summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authorJunio C Hamano <gitster@pobox.com>2017-08-01 12:27:31 -0700
committerJunio C Hamano <gitster@pobox.com>2017-08-01 12:27:31 -0700
commite312af164c12052b7a0dbf8f7b86549a3c5b578f (patch)
tree2305e144bb615718f3e163ecfc52bc639a4c0e41
parentcf8899d285d2648013040ec7196ffd3de0606664 (diff)
parent3d9c5b5c4461957fbbc0479e037990db04ebb740 (diff)
downloadgit-e312af164c12052b7a0dbf8f7b86549a3c5b578f.tar.gz
Merge tag 'v2.12.4' into maint
-rw-r--r--Documentation/RelNotes/2.10.4.txt4
-rw-r--r--Documentation/RelNotes/2.11.3.txt4
-rw-r--r--Documentation/RelNotes/2.12.4.txt4
-rw-r--r--Documentation/RelNotes/2.7.6.txt25
-rw-r--r--Documentation/RelNotes/2.8.6.txt4
-rw-r--r--Documentation/RelNotes/2.9.5.txt4
-rw-r--r--cache.h8
-rw-r--r--connect.c11
-rw-r--r--path.c5
-rw-r--r--t/lib-proto-disable.sh8
-rwxr-xr-xt/t5532-fetch-proxy.sh5
-rwxr-xr-xt/t5810-proto-disable-local.sh23
-rwxr-xr-xt/t5813-proto-disable-ssh.sh23
13 files changed, 126 insertions, 2 deletions
diff --git a/Documentation/RelNotes/2.10.4.txt b/Documentation/RelNotes/2.10.4.txt
new file mode 100644
index 0000000000..ee8142ad24
--- /dev/null
+++ b/Documentation/RelNotes/2.10.4.txt
@@ -0,0 +1,4 @@
+Git v2.10.4 Release Notes
+=========================
+
+This release forward-ports the fix for "ssh://..." URL from Git v2.7.6
diff --git a/Documentation/RelNotes/2.11.3.txt b/Documentation/RelNotes/2.11.3.txt
new file mode 100644
index 0000000000..4e3b78d0e8
--- /dev/null
+++ b/Documentation/RelNotes/2.11.3.txt
@@ -0,0 +1,4 @@
+Git v2.11.3 Release Notes
+=========================
+
+This release forward-ports the fix for "ssh://..." URL from Git v2.7.6
diff --git a/Documentation/RelNotes/2.12.4.txt b/Documentation/RelNotes/2.12.4.txt
new file mode 100644
index 0000000000..3f56938221
--- /dev/null
+++ b/Documentation/RelNotes/2.12.4.txt
@@ -0,0 +1,4 @@
+Git v2.12.4 Release Notes
+=========================
+
+This release forward-ports the fix for "ssh://..." URL from Git v2.7.6
diff --git a/Documentation/RelNotes/2.7.6.txt b/Documentation/RelNotes/2.7.6.txt
new file mode 100644
index 0000000000..4c6d1dcd4a
--- /dev/null
+++ b/Documentation/RelNotes/2.7.6.txt
@@ -0,0 +1,25 @@
+Git v2.7.6 Release Notes
+========================
+
+Fixes since v2.7.5
+------------------
+
+ * A "ssh://..." URL can result in a "ssh" command line with a
+ hostname that begins with a dash "-", which would cause the "ssh"
+ command to instead (mis)treat it as an option. This is now
+ prevented by forbidding such a hostname (which will not be
+ necessary in the real world).
+
+ * Similarly, when GIT_PROXY_COMMAND is configured, the command is
+ run with host and port that are parsed out from "ssh://..." URL;
+ a poorly written GIT_PROXY_COMMAND could be tricked into treating
+ a string that begins with a dash "-". This is now prevented by
+ forbidding such a hostname and port number (again, which will not
+ be necessary in the real world).
+
+ * In the same spirit, a repository name that begins with a dash "-"
+ is also forbidden now.
+
+Credits go to Brian Neel at GitLab, Joern Schneeweisz of Recurity
+Labs and Jeff King at GitHub.
