2008-02-25 22:46:04 +01:00
|
|
|
#include "cache.h"
|
2018-05-16 01:42:15 +02:00
|
|
|
#include "object-store.h"
|
2018-06-29 03:21:51 +02:00
|
|
|
#include "repository.h"
|
2008-02-25 22:46:04 +01:00
|
|
|
#include "object.h"
|
|
|
|
#include "blob.h"
|
|
|
|
#include "tree.h"
|
|
|
|
#include "tree-walk.h"
|
|
|
|
#include "commit.h"
|
|
|
|
#include "tag.h"
|
|
|
|
#include "fsck.h"
|
2014-09-11 16:26:38 +02:00
|
|
|
#include "refs.h"
|
2020-04-19 05:52:34 +02:00
|
|
|
#include "url.h"
|
fsck: complain about HFS+ ".git" aliases in trees
Now that the index can block pathnames that case-fold to
".git" on HFS+, it would be helpful for fsck to notice such
problematic paths. This lets servers which use
receive.fsckObjects block them before the damage spreads.
Note that the fsck check is always on, even for systems
without core.protectHFS set. This is technically more
restrictive than we need to be, as a set of users on ext4
could happily use these odd filenames without caring about
HFS+.
However, on balance, it's helpful for all servers to block
these (because the paths can be used for mischief, and
servers which bother to fsck would want to stop the spread
whether they are on HFS+ themselves or not), and hardly
anybody will be affected (because the blocked names are
variants of .git with invisible Unicode code-points mixed
in, meaning mischief is almost certainly what the tree
author had in mind).
Ideally these would be controlled by a separate
"fsck.protectHFS" flag. However, it would be much nicer to
be able to enable/disable _any_ fsck flag individually, and
any scheme we choose should match such a system. Given the
likelihood of anybody using such a path in practice, it is
not unreasonable to wait until such a system materializes.
Signed-off-by: Jeff King <peff@peff.net>
Signed-off-by: Junio C Hamano <gitster@pobox.com>
2014-12-16 00:21:57 +01:00
|
|
|
#include "utf8.h"
|
2016-07-17 12:59:49 +02:00
|
|
|
#include "decorate.h"
|
fsck: detect gitmodules files
In preparation for performing fsck checks on .gitmodules
files, this commit plumbs in the actual detection of the
files. Note that unlike most other fsck checks, this cannot
be a property of a single object: we must know that the
object is found at a ".gitmodules" path at the root tree of
a commit.
Since the fsck code only sees one object at a time, we have
to mark the related objects to fit the puzzle together. When
we see a commit we mark its tree as a root tree, and when
we see a root tree with a .gitmodules file, we mark the
corresponding blob to be checked.
In an ideal world, we'd check the objects in topological
order: commits followed by trees followed by blobs. In that
case we can avoid ever loading an object twice, since all
markings would be complete by the time we get to the marked
objects. And indeed, if we are checking a single packfile,
this is the order in which Git will generally write the
objects. But we can't count on that:
1. git-fsck may show us the objects in arbitrary order
(loose objects are fed in sha1 order, but we may also
have multiple packs, and we process each pack fully in
sequence).
2. The type ordering is just what git-pack-objects happens
to write now. The pack format does not require a
specific order, and it's possible that future versions
of Git (or a custom version trying to fool official
Git's fsck checks!) may order it differently.
3. We may not even be fscking all of the relevant objects
at once. Consider pushing with transfer.fsckObjects,
where one push adds a blob at path "foo", and then a
second push adds the same blob at path ".gitmodules".
The blob is not part of the second push at all, but we
need to mark and check it.
So in the general case, we need to make up to three passes
over the objects: once to make sure we've seen all commits,
then once to cover any trees we might have missed, and then
a final pass to cover any .gitmodules blobs we found in the
second pass.
We can simplify things a bit by loosening the requirement
that we find .gitmodules only at root trees. Technically
a file like "subdir/.gitmodules" is not parsed by Git, but
it's not unreasonable for us to declare that Git is aware of
all ".gitmodules" files and make them eligible for checking.
That lets us drop the root-tree requirement, which
eliminates one pass entirely. And it makes our worst case
much better: instead of potentially queueing every root tree
to be re-examined, the worst case is that we queue each
unique .gitmodules blob for a second look.
This patch just adds the boilerplate to find .gitmodules
files. The actual content checks will come in a subsequent
commit.
Signed-off-by: Jeff King <peff@peff.net>
2018-05-02 23:20:08 +02:00
|
|
|
#include "oidset.h"
|
2018-05-14 18:22:48 +02:00
|
|
|
#include "packfile.h"
|
2018-05-02 23:25:27 +02:00
|
|
|
#include "submodule-config.h"
|
|
|
|
#include "config.h"
|
2020-03-11 23:48:24 +01:00
|
|
|
#include "credential.h"
|
2018-05-26 15:55:24 +02:00
|
|
|
#include "help.h"
|
fsck: detect gitmodules files
In preparation for performing fsck checks on .gitmodules
files, this commit plumbs in the actual detection of the
files. Note that unlike most other fsck checks, this cannot
be a property of a single object: we must know that the
object is found at a ".gitmodules" path at the root tree of
a commit.
Since the fsck code only sees one object at a time, we have
to mark the related objects to fit the puzzle together. When
we see a commit we mark its tree as a root tree, and when
we see a root tree with a .gitmodules file, we mark the
corresponding blob to be checked.
In an ideal world, we'd check the objects in topological
order: commits followed by trees followed by blobs. In that
case we can avoid ever loading an object twice, since all
markings would be complete by the time we get to the marked
objects. And indeed, if we are checking a single packfile,
this is the order in which Git will generally write the
objects. But we can't count on that:
1. git-fsck may show us the objects in arbitrary order
(loose objects are fed in sha1 order, but we may also
have multiple packs, and we process each pack fully in
sequence).
2. The type ordering is just what git-pack-objects happens
to write now. The pack format does not require a
specific order, and it's possible that future versions
of Git (or a custom version trying to fool official
Git's fsck checks!) may order it differently.
