mirror of
https://github.com/git/git
synced 2024-09-12 21:04:12 +00:00
a2b26ffb1a
In 07259e74ec (fsck: detect gitmodules URLs with embedded newlines,
2020-03-11), git fsck learned to check whether URLs in .gitmodules could
be understood by the credential machinery when they are handled by
git-remote-curl.
However, the check is overbroad: it checks all URLs instead of only
URLs that would be passed to git-remote-curl. In principle a git:// or
file:/// URL does not need to follow the same conventions as an http://
URL; in particular, git:// and file:// protocols are not succeptible to
issues in the credential API because they do not support attaching
credentials.
In the HTTP case, the URL in .gitmodules does not always match the URL
that would be passed to git-remote-curl and the credential machinery:
Git's URL syntax allows specifying a remote helper followed by a "::"
delimiter and a URL to be passed to it, so that
git ls-remote http::https://example.com/repo.git
invokes git-remote-http with https://example.com/repo.git as its URL
argument. With today's checks, that distinction does not make a
difference, but for a check we are about to introduce (for empty URL
schemes) it will matter.
.gitmodules files also support relative URLs. To ensure coverage for the
https based embedded-newline attack, urldecode and check them directly
for embedded newlines.
Helped-by: Jeff King <peff@peff.net>
Signed-off-by: Jonathan Nieder <jrnieder@gmail.com>
Reviewed-by: Jeff King <peff@peff.net>
109 lines
3.2 KiB
Bash
Executable file
109 lines
3.2 KiB
Bash
Executable file
#!/bin/sh
|
|
|
|
test_description='check handling of disallowed .gitmodule urls'
|
|
. ./test-lib.sh
|
|
|
|
test_expect_success 'create submodule with protected dash in url' '
|
|
git init upstream &&
|
|
git -C upstream commit --allow-empty -m base &&
|
|
mv upstream ./-upstream &&
|
|
git submodule add ./-upstream sub &&
|
|
git add sub .gitmodules &&
|
|
git commit -m submodule
|
|
'
|
|
|
|
test_expect_success 'clone can recurse submodule' '
|
|
test_when_finished "rm -rf dst" &&
|
|
git clone --recurse-submodules . dst &&
|
|
echo base >expect &&
|
|
git -C dst/sub log -1 --format=%s >actual &&
|
|
test_cmp expect actual
|
|
'
|
|
|
|
test_expect_success 'fsck accepts protected dash' '
|
|
test_when_finished "rm -rf dst" &&
|
|
git init --bare dst &&
|
|
git -C dst config transfer.fsckObjects true &&
|
|
git push dst HEAD
|
|
'
|
|
|
|
test_expect_success 'remove ./ protection from .gitmodules url' '
|
|
perl -i -pe "s{\./}{}" .gitmodules &&
|
|
git commit -am "drop protection"
|
|
'
|
|
|
|
test_expect_success 'clone rejects unprotected dash' '
|
|
test_when_finished "rm -rf dst" &&
|
|
test_must_fail git clone --recurse-submodules . dst 2>err &&
|
|
test_i18ngrep ignoring err
|
|
'
|
|
|
|
test_expect_success 'fsck rejects unprotected dash' '
|
|
test_when_finished "rm -rf dst" &&
|
|
git init --bare dst &&
|
|
git -C dst config transfer.fsckObjects true &&
|
|
test_must_fail git push dst HEAD 2>err &&
|
|
grep gitmodulesUrl err
|
|
'
|
|
|
|
test_expect_success 'trailing backslash is handled correctly' '
|
|
git init testmodule &&
|
|
test_commit -C testmodule c &&
|
|
git submodule add ./testmodule &&
|
|
: ensure that the name ends in a double backslash &&
|
|
sed -e "s|\\(submodule \"testmodule\\)\"|\\1\\\\\\\\\"|" \
|
|
-e "s|url = .*|url = \" --should-not-be-an-option\"|" \
|
|
<.gitmodules >.new &&
|
|
mv .new .gitmodules &&
|
|
git commit -am "Add testmodule" &&
|
|
test_must_fail git clone --verbose --recurse-submodules . dolly 2>err &&
|
|
test_i18ngrep ! "unknown option" err
|
|
'
|
|
|
|
test_expect_success 'fsck permits embedded newline with unrecognized scheme' '
|
|
git checkout --orphan newscheme &&
|
|
cat >.gitmodules <<-\EOF &&
|
|
[submodule "foo"]
|
|
url = "data://acjbkd%0akajfdickajkd"
|
|
EOF
|
|
git add .gitmodules &&
|
|
git commit -m "gitmodules with unrecognized scheme" &&
|
|
test_when_finished "rm -rf dst" &&
|
|
git init --bare dst &&
|
|
git -C dst config transfer.fsckObjects true &&
|
|
git push dst HEAD
|
|
'
|
|
|
|
test_expect_success 'fsck rejects embedded newline in url' '
|
|
# create an orphan branch to avoid existing .gitmodules objects
|
|
git checkout --orphan newline &&
|
|
cat >.gitmodules <<-\EOF &&
|
|
[submodule "foo"]
|
|
url = "https://one.example.com?%0ahost=two.example.com/foo.git"
|
|
EOF
|
|
git add .gitmodules &&
|
|
git commit -m "gitmodules with newline" &&
|
|
test_when_finished "rm -rf dst" &&
|
|
git init --bare dst &&
|
|
git -C dst config transfer.fsckObjects true &&
|
|
test_must_fail git push dst HEAD 2>err &&
|
|
grep gitmodulesUrl err
|
|
'
|
|
|
|
test_expect_success 'fsck rejects embedded newline in relative url' '
|
|
git checkout --orphan relative-newline &&
|
|
cat >.gitmodules <<-\EOF &&
|
|
[submodule "foo"]
|
|
url = "./%0ahost=two.example.com/foo.git"
|
|
EOF
|
|
git add .gitmodules &&
|
|
git commit -m "relative url with newline" &&
|
|
test_when_finished "rm -rf dst" &&
|
|
git init --bare dst &&
|
|
git -C dst config transfer.fsckObjects true &&
|
|
test_must_fail git push dst HEAD 2>err &&
|
|
grep gitmodulesUrl err
|
|
'
|
|
|
|
test_done
|