+
diff --git a/Documentation/RelNotes/2.8.6.txt b/Documentation/RelNotes/2.8.6.txt
new file mode 100644
index 0000000000..d8db55d920
--- /dev/null
+++ b/Documentation/RelNotes/2.8.6.txt
@@ -0,0 +1,4 @@
+Git v2.8.6 Release Notes
+========================
+
+This release forward-ports the fix for "ssh://..." URL from Git v2.7.6
diff --git a/Documentation/RelNotes/2.9.5.txt b/Documentation/RelNotes/2.9.5.txt
new file mode 100644
index 0000000000..668313ae55
--- /dev/null
+++ b/Documentation/RelNotes/2.9.5.txt
@@ -0,0 +1,4 @@
+Git v2.9.5 Release Notes
+========================
+
+This release forward-ports the fix for "ssh://..." URL from Git v2.7.6
diff --git a/cache.h b/cache.h
index 52b91f5b64..c1041cc02b 100644
--- a/cache.h
+++ b/cache.h
@@ -1190,6 +1190,14 @@ char *strip_path_suffix(const char *path, const char *suffix);
int daemon_avoid_alias(const char *path);
extern int is_ntfs_dotgit(const char *name);
+/*
+ * Returns true iff "str" could be confused as a command-line option when
+ * passed to a sub-program like "ssh". Note that this has nothing to do with
+ * shell-quoting, which should be handled separately; we're assuming here that
+ * the string makes it verbatim to the sub-program.
+ */
+int looks_like_command_line_option(const char *str);
+
/**
* Return a newly allocated string with the evaluation of
* "$XDG_CONFIG_HOME/git/$filename" if $XDG_CONFIG_HOME is non-empty, otherwise
diff --git a/connect.c b/connect.c
index c72b1d1151..e43df44b0c 100644
--- a/connect.c
+++ b/connect.c
@@ -577,6 +577,11 @@ static struct child_process *git_proxy_connect(int fd[2], char *host)
get_host_and_port(&host, &port);
+ if (looks_like_command_line_option(host))
+ die("strange hostname '%s' blocked", host);
+ if (looks_like_command_line_option(port))
+ die("strange port '%s' blocked", port);
+
proxy = xmalloc(sizeof(*proxy));
child_process_init(proxy);
argv_array_push(&proxy->args, git_proxy_command);
@@ -823,6 +828,9 @@ struct child_process *git_connect(int fd[2], const char *url,
conn = xmalloc(sizeof(*conn));
child_process_init(conn);
+ if (looks_like_command_line_option(path))
+ die("strange pathname '%s' blocked", path);
+
strbuf_addstr(&cmd, prog);
strbuf_addch(&cmd, ' ');
sq_quote_buf(&cmd, path);
@@ -856,6 +864,9 @@ struct child_process *git_connect(int fd[2], const char *url,
return NULL;
}
+ if (looks_like_command_line_option(ssh_host))
+ die("strange hostname '%s' blocked", ssh_host);
+
ssh = get_ssh_command();
if (ssh)
handle_ssh_variant(ssh, 1, &port_option,
diff --git a/path.c b/path.c
index c1cb1cf627..0349a0ab7b 100644
--- a/path.c
+++ b/path.c
@@ -1241,6 +1241,11 @@ int is_ntfs_dotgit(const char *name)
}
}
+int looks_like_command_line_option(const char *str)
+{
+ return str && str[0] == '-';
+}
+
char *xdg_config_home(const char *filename)
{
const char *home, *config_home;
diff --git a/t/lib-proto-disable.sh b/t/lib-proto-disable.sh
index 02f49cb409..83babe57d9 100644
--- a/t/lib-proto-disable.sh
+++ b/t/lib-proto-disable.sh
@@ -147,29 +147,33 @@ test_config () {
# Test clone/fetch/push with protocol.allow user defined default
test_expect_success "clone $desc (enabled)" '
rm -rf tmp.git &&
- git config --global protocol.allow always &&
+ test_config_global protocol.allow always &&
git clone --bare "$url" tmp.git
'
test_expect_success "fetch $desc (enabled)" '
+ test_config_global protocol.allow always &&