3. We may not even be fscking all of the relevant objects
at once. Consider pushing with transfer.fsckObjects,
where one push adds a blob at path "foo", and then a
second push adds the same blob at path ".gitmodules".
The blob is not part of the second push at all, but we
need to mark and check it.
So in the general case, we need to make up to three passes
over the objects: once to make sure we've seen all commits,
then once to cover any trees we might have missed, and then
a final pass to cover any .gitmodules blobs we found in the
second pass.
We can simplify things a bit by loosening the requirement
that we find .gitmodules only at root trees. Technically
a file like "subdir/.gitmodules" is not parsed by Git, but
it's not unreasonable for us to declare that Git is aware of
all ".gitmodules" files and make them eligible for checking.
That lets us drop the root-tree requirement, which
eliminates one pass entirely. And it makes our worst case
much better: instead of potentially queueing every root tree
to be re-examined, the worst case is that we queue each
unique .gitmodules blob for a second look.
This patch just adds the boilerplate to find .gitmodules
files. The actual content checks will come in a subsequent
commit.
Signed-off-by: Jeff King <peff@peff.net>
2018-05-02 23:20:08 +02:00
|
|
|
|
|
|
|
static struct oidset gitmodules_found = OIDSET_INIT;
|
|
|
|
static struct oidset gitmodules_done = OIDSET_INIT;
|
2008-02-25 22:46:04 +01:00
|
|
|
|
2015-06-22 17:26:42 +02:00
|
|
|
#define FSCK_FATAL -1
|
2015-06-22 17:26:54 +02:00
|
|
|
#define FSCK_INFO -2
|
2015-06-22 17:26:42 +02:00
|
|
|
|
2015-06-22 17:25:09 +02:00
|
|
|
#define FOREACH_MSG_ID(FUNC) \
|
2015-06-22 17:26:42 +02:00
|
|
|
/* fatal errors */ \
|
|
|
|
FUNC(NUL_IN_HEADER, FATAL) \
|
|
|
|
FUNC(UNTERMINATED_HEADER, FATAL) \
|
2015-06-22 17:25:09 +02:00
|
|
|
/* errors */ \
|
|
|
|
FUNC(BAD_DATE, ERROR) \
|
|
|
|
FUNC(BAD_DATE_OVERFLOW, ERROR) \
|
|
|
|
FUNC(BAD_EMAIL, ERROR) \
|
|
|
|
FUNC(BAD_NAME, ERROR) \
|
|
|
|
FUNC(BAD_OBJECT_SHA1, ERROR) \
|
|
|
|
FUNC(BAD_PARENT_SHA1, ERROR) \
|
|
|
|
FUNC(BAD_TAG_OBJECT, ERROR) \
|
|
|
|
FUNC(BAD_TIMEZONE, ERROR) \
|
|
|
|
FUNC(BAD_TREE, ERROR) \
|
|
|
|
FUNC(BAD_TREE_SHA1, ERROR) \
|
|
|
|
FUNC(BAD_TYPE, ERROR) \
|
|
|
|
FUNC(DUPLICATE_ENTRIES, ERROR) \
|
|
|
|
FUNC(MISSING_AUTHOR, ERROR) \
|
|
|
|
FUNC(MISSING_COMMITTER, ERROR) \
|
|
|
|
FUNC(MISSING_EMAIL, ERROR) \
|
|
|
|
FUNC(MISSING_NAME_BEFORE_EMAIL, ERROR) \
|
|
|
|
FUNC(MISSING_OBJECT, ERROR) \
|
|
|
|
FUNC(MISSING_SPACE_BEFORE_DATE, ERROR) \
|
|
|
|
FUNC(MISSING_SPACE_BEFORE_EMAIL, ERROR) \
|
|
|
|
FUNC(MISSING_TAG, ERROR) \
|
|
|
|
FUNC(MISSING_TAG_ENTRY, ERROR) \
|
|
|
|
FUNC(MISSING_TREE, ERROR) \
|
fsck: detect gitmodules files
In preparation for performing fsck checks on .gitmodules
files, this commit plumbs in the actual detection of the
files. Note that unlike most other fsck checks, this cannot
be a property of a single object: we must know that the
object is found at a ".gitmodules" path at the root tree of
a commit.
Since the fsck code only sees one object at a time, we have
to mark the related objects to fit the puzzle together. When
we see a commit we mark its tree as a root tree, and when
we see a root tree with a .gitmodules file, we mark the
corresponding blob to be checked.
In an ideal world, we'd check the objects in topological
order: commits followed by trees followed by blobs. In that
case we can avoid ever loading an object twice, since all
markings would be complete by the time we get to the marked
objects. And indeed, if we are checking a single packfile,
this is the order in which Git will generally write the
objects. But we can't count on that:
1. git-fsck may show us the objects in arbitrary order
(loose objects are fed in sha1 order, but we may also
have multiple packs, and we process each pack fully in
sequence).
2. The type ordering is just what git-pack-objects happens
to write now. The pack format does not require a
specific order, and it's possible that future versions
of Git (or a custom version trying to fool official
Git's fsck checks!) may order it differently.
3. We may not even be fscking all of the relevant objects
at once. Consider pushing with transfer.fsckObjects,
where one push adds a blob at path "foo", and then a
second push adds the same blob at path ".gitmodules".
The blob is not part of the second push at all, but we
need to mark and check it.
So in the general case, we need to make up to three passes
over the objects: once to make sure we've seen all commits,
then once to cover any trees we might have missed, and then
a final pass to cover any .gitmodules blobs we found in the
second pass.
We can simplify things a bit by loosening the requirement
that we find .gitmodules only at root trees. Technically
a file like "subdir/.gitmodules" is not parsed by Git, but
it's not unreasonable for us to declare that Git is aware of
all ".gitmodules" files and make them eligible for checking.
