summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authorJunio C Hamano <gitster@pobox.com>2017-07-30 14:45:13 -0700
committerJunio C Hamano <gitster@pobox.com>2017-07-30 14:45:13 -0700
commit5e0649dc65fe33e8cf38823350e9d7951f6a6346 (patch)
treec858f25264da2d8bbc78f3258c4ecac3f9901c4e
parenta4f234bf9bd3fb11fb1608a507783d9412af27a9 (diff)
downloadgit-5e0649dc65fe33e8cf38823350e9d7951f6a6346.tar.gz
Signed-off-by: Junio C Hamano <gitster@pobox.com>
-rw-r--r--Documentation/RelNotes/2.7.6.txt25
-rwxr-xr-xGIT-VERSION-GEN2
l---------RelNotes2
3 files changed, 27 insertions, 2 deletions
diff --git a/Documentation/RelNotes/2.7.6.txt b/Documentation/RelNotes/2.7.6.txt
new file mode 100644
index 0000000000..4c6d1dcd4a
--- /dev/null
+++ b/Documentation/RelNotes/2.7.6.txt
@@ -0,0 +1,25 @@
+Git v2.7.6 Release Notes
+========================
+
+Fixes since v2.7.5
+------------------
+
+ * A "ssh://..." URL can result in a "ssh" command line with a
+ hostname that begins with a dash "-", which would cause the "ssh"
+ command to instead (mis)treat it as an option. This is now
+ prevented by forbidding such a hostname (which will not be
+ necessary in the real world).
+
+ * Similarly, when GIT_PROXY_COMMAND is configured, the command is
+ run with host and port that are parsed out from "ssh://..." URL;
+ a poorly written GIT_PROXY_COMMAND could be tricked into treating
+ a string that begins with a dash "-". This is now prevented by
+ forbidding such a hostname and port number (again, which will not
+ be necessary in the real world).
+
+ * In the same spirit, a repository name that begins with a dash "-"
+ is also forbidden now.
+
+Credits go to Brian Neel at GitLab, Joern Schneeweisz of Recurity
+Labs and Jeff King at GitHub.
+
diff --git a/GIT-VERSION-GEN b/GIT-VERSION-GEN
index c80681ef00..2c156bce82 100755
--- a/GIT-VERSION-GEN
+++ b/GIT-VERSION-GEN
@@ -1,7 +1,7 @@
#!/bin/sh
GVF=GIT-VERSION-FILE
-DEF_VER=v2.7.5
+DEF_VER=v2.7.6
LF='
'
diff --git a/RelNotes b/RelNotes
index 1609b5af0d..a256349b9d 120000
--- a/RelNotes
+++ b/RelNotes
@@ -1 +1 @@
-Documentation/RelNotes/2.7.5.txt \ No newline at end of file
+Documentation/RelNotes/2.7.6.txt \ No newline at end of file