git -C tmp.git fetch
'
test_expect_success "push $desc (enabled)" '
+ test_config_global protocol.allow always &&
git -C tmp.git push origin HEAD:pushed
'
test_expect_success "push $desc (disabled)" '
- git config --global protocol.allow never &&
+ test_config_global protocol.allow never &&
test_must_fail git -C tmp.git push origin HEAD:pushed
'
test_expect_success "fetch $desc (disabled)" '
+ test_config_global protocol.allow never &&
test_must_fail git -C tmp.git fetch
'
test_expect_success "clone $desc (disabled)" '
rm -rf tmp.git &&
+ test_config_global protocol.allow never &&
test_must_fail git clone --bare "$url" tmp.git
'
}
diff --git a/t/t5532-fetch-proxy.sh b/t/t5532-fetch-proxy.sh
index 51c9669398..9c2798603b 100755
--- a/t/t5532-fetch-proxy.sh
+++ b/t/t5532-fetch-proxy.sh
@@ -43,4 +43,9 @@ test_expect_success 'fetch through proxy works' '
test_cmp expect actual
'
+test_expect_success 'funny hostnames are rejected before running proxy' '
+ test_must_fail git fetch git://-remote/repo.git 2>stderr &&
+ ! grep "proxying for" stderr
+'
+
test_done
diff --git a/t/t5810-proto-disable-local.sh b/t/t5810-proto-disable-local.sh
index 563592d8a8..c1ef99b85c 100755
--- a/t/t5810-proto-disable-local.sh
+++ b/t/t5810-proto-disable-local.sh
@@ -11,4 +11,27 @@ test_expect_success 'setup repository to clone' '
test_proto "file://" file "file://$PWD"
test_proto "path" file .
+test_expect_success 'setup repo with dash' '
+ git init --bare repo.git &&
+ git push repo.git HEAD &&
+ mv repo.git "$PWD/-repo.git"
+'
+
+# This will fail even without our rejection because upload-pack will
+# complain about the bogus option. So let's make sure that GIT_TRACE
+# doesn't show us even running upload-pack.
+#
+# We must also be sure to use "fetch" and not "clone" here, as the latter
+# actually canonicalizes our input into an absolute path (which is fine
+# to allow).
+test_expect_success 'repo names starting with dash are rejected' '
+ rm -f trace.out &&
+ test_must_fail env GIT_TRACE="$PWD/trace.out" git fetch -- -repo.git &&
+ ! grep upload-pack trace.out
+'
+
+test_expect_success 'full paths still work' '
+ git fetch "$PWD/-repo.git"
+'
+
test_done
diff --git a/t/t5813-proto-disable-ssh.sh b/t/t5813-proto-disable-ssh.sh
index a954ead8af..3f084ee306 100755
--- a/t/t5813-proto-disable-ssh.sh
+++ b/t/t5813-proto-disable-ssh.sh
@@ -17,4 +17,27 @@ test_proto "host:path" ssh "remote:repo.git"
test_proto "ssh://" ssh "ssh://remote$PWD/remote/repo.git"
test_proto "git+ssh://" ssh "git+ssh://remote$PWD/remote/repo.git"
+# Don't even bother setting up a "-remote" directory, as ssh would generally
+# complain about the bogus option rather than completing our request. Our
+# fake wrapper actually _can_ handle this case, but it's more robust to
+# simply confirm from its output that it did not run at all.
+test_expect_success 'hostnames starting with dash are rejected' '
+ test_must_fail git clone ssh://-remote/repo.git dash-host 2>stderr &&
+ ! grep ^ssh: stderr
+'
+
+test_expect_success 'setup repo with dash' '
+ git init --bare remote/-repo.git &&
+ git push remote/-repo.git HEAD
+'
+
+test_expect_success 'repo names starting with dash are rejected' '
+ test_must_fail git clone remote:-repo.git dash-path 2>stderr &&
+ ! grep ^ssh: stderr
+'
+
+test_expect_success 'full paths still work' '
+ git clone "remote:$PWD/remote/-repo.git" dash-path
+'
+
test_done