That lets us drop the root-tree requirement, which
eliminates one pass entirely. And it makes our worst case
much better: instead of potentially queueing every root tree
to be re-examined, the worst case is that we queue each
unique .gitmodules blob for a second look.
This patch just adds the boilerplate to find .gitmodules
files. The actual content checks will come in a subsequent
commit.
Signed-off-by: Jeff King <peff@peff.net>
2018-05-02 23:20:08 +02:00
|
|
|
FUNC(MISSING_TREE_OBJECT, ERROR) \
|
2015-06-22 17:25:09 +02:00
|
|
|
FUNC(MISSING_TYPE, ERROR) \
|
|
|
|
FUNC(MISSING_TYPE_ENTRY, ERROR) \
|
2015-06-22 17:26:23 +02:00
|
|
|
FUNC(MULTIPLE_AUTHORS, ERROR) \
|
2015-06-22 17:25:09 +02:00
|
|
|
FUNC(TREE_NOT_SORTED, ERROR) \
|
|
|
|
FUNC(UNKNOWN_TYPE, ERROR) \
|
|
|
|
FUNC(ZERO_PADDED_DATE, ERROR) \
|
fsck: detect gitmodules files
In preparation for performing fsck checks on .gitmodules
files, this commit plumbs in the actual detection of the
files. Note that unlike most other fsck checks, this cannot
be a property of a single object: we must know that the
object is found at a ".gitmodules" path at the root tree of
a commit.
Since the fsck code only sees one object at a time, we have
to mark the related objects to fit the puzzle together. When
we see a commit we mark its tree as a root tree, and when
we see a root tree with a .gitmodules file, we mark the
corresponding blob to be checked.
In an ideal world, we'd check the objects in topological
order: commits followed by trees followed by blobs. In that
case we can avoid ever loading an object twice, since all
markings would be complete by the time we get to the marked
objects. And indeed, if we are checking a single packfile,
this is the order in which Git will generally write the
objects. But we can't count on that:
1. git-fsck may show us the objects in arbitrary order
(loose objects are fed in sha1 order, but we may also
have multiple packs, and we process each pack fully in
sequence).
2. The type ordering is just what git-pack-objects happens
to write now. The pack format does not require a
specific order, and it's possible that future versions
of Git (or a custom version trying to fool official
Git's fsck checks!) may order it differently.
3. We may not even be fscking all of the relevant objects
at once. Consider pushing with transfer.fsckObjects,
where one push adds a blob at path "foo", and then a
second push adds the same blob at path ".gitmodules".
The blob is not part of the second push at all, but we
need to mark and check it.
So in the general case, we need to make up to three passes
over the objects: once to make sure we've seen all commits,
then once to cover any trees we might have missed, and then
a final pass to cover any .gitmodules blobs we found in the
second pass.
We can simplify things a bit by loosening the requirement
that we find .gitmodules only at root trees. Technically
a file like "subdir/.gitmodules" is not parsed by Git, but
it's not unreasonable for us to declare that Git is aware of
all ".gitmodules" files and make them eligible for checking.
That lets us drop the root-tree requirement, which
eliminates one pass entirely. And it makes our worst case
much better: instead of potentially queueing every root tree
to be re-examined, the worst case is that we queue each
unique .gitmodules blob for a second look.
This patch just adds the boilerplate to find .gitmodules
files. The actual content checks will come in a subsequent
commit.
Signed-off-by: Jeff King <peff@peff.net>
2018-05-02 23:20:08 +02:00
|
|
|
FUNC(GITMODULES_MISSING, ERROR) \
|
|
|
|
FUNC(GITMODULES_BLOB, ERROR) \
|
2018-07-13 21:39:53 +02:00
|
|
|
FUNC(GITMODULES_LARGE, ERROR) \
|
2018-05-02 23:25:27 +02:00
|
|
|
FUNC(GITMODULES_NAME, ERROR) \
|
2018-05-05 02:03:35 +02:00
|
|
|
FUNC(GITMODULES_SYMLINK, ERROR) \
|
2018-09-24 10:37:17 +02:00
|
|
|
FUNC(GITMODULES_URL, ERROR) \
|
fsck: detect submodule paths starting with dash
As with urls, submodule paths with dashes are ignored by
git, but may end up confusing older versions. Detecting them
via fsck lets us prevent modern versions of git from being a
vector to spread broken .gitmodules to older versions.
Compared to blocking leading-dash urls, though, this
detection may be less of a good idea:
1. While such paths provide confusing and broken results,
they don't seem to actually work as option injections
against anything except "cd". In particular, the
submodule code seems to canonicalize to an absolute
path before running "git clone" (so it passes
/your/clone/-sub).
2. It's more likely that we may one day make such names
actually work correctly. Even after we revert this fsck
check, it will continue to be a hassle until hosting
servers are all updated.
On the other hand, it's not entirely clear that the behavior
in older versions is safe. And if we do want to eventually
allow this, we may end up doing so with a special syntax
anyway (e.g., writing "./-sub" in the .gitmodules file, and
teaching the submodule code to canonicalize it when
comparing).
So on balance, this is probably a good protection.
Signed-off-by: Jeff King <peff@peff.net>
Signed-off-by: Junio C Hamano <gitster@pobox.com>
2018-09-24 10:42:19 +02:00
|
|
|
FUNC(GITMODULES_PATH, ERROR) \
|
2019-12-05 10:30:43 +01:00
|
|
|
FUNC(GITMODULES_UPDATE, ERROR) \
|
2015-06-22 17:25:09 +02:00
|
|
|
/* warnings */ \
|
|
|
|
FUNC(BAD_FILEMODE, WARN) \
|
|
|
|
FUNC(EMPTY_NAME, WARN) \
|
|
|
|
FUNC(FULL_PATHNAME, WARN) \
|
|
|
|
FUNC(HAS_DOT, WARN) \
|
|
|
|
FUNC(HAS_DOTDOT, WARN) \
|
|
|
|
FUNC(HAS_DOTGIT, WARN) \
|
|
|
|
FUNC(NULL_SHA1, WARN) \
|
2015-06-22 17:26:54 +02:00
|
|
|
FUNC(ZERO_PADDED_FILEMODE, WARN) \
|
2016-04-14 19:58:22 +02:00
|
|
|
FUNC(NUL_IN_COMMIT, WARN) \
|
2015-06-22 17:26:54 +02:00
|
|
|
/* infos (reported as warnings, but ignored by default) */ \
|
fsck: downgrade gitmodulesParse default to "info"
We added an fsck check in ed8b10f631 (fsck: check
.gitmodules content, 2018-05-02) as a defense against the
vulnerability from 0383bbb901 (submodule-config: verify
submodule names as paths, 2018-04-30). With the idea that
up-to-date hosting sites could protect downstream unpatched
clients that fetch from them.
As part of that defense, we reject any ".gitmodules" entry
that is not syntactically valid. The theory is that if we
cannot even parse the file, we cannot accurately check it
for vulnerabilities. And anybody with a broken .gitmodules
file would eventually want to know anyway.
But there are a few reasons this is a bad tradeoff in
practice:
- for this particular vulnerability, the client has to be
able to parse the file. So you cannot sneak an attack
through using a broken file, assuming the config parsers
for the process running fsck and the eventual victim are
functionally equivalent.
- a broken .gitmodules file is not necessarily a problem.
Our fsck check detects .gitmodules in _any_ tree, not
just at the root. And the presence of a .gitmodules file
does not necessarily mean it will be used; you'd have to
also have gitlinks in the tree. The cgit repository, for
example, has a file named .gitmodules from a
pre-submodule attempt at sharing code, but does not
actually have any gitlinks.
- when the fsck check is used to reject a push, it's often
hard to work around. The pusher may not have full control
over the destination repository (e.g., if it's on a
hosting server, they may need to contact the hosting
site's support). And the broken .gitmodules may be too
far back in history for rewriting to be feasible (again,
this is an issue for cgit).
So we're being unnecessarily restrictive without actually
improving the security in a meaningful way. It would be more
convenient to downgrade this check to "info", which means
we'd still comment on it, but not reject a push. Site admins
can already do this via config, but we should ship sensible
defaults.
There are a few counterpoints to consider in favor of
keeping the check as an error:
- the first point above assumes that the config parsers for
the victim and the fsck process are equivalent. This is
pretty true now, but as time goes on will become less so.
Hosting sites are likely to upgrade their version of Git,
whereas vulnerable clients will be stagnant (if they did
upgrade, they'd cease to be vulnerable!). So in theory we
may see drift over time between what two config parsers
will accept.
In practice, this is probably OK. The config format is
pretty established at this point and shouldn't change a
lot. And the farther we get from the announcement of the
vulnerability, the less interesting this extra layer of
protection becomes. I.e., it was _most_ valuable on day
0, when everybody's client was still vulnerable and
hosting sites could protect people. But as time goes on
and people upgrade, the population of vulnerable clients
becomes smaller and smaller.
- In theory this could protect us from other
vulnerabilities in the future. E.g., .gitmodules are the
only way for a malicious repository to feed data to the
config parser, so this check could similarly protect
clients from a future (to-be-found) bug there.
But that's trading a hypothetical case for real-world
pain today. If we do find such a bug, the hosting site
would need to be updated to fix it, too. At which point
we could figure out whether it's possible to detect
_just_ the malicious case without hurting existing
broken-but-not-evil cases.
- Until recently, we hadn't made any restrictions on
.gitmodules content. So now in tightening that we're
hitting cases where certain things used to work, but
don't anymore. There's some moderate pain now. But as
time goes on, we'll see more (and more varied) cases that
will make tightening harder in the future. So there's
some argument for putting rules in place _now_, before
users grow more cases that violate them.
Again, this is trading pain now for hypothetical benefit
in the future. And if we try hard in the future to keep
our tightening to a minimum (i.e., rejecting true
maliciousness without hurting broken-but-not-evil repos),
then that reduces even the hypothetical benefit.
Considering both sets of arguments, it makes sense to loosen
this check for now.
Note that we have to tweak the test in t7415 since fsck will
no longer consider this a fatal error. But we still check
that it reports the warning, and that we don't get the
spurious error from the config code.
Signed-off-by: Jeff King <peff@peff.net>
Signed-off-by: Junio C Hamano <gitster@pobox.com>
2018-07-13 21:39:58 +02:00
|
|
|
FUNC(GITMODULES_PARSE, INFO) \
|
2015-06-22 17:26:54 +02:00
|
|
|
FUNC(BAD_TAG_NAME, INFO) \
|
mktag: use fsck instead of custom verify_tag()
Change the validation logic in "mktag" to use fsck's fsck_tag()
instead of its own custom parser. Curiously the logic for both dates
back to the same commit[1]. Let's unify them so we're not maintaining
two sets functions to verify that a tag is OK.
The behavior of fsck_tag() and the old "mktag" code being removed here
is different in few aspects.
I think it makes sense to remove some of those checks, namely:
A. fsck only cares that the timezone matches [-+][0-9]{4}. The mktag
code disallowed values larger than 1400.
Yes there's currently no timezone with a greater offset[2], but
since we allow any number of non-offical timezones (e.g. +1234)
passing this through seems fine. Git also won't break in the
future if e.g. French Polynesia decides it needs to outdo the Line
Islands when it comes to timezone extravagance.
B. fsck allows missing author names such as "tagger <email>", mktag
wouldn't, but would allow e.g. "tagger [2 spaces] <email>" (but
not "tagger [1 space] <email>"). Now we allow all of these.
C. Like B, but "mktag" disallowed spaces in the <email> part, fsck
allows it.
In some ways fsck_tag() is stricter than "mktag" was, namely:
D. fsck disallows zero-padded dates, but mktag didn't care. So
e.g. the timestamp "0000000000 +0000" produces an error now. A
test in "t1006-cat-file.sh" relied on this, it's been changed to
use "hash-object" (without fsck) instead.
There was one check I deemed worth keeping by porting it over to
fsck_tag():
E. "mktag" did not allow any custom headers, and by extension (as an
empty commit is allowed) also forbade an extra stray trailing
newline after the headers it knew about.
Add a new check in the "ignore" category to fsck and use it. This
somewhat abuses the facility added in efaba7cc77f (fsck:
optionally ignore specific fsck issues completely, 2015-06-22).
This is somewhat of hack, but probably the least invasive change
we can make here. The fsck command will shuffle these categories
around, e.g. under --strict the "info" becomes a "warn" and "warn"
becomes "error". Existing users of fsck's (and others,
e.g. index-pack) --strict option rely on this.
So we need to put something into a category that'll be ignored by
all existing users of the API. Pretending that
fsck.extraHeaderEntry=error ("ignore" by default) was set serves
to do this for us.
1. ec4465adb38 (Add "tag" objects that can be used to sign other
objects., 2005-04-25)
2. https://en.wikipedia.org/wiki/List_of_UTC_time_offsets
Signed-off-by: Ævar Arnfjörð Bjarmason <avarab@gmail.com>
Signed-off-by: Junio C Hamano <gitster@pobox.com>
2021-01-05 20:42:46 +01:00
|
|
|
FUNC(MISSING_TAGGER_ENTRY, INFO) \
|
|
|
|
/* ignored (elevated when requested) */ \
|
|
|
|
FUNC(EXTRA_HEADER_ENTRY, IGNORE)
|
2015-06-22 17:25:09 +02:00
|
|
|
|
|
|
|
#define MSG_ID(id, msg_type) FSCK_MSG_##id,
|
|
|
|
enum fsck_msg_id {
|
|
|
|
FOREACH_MSG_ID(MSG_ID)
|
|
|
|
FSCK_MSG_MAX
|
|
|
|
};
|
|
|
|
#undef MSG_ID
|
|
|
|
|
2015-06-22 17:25:14 +02:00
|
|
|
#define STR(x) #x
|
2018-05-26 15:55:25 +02:00
|
|
|
#define MSG_ID(id, msg_type) { STR(id), NULL, NULL, FSCK_##msg_type },
|
2015-06-22 17:25:09 +02:00
|
|
|
static struct {
|
2015-06-22 17:25:14 +02:00
|
|
|
const char *id_string;
|
|
|
|
const char *downcased;
|
2018-05-26 15:55:25 +02:00
|
|
|
const char *camelcased;
|
2015-06-22 17:25:09 +02:00
|
|
|
int msg_type;
|
|
|
|
} msg_id_info[FSCK_MSG_MAX + 1] = {
|
|
|
|
FOREACH_MSG_ID(MSG_ID)
|
2018-05-26 15:55:25 +02:00
|
|
|
{ NULL, NULL, NULL, -1 }
|
2015-06-22 17:25:09 +02:00
|
|
|
};
|
|
|
|
#undef MSG_ID
|
|
|
|
|
2018-05-26 15:55:23 +02:00
|
|
|
static void prepare_msg_ids(void)
|
2015-06-22 17:25:14 +02:00
|
|
|
{
|
|
|
|
int i;
|
|
|
|
|
2018-05-26 15:55:23 +02:00
|
|
|
if (msg_id_info[0].downcased)
|
|
|
|
return;
|
|
|
|
|
|
|
|
/* convert id_string to lower case, without underscores. */
|
|
|
|
for (i = 0; i < FSCK_MSG_MAX; i++) {
|
|
|
|
const char *p = msg_id_info[i].id_string;
|
|
|
|
int len = strlen(p);
|
|
|
|
char *q = xmalloc(len);
|
|
|
|
|
|
|
|
msg_id_info[i].downcased = q;
|
|
|
|
while (*p)
|
|
|
|
if (*p == '_')
|
|
|
|
p++;
|
|
|
|
else
|
|
|
|
*(q)++ = tolower(*(p)++);
|
|
|
|
*q = '\0';
|
2018-05-26 15:55:25 +02:00
|
|
|
|
|
|
|
p = msg_id_info[i].id_string;
|
|
|
|
q = xmalloc(len);
|
|
|
|
msg_id_info[i].camelcased = q;
|
|
|
|
while (*p) {
|
|
|
|
if (*p == '_') {
|
|
|
|
p++;
|
|
|
|
if (*p)
|
|
|
|
*q++ = *p++;
|
|
|
|
} else {
|
|
|
|
*q++ = tolower(*p++);
|
|
|
|
}
|
2015-06-22 17:25:14 +02:00
|
|
|
}
|
2018-05-26 15:55:25 +02:00
|
|
|
*q = '\0';
|
2015-06-22 17:25:14 +02:00
|
|
|
}
|
2018-05-26 15:55:23 +02:00
|
|
|
}
|
|
|
|
|
|
|
|
static int parse_msg_id(const char *text)
|
|
|
|
{
|
|
|
|
int i;
|
|
|
|
|
|
|
|
prepare_msg_ids();
|
2015-06-22 17:25:14 +02:00
|
|
|
|
|
|
|
for (i = 0; i < FSCK_MSG_MAX; i++)
|
|
|
|
if (!strcmp(text, msg_id_info[i].downcased))
|
|
|
|
return i;
|
|
|
|
|
|
|
|
return -1;
|
|
|
|
}
|
|
|
|
|
2018-05-26 15:55:24 +02:00
|
|
|
void list_config_fsck_msg_ids(struct string_list *list, const char *prefix)
|
|
|
|
{
|
|
|
|
int i;
|
|
|
|
|
|
|
|
prepare_msg_ids();
|
|
|
|
|
|
|
|
for (i = 0; i < FSCK_MSG_MAX; i++)
|
2018-05-26 15:55:25 +02:00
|
|
|
list_config_item(list, prefix, msg_id_info[i].camelcased);
|
2018-05-26 15:55:24 +02:00
|
|
|
}
|
|
|
|
|
2015-06-22 17:25:09 +02:00
|
|
|
static int fsck_msg_type(enum fsck_msg_id msg_id,
|
|
|
|
struct fsck_options *options)
|
|
|
|
{
|
|
|
|
int msg_type;
|
|
|
|
|
2015-06-22 17:25:25 +02:00
|
|
|
assert(msg_id >= 0 && msg_id < FSCK_MSG_MAX);
|
|
|
|
|
|
|
|
if (options->msg_type)
|
|
|
|
msg_type = options->msg_type[msg_id];
|
|
|
|
else {
|
|
|
|
msg_type = msg_id_info[msg_id].msg_type;
|
|
|
|
if (options->strict && msg_type == FSCK_WARN)
|
|
|
|
msg_type = FSCK_ERROR;
|
|
|
|
}
|
2015-06-22 17:25:09 +02:00
|
|
|
|
|
|
|
return msg_type;
|
|
|
|
}
|
|
|
|
|
2015-06-22 17:25:25 +02:00
|
|
|
static int parse_msg_type(const char *str)
|
|
|
|
{
|
|
|
|
if (!strcmp(str, "error"))
|
|
|
|
return FSCK_ERROR;
|
|
|
|
else if (!strcmp(str, "warn"))
|
|
|
|
return FSCK_WARN;
|
2015-06-22 17:26:48 +02:00
|
|
|
else if (!strcmp(str, "ignore"))
|
|
|
|
return FSCK_IGNORE;
|
2015-06-22 17:25:25 +02:00
|
|
|
else
|
|
|
|
die("Unknown fsck message type: '%s'", str);
|
|
|
|
}
|
|
|
|
|
2015-06-22 17:25:31 +02:00
|
|
|
int is_valid_msg_type(const char *msg_id, const char *msg_type)
|
|
|
|
{
|
|
|
|
if (parse_msg_id(msg_id) < 0)
|
|
|
|
return 0;
|
|
|
|
parse_msg_type(msg_type);
|
|
|
|
return 1;
|
|
|
|
}
|
|
|
|
|
2015-06-22 17:25:25 +02:00
|
|
|
void fsck_set_msg_type(struct fsck_options *options,
|
|
|
|
const char *msg_id, const char *msg_type)
|
|
|
|
{
|
|
|
|
int id = parse_msg_id(msg_id), type;
|
|
|
|
|
|
|
|
if (id < 0)
|
|
|
|
die("Unhandled message id: %s", msg_id);
|
|
|
|
type = parse_msg_type(msg_type);
|
|
|
|
|
2015-06-22 17:26:42 +02:00
|
|
|
if (type != FSCK_ERROR && msg_id_info[id].msg_type == FSCK_FATAL)
|
|
|
|
die("Cannot demote %s to %s", msg_id, msg_type);
|
|
|
|
|
2015-06-22 17:25:25 +02:00
|
|
|
if (!options->msg_type) {
|
|
|
|
int i;
|
2016-02-22 23:44:25 +01:00
|
|
|
int *msg_type;
|
|
|
|
ALLOC_ARRAY(msg_type, FSCK_MSG_MAX);
|
2015-06-22 17:25:25 +02:00
|
|
|
for (i = 0; i < FSCK_MSG_MAX; i++)
|
|
|
|
msg_type[i] = fsck_msg_type(i, options);
|
|
|
|
options->msg_type = msg_type;
|
|
|
|
}
|
|
|
|
|
|
|
|
options->msg_type[id] = type;
|
|
|
|
}
|
|
|
|
|
|
|
|
void fsck_set_msg_types(struct fsck_options *options, const char *values)
|
|
|
|
{
|
|
|
|
char *buf = xstrdup(values), *to_free = buf;
|
|
|
|
int done = 0;
|
|
|
|
|
|
|
|
while (!done) {
|
|
|
|
int len = strcspn(buf, " ,|"), equal;
|
|
|
|
|
|
|
|
done = !buf[len];
|
|
|
|
if (!len) {
|
|
|
|
buf++;
|
|
|
|
continue;
|
|
|
|
}
|
|
|
|
buf[len] = '\0';
|
|
|
|
|
|
|
|
for (equal = 0;
|
|
|
|
equal < len && buf[equal] != '=' && buf[equal] != ':';
|
|
|
|
equal++)
|
|
|
|
buf[equal] = tolower(buf[equal]);
|
|
|
|
buf[equal] = '\0';
|
|
|
|
|
2015-06-22 17:27:18 +02:00
|
|
|
if (!strcmp(buf, "skiplist")) {
|
|
|
|
if (equal == len)
|
|
|
|
die("skiplist requires a path");
|
2019-05-15 23:44:56 +02:00
|
|
|
oidset_parse_file(&options->skiplist, buf + equal + 1);
|
2015-06-22 17:27:18 +02:00
|
|
|
buf += len + 1;
|
|
|
|
continue;
|
|
|
|
}
|
|
|
|
|
2015-06-22 17:25:25 +02:00
|
|
|
if (equal == len)
|
|
|
|
die("Missing '=': '%s'", buf);
|
2008-02-25 22:46:04 +01:00
|
|
|
|
2015-06-22 17:25:25 +02:00
|
|
|
fsck_set_msg_type(options, buf, buf + equal + 1);
|
|
|
|
buf += len + 1;
|
|
|
|
}
|
|
|
|
free(to_free);
|
|
|
|
}
|
|
|
|
|
2015-06-22 17:25:52 +02:00
|
|
|
static void append_msg_id(struct strbuf *sb, const char *msg_id)
|
|
|
|
{
|
|
|
|
for (;;) {
|
|
|
|
char c = *(msg_id)++;
|
|
|
|
|
|
|
|
if (!c)
|
|
|
|
break;
|
|
|
|
if (c != '_')
|
|
|
|
strbuf_addch(sb, tolower(c));
|
|
|
|
else {
|
|
|
|
assert(*msg_id);
|
|
|
|
strbuf_addch(sb, *(msg_id)++);
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
|
|
|
strbuf_addstr(sb, ": ");
|
|
|
|
}
|
|
|
|
|
2019-10-18 06:58:51 +02:00
|
|
|
static int object_on_skiplist(struct fsck_options *opts,
|
|
|
|
const struct object_id *oid)
|
fsck: check skiplist for object in fsck_blob()
Since commit ed8b10f631 ("fsck: check .gitmodules content", 2018-05-02),
fsck will issue an error message for '.gitmodules' content that cannot
be parsed correctly. This is the case, even when the corresponding blob
object has been included on the skiplist. For example, using the cgit
repository, we see the following:
$ git fsck
Checking object directories: 100% (256/256), done.
error: bad config line 5 in blob .gitmodules
error in blob 51dd1eff1edc663674df9ab85d2786a40f7ae3a5: gitmodulesParse: could not parse gitmodules blob
Checking objects: 100% (6626/6626), done.
$
$ git config fsck.skiplist '.git/skip'
$ echo 51dd1eff1edc663674df9ab85d2786a40f7ae3a5 >.git/skip
$
$ git fsck
Checking object directories: 100% (256/256), done.
error: bad config line 5 in blob .gitmodules
Checking objects: 100% (6626/6626), done.
$
Note that the error message issued by the config parser is still
present, despite adding the object-id of the blob to the skiplist.
One solution would be to provide a means of suppressing the messages
issued by the config parser. However, given that (logically) we are
asking fsck to ignore this object, a simpler approach is to just not
call the config parser if the object is to be skipped. Add a check to
the 'fsck_blob()' processing function, to determine if the object is
on the skiplist and, if so, exit the function early.
Signed-off-by: Ramsay Jones <ramsay@ramsayjones.plus.com>
Signed-off-by: Junio C Hamano <gitster@pobox.com>
2018-06-27 20:39:53 +02:00
|
|
|
{
|
2019-10-18 06:58:51 +02:00
|
|
|
return opts && oid && oidset_contains(&opts->skiplist, oid);
|
fsck: check skiplist for object in fsck_blob()
Since commit ed8b10f631 ("fsck: check .gitmodules content", 2018-05-02),
fsck will issue an error message for '.gitmodules' content that cannot
be parsed correctly. This is the case, even when the corresponding blob
object has been included on the skiplist. For example, using the cgit
repository, we see the following:
$ git fsck
Checking object directories: 100% (256/256), done.
error: bad config line 5 in blob .gitmodules
error in blob 51dd1eff1edc663674df9ab85d2786a40f7ae3a5: gitmodulesParse: could not parse gitmodules blob
Checking objects: 100% (6626/6626), done.
$
$ git config fsck.skiplist '.git/skip'
$ echo 51dd1eff1edc663674df9ab85d2786a40f7ae3a5 >.git/skip
$
$ git fsck
Checking object directories: 100% (256/256), done.
error: bad config line 5 in blob .gitmodules
Checking objects: 100% (6626/6626), done.
$
Note that the error message issued by the config parser is still
present, despite adding the object-id of the blob to the skiplist.
One solution would be to provide a means of suppressing the messages
issued by the config parser. However, given that (logically) we are
asking fsck to ignore this object, a simpler approach is to just not
call the config parser if the object is to be skipped. Add a check to
the 'fsck_blob()' processing function, to determine if the object is
on the skiplist and, if so, exit the function early.
Signed-off-by: Ramsay Jones <ramsay@ramsayjones.plus.com>
Signed-off-by: Junio C Hamano <gitster@pobox.com>
2018-06-27 20:39:53 +02:00
|
|
|
}
|
|
|
|
|
2019-10-18 06:59:15 +02:00
|
|
|
__attribute__((format (printf, 5, 6)))
|
|
|
|
static int report(struct fsck_options *options,
|
|
|
|
const struct object_id *oid, enum object_type object_type,
|
|
|
|
enum fsck_msg_id id, const char *fmt, ...)
|
2015-06-22 17:25:09 +02:00
|
|
|
{
|
|
|
|
va_list ap;
|
|
|
|
struct strbuf sb = STRBUF_INIT;
|
|
|
|
int msg_type = fsck_msg_type(id, options), result;
|
|
|
|
|
2015-06-22 17:26:48 +02:00
|
|
|
if (msg_type == FSCK_IGNORE)
|
|
|
|
return 0;
|
|
|
|
|
2019-10-18 06:59:15 +02:00
|
|
|
if (object_on_skiplist(options, oid))
|
2015-06-22 17:27:18 +02:00
|
|
|
return 0;
|
|
|
|
|
2015-06-22 17:26:42 +02:00
|
|
|
if (msg_type == FSCK_FATAL)
|
|
|
|
msg_type = FSCK_ERROR;
|
2015-06-22 17:26:54 +02:00
|
|
|
else if (msg_type == FSCK_INFO)
|
|
|
|
msg_type = FSCK_WARN;
|
2015-06-22 17:26:42 +02:00
|
|
|
|
2015-06-22 17:25:52 +02:00
|
|
|
append_msg_id(&sb, msg_id_info[id].id_string);
|
|
|
|
|
2015-06-22 17:25:09 +02:00
|
|
|
va_start(ap, fmt);
|
|
|
|
strbuf_vaddf(&sb, fmt, ap);
|
2019-10-18 06:59:15 +02:00
|
|
|
result = options->error_func(options, oid, object_type,
|
2019-10-18 06:58:40 +02:00
|
|
|
msg_type, sb.buf);
|
2015-06-22 17:25:09 +02:00
|
|
|
strbuf_release(&sb);
|
|
|
|
va_end(ap);
|
|
|
|
|
|
|
|
return result;
|
|
|
|
}
|
|
|
|
|
fsck: unify object-name code
Commit 90cf590f53 (fsck: optionally show more helpful info for broken
links, 2016-07-17) added a system for decorating objects with names. The
code is split across builtin/fsck.c (which gives the initial names) and
fsck.c (which adds to the names as it traverses the object graph). This
leads to some duplication, where both sites have near-identical
describe_object() functions (the difference being that the one in
builtin/fsck.c uses a circular array of buffers to allow multiple calls
in a single printf).
