Commit aeeb2d49 authored by Jeff King's avatar Jeff King Committed by Junio C Hamano

connect: reject paths that look like command line options

If we get a repo path like "-repo.git", we may try to invoke
"git-upload-pack -repo.git". This is going to fail, since
upload-pack will interpret it as a set of bogus options. But
let's reject this before we even run the sub-program, since
we would not want to allow any mischief with repo names that
actually are real command-line options.

You can still ask for such a path via git-daemon, but there's no
security problem there, because git-daemon enters the repo itself
and then passes "."  on the command line.
Signed-off-by: default avatarJeff King <peff@peff.net>
Reviewed-by: default avatarJonathan Nieder <jrnieder@gmail.com>
Signed-off-by: default avatarJunio C Hamano <gitster@pobox.com>
parent 3be4cf09
......@@ -727,6 +727,9 @@ struct child_process *git_connect(int fd[2], const char *url,
conn = xmalloc(sizeof(*conn));
child_process_init(conn);
if (looks_like_command_line_option(path))
die("strange pathname '%s' blocked", path);
strbuf_addstr(&cmd, prog);
strbuf_addch(&cmd, ' ');
sq_quote_buf(&cmd, path);
......
......@@ -11,4 +11,27 @@ test_expect_success 'setup repository to clone' '
test_proto "file://" file "file://$PWD"
test_proto "path" file .
test_expect_success 'setup repo with dash' '
git init --bare repo.git &&
git push repo.git HEAD &&
mv repo.git "$PWD/-repo.git"
'
# This will fail even without our rejection because upload-pack will
# complain about the bogus option. So let's make sure that GIT_TRACE
# doesn't show us even running upload-pack.
#
# We must also be sure to use "fetch" and not "clone" here, as the latter
# actually canonicalizes our input into an absolute path (which is fine
# to allow).
test_expect_success 'repo names starting with dash are rejected' '
rm -f trace.out &&
test_must_fail env GIT_TRACE="$PWD/trace.out" git fetch -- -repo.git &&
! grep upload-pack trace.out
'
test_expect_success 'full paths still work' '
git fetch "$PWD/-repo.git"
'
test_done
......@@ -26,4 +26,18 @@ test_expect_success 'hostnames starting with dash are rejected' '
! grep ^ssh: stderr
'
test_expect_success 'setup repo with dash' '
git init --bare remote/-repo.git &&
git push remote/-repo.git HEAD
'
test_expect_success 'repo names starting with dash are rejected' '
test_must_fail git clone remote:-repo.git dash-path 2>stderr &&
! grep ^ssh: stderr
'
test_expect_success 'full paths still work' '
git clone "remote:$PWD/remote/-repo.git" dash-path
'
test_done
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment