Commit 820d7650 authored by Junio C Hamano's avatar Junio C Hamano Committed by Junio C Hamano

connect: reject ssh hostname that begins with a dash

When commands like "git fetch" talk with ssh://$rest_of_URL/, the
code splits $rest_of_URL into components like host, port, etc., and
then spawns the underlying "ssh" program by formulating argv[] array
that has:

 - the path to ssh command taken from GIT_SSH_COMMAND, etc.

 - dashed options like '-batch' (for Tortoise), '-p <port>' as

 - ssh_host, which is supposed to be the hostname parsed out of

 - then the command to be run on the other side, e.g. git

If the ssh_host ends up getting '-<anything>', the argv[] that is
used to spawn the command becomes something like:

    { "ssh", "-p", "22", "-<anything>", "command", "to", "run", NULL }

which obviously is bogus, but depending on the actual value of
"<anything>", will make "ssh" parse and use it as an option.

Prevent this by forbidding ssh_host that begins with a "-".

Noticed-by: Joern Schneeweisz of Recurity Labs
Reported-by: Brian at GitLab
Signed-off-by: default avatarJunio C Hamano <>
Reviewed-by: default avatarJeff King <>
Signed-off-by: default avatarJunio C Hamano <>
parent c8dd1e3b
......@@ -754,6 +754,9 @@ struct child_process *git_connect(int fd[2], const char *url,
return NULL;
if (ssh_host[0] == '-')
die("strange hostname '%s' blocked", ssh_host);
ssh = getenv("GIT_SSH_COMMAND");
if (!ssh) {
const char *base;
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment