && git fetch -v) 2>stderr &&
|
|
check_verbose_connect
|
|
'
|
|
|
|
test_expect_success 'no-op fetch without "-v" is quiet' '
|
|
(cd clone && git fetch 2>../stderr) &&
|
|
test_must_be_empty stderr
|
|
'
|
|
|
|
test_expect_success 'remote detects correct HEAD' '
|
|
git push public master:other &&
|
|
(cd clone &&
|
|
git remote set-head -d origin &&
|
|
git remote set-head -a origin &&
|
|
git symbolic-ref refs/remotes/origin/HEAD > output &&
|
|
echo refs/remotes/origin/master > expect &&
|
|
test_cmp expect output
|
|
)
|
|
'
|
|
|
|
test_expect_success 'prepare pack objects' '
|
|
cp -R "$GIT_DAEMON_DOCUMENT_ROOT_PATH"/repo.git "$GIT_DAEMON_DOCUMENT_ROOT_PATH"/repo_pack.git &&
|
|
(cd "$GIT_DAEMON_DOCUMENT_ROOT_PATH"/repo_pack.git &&
|
|
git --bare repack -a -d
|
|
)
|
|
'
|
|
|
|
test_expect_success 'fetch notices corrupt pack' '
|
|
cp -R "$GIT_DAEMON_DOCUMENT_ROOT_PATH"/repo_pack.git "$GIT_DAEMON_DOCUMENT_ROOT_PATH"/repo_bad1.git &&
|
|
(cd "$GIT_DAEMON_DOCUMENT_ROOT_PATH"/repo_bad1.git &&
|
|
p=$(ls objects/pack/pack-*.pack) &&
|
|
chmod u+w $p &&
|
|
printf %0256d 0 | dd of=$p bs=256 count=1 seek=1 conv=notrunc
|
|
) &&
|
|
mkdir repo_bad1.git &&
|
|
(cd repo_bad1.git &&
|
|
git --bare init &&
|
|
test_must_fail git --bare fetch "$GIT_DAEMON_URL/repo_bad1.git" &&
|
|
test 0 = $(ls objects/pack/pack-*.pack | wc -l)
|
|
)
|
|
'
|
|
|
|
test_expect_success 'fetch notices corrupt idx' '
|
|
cp -R "$GIT_DAEMON_DOCUMENT_ROOT_PATH"/repo_pack.git "$GIT_DAEMON_DOCUMENT_ROOT_PATH"/repo_bad2.git &&
|
|
(cd "$GIT_DAEMON_DOCUMENT_ROOT_PATH"/repo_bad2.git &&
|
|
p=$(ls objects/pack/pack-*.idx) &&
|
|
chmod u+w $p &&
|
|
printf %0256d 0 | dd of=$p bs=256 count=1 seek=1 conv=notrunc
|
|
) &&
|
|
mkdir repo_bad2.git &&
|
|
(cd repo_bad2.git &&
|
|
git --bare init &&
|
|
test_must_fail git --bare fetch "$GIT_DAEMON_URL/repo_bad2.git" &&
|
|
test 0 = $(ls objects/pack | wc -l)
|
|
)
|
|
'
|
|
|
|
test_expect_success 'client refuses to ask for repo with newline' '
|
|
test_must_fail git clone "$GIT_DAEMON_URL/repo$LF.git" dst 2>stderr &&
|
|
test_i18ngrep newline.is.forbidden stderr
|
|
'
|
|
|
|
test_remote_error()
|
|
{
|
|
do_export=YesPlease
|
|
while test $# -gt 0
|
|
do
|
|
case $1 in
|
|
-x)
|
|
shift
|
|
chmod -x "$GIT_DAEMON_DOCUMENT_ROOT_PATH/repo.git"
|
|
;;
|
|
-n)
|
|
shift
|
|
do_export=
|
|
;;
|
|
*)
|
|
break
|
|
esac
|
|
done
|
|
|
|
msg=$1
|
|
shift
|
|
cmd=$1
|
|
shift
|
|
repo=$1
|
|
shift || error "invalid number of arguments"
|
|
|
|
if test -x "$GIT_DAEMON_DOCUMENT_ROOT_PATH/$repo"
|
|
then
|
|
if test -n "$do_export"
|
|
then
|
|
: >"$GIT_DAEMON_DOCUMENT_ROOT_PATH/$repo/git-daemon-export-ok"
|
|
else
|
|
rm -f "$GIT_DAEMON_DOCUMENT_ROOT_PATH/$repo/git-daemon-export-ok"
|
|
fi
|
|
fi
|
|
|
|
test_must_fail git "$cmd" "$GIT_DAEMON_URL/$repo" "$@" 2>output &&
|
|
test_i18ngrep "fatal: remote error: $msg: /$repo" output &&
|
|
ret=$?
|
|
chmod +x "$GIT_DAEMON_DOCUMENT_ROOT_PATH/repo.git"
|
|
(exit $ret)
|
|
}
|
|
|
|
msg="access denied or repository not exported"
|
|
test_expect_success 'clone non-existent' "test_remote_error '$msg' clone nowhere.git "
|
|
test_expect_success 'push disabled' "test_remote_error '$msg' push repo.git master"
|
|
test_expect_success 'read access denied' "test_remote_error -x '$msg' fetch repo.git "
|
|
test_expect_success 'not exported' "test_remote_error -n '$msg' fetch repo.git "
|
|
|
|
stop_git_daemon
|
|
start_git_daemon --informative-errors
|
|
|
|
test_expect_success 'clone non-existent' "test_remote_error 'no such repository' clone nowhere.git "
|
|
test_expect_success 'push disabled' "test_remote_error 'service not enabled' push repo.git master"
|
|
test_expect_success 'read access denied' "test_remote_error -x 'no such repository' fetch repo.git "
|
|
test_expect_success 'not exported' "test_remote_error -n 'repository not exported' fetch repo.git "
|
|
|
|
stop_git_daemon
|
|
start_git_daemon --interpolated-path="$GIT_DAEMON_DOCUMENT_ROOT_PATH/%H%D"
|
|
|
|
test_expect_success 'access repo via interpolated hostname' '
|
|
repo="$GIT_DAEMON_DOCUMENT_ROOT_PATH/localhost/interp.git" &&
|
|
git init --bare "$repo" &&
|
|
git push "$repo" HEAD &&
|
|
>"$repo"/git-daemon-export-ok &&
|
|
GIT_OVERRIDE_VIRTUAL_HOST=localhost \
|
|
git ls-remote "$GIT_DAEMON_URL/interp.git" &&
|
|
GIT_OVERRIDE_VIRTUAL_HOST=LOCALHOST \
|
|
git ls-remote "$GIT_DAEMON_URL/interp.git"
|
|
'
|
|
|
|
test_expect_success 'hostname cannot break out of directory' '
|
|
repo="$GIT_DAEMON_DOCUMENT_ROOT_PATH/../escape.git" &&
|
|
git init --bare "$repo" &&
|
|
git push "$repo" HEAD &&
|
|
>"$repo"/git-daemon-export-ok &&
|
|
test_must_fail \
|
|
env GIT_OVERRIDE_VIRTUAL_HOST=.. \
|
|
git ls-remote "$GIT_DAEMON_URL/escape.git"
|
|
'
|
|
|
|
test_expect_success 'daemon log records all attributes' '
|
|
cat >expect <<-\EOF &&
|
|
Extended attribute "host": localhost
|
|
Extended attribute "protocol": version=1
|
|
EOF
|
|
>daemon.log &&
|
|
GIT_OVERRIDE_VIRTUAL_HOST=localhost \
|
|
git -c protocol.version=1 \
|
|
ls-remote "$GIT_DAEMON_URL/interp.git" &&
|
|
grep -i extended.attribute daemon.log | cut -d" " -f2- >actual &&
|
|
test_cmp expect actual
|
|
'
|
|
|
|
test_expect_success FAKENC 'hostname interpolation works after LF-stripping' '
|
|
{
|
|
printf "git-upload-pack /interp.git\n\0host=localhost" | packetize
|
|
printf "0000"
|
|
} >input &&
|
|
fake_nc "$GIT_DAEMON_HOST_PORT" <input >output &&
|
|
depacketize <output >output.raw &&
|
|
|
|
# just pick out the value of master, which avoids any protocol
|
|
# particulars
|
|
perl -lne "print \$1 if m{^(\\S+) refs/heads/master}" <output.raw >actual &&
|
|
git -C "$repo" rev-parse master >expect &&
|
|
test_cmp expect actual
|
|
'
|
|
|
|
stop_git_daemon
|
|
test_done
|