Let's provide a unified object_name API for fsck. That lets us drop the
duplication, as well as making the interface boundaries more clear
(which will let us refactor the implementation more in a future patch).
We'll leave describe_object() in builtin/fsck.c as a thin wrapper around
the new API, as it relies on a static global to make its many callers a
bit shorter.
We'll also convert the bare add_decoration() calls in builtin/fsck.c to
put_object_name(). This fixes two minor bugs:
1. We leak many small strings. add_decoration() has a last-one-wins
approach: it updates the decoration to the new string and returns
the old one. But we ignore the return value, leaking the old
string. This is quite common to trigger, since we look at reflogs:
the tip of any ref will be described both by looking at the actual
ref, as well as the latest reflog entry. So we'd always end up
leaking one of those strings.
2. The last-one-wins approach gives us lousy names. For instance, we
first look at all of the refs, and then all of the reflogs. So
rather than seeing "refs/heads/master", we're likely to overwrite
it with "HEAD@{12345678}". We're generally better off using the
first name we find.
And indeed, the test in t1450 expects this ugly HEAD@{} name. After
this patch, we've switched to using fsck_put_object_name()'s
first-one-wins semantics, and we output the more human-friendly
"refs/tags/julius" (and the test is updated accordingly).
Signed-off-by: Jeff King <peff@peff.net>
Signed-off-by: Junio C Hamano <gitster@pobox.com>
2019-10-18 06:56:13 +02:00
|
|
|
void fsck_enable_object_names(struct fsck_options *options)
|
|
|
|
{
|
|
|
|
if (!options->object_names)
|
2019-10-18 06:57:37 +02:00
|
|
|
options->object_names = kh_init_oid_map();
|
fsck: unify object-name code
Commit 90cf590f53 (fsck: optionally show more helpful info for broken
links, 2016-07-17) added a system for decorating objects with names. The
code is split across builtin/fsck.c (which gives the initial names) and
fsck.c (which adds to the names as it traverses the object graph). This
leads to some duplication, where both sites have near-identical
describe_object() functions (the difference being that the one in
builtin/fsck.c uses a circular array of buffers to allow multiple calls
in a single printf).
Let's provide a unified object_name API for fsck. That lets us drop the
duplication, as well as making the interface boundaries more clear
(which will let us refactor the implementation more in a future patch).
We'll leave describe_object() in builtin/fsck.c as a thin wrapper around
the new API, as it relies on a static global to make its many callers a
bit shorter.
We'll also convert the bare add_decoration() calls in builtin/fsck.c to
put_object_name(). This fixes two minor bugs:
1. We leak many small strings. add_decoration() has a last-one-wins
approach: it updates the decoration to the new string and returns
the old one. But we ignore the return value, leaking the old
string. This is quite common to trigger, since we look at reflogs:
the tip of any ref will be described both by looking at the actual
ref, as well as the latest reflog entry. So we'd always end up
leaking one of those strings.
2. The last-one-wins approach gives us lousy names. For instance, we
first look at all of the refs, and then all of the reflogs. So
rather than seeing "refs/heads/master", we're likely to overwrite
it with "HEAD@{12345678}". We're generally better off using the
first name we find.
And indeed, the test in t1450 expects this ugly HEAD@{} name. After
this patch, we've switched to using fsck_put_object_name()'s
first-one-wins semantics, and we output the more human-friendly
"refs/tags/julius" (and the test is updated accordingly).
Signed-off-by: Jeff King <peff@peff.net>
Signed-off-by: Junio C Hamano <gitster@pobox.com>
2019-10-18 06:56:13 +02:00
|
|
|
}
|
|
|
|
|
2019-10-18 06:57:37 +02:00
|
|
|
const char *fsck_get_object_name(struct fsck_options *options,
|
|
|
|
const struct object_id *oid)
|
2016-07-17 12:59:49 +02:00
|
|
|
{
|
2019-10-18 06:57:37 +02:00
|
|
|
khiter_t pos;
|
2016-07-17 12:59:49 +02:00
|
|
|
if (!options->object_names)
|
|
|
|
return NULL;
|
2019-10-18 06:57:37 +02:00
|
|
|
pos = kh_get_oid_map(options->object_names, *oid);
|
|
|
|
if (pos >= kh_end(options->object_names))
|
|
|
|
return NULL;
|
|
|
|
return kh_value(options->object_names, pos);
|
2016-07-17 12:59:49 +02:00
|
|
|
}
|
|
|
|
|
2019-10-18 06:57:37 +02:00
|
|
|
void fsck_put_object_name(struct fsck_options *options,
|
|
|
|
const struct object_id *oid,
|
fsck: unify object-name code
Commit 90cf590f53 (fsck: optionally show more helpful info for broken
links, 2016-07-17) added a system for decorating objects with names. The
code is split across builtin/fsck.c (which gives the initial names) and
fsck.c (which adds to the names as it traverses the object graph). This
leads to some duplication, where both sites have near-identical
describe_object() functions (the difference being that the one in
builtin/fsck.c uses a circular array of buffers to allow multiple calls
in a single printf).
Let's provide a unified object_name API for fsck. That lets us drop the
duplication, as well as making the interface boundaries more clear
(which will let us refactor the implementation more in a future patch).
We'll leave describe_object() in builtin/fsck.c as a thin wrapper around
the new API, as it relies on a static global to make its many callers a
bit shorter.
We'll also convert the bare add_decoration() calls in builtin/fsck.c to
put_object_name(). This fixes two minor bugs:
1. We leak many small strings. add_decoration() has a last-one-wins
approach: it updates the decoration to the new string and returns
the old one. But we ignore the return value, leaking the old
string. This is quite common to trigger, since we look at reflogs:
the tip of any ref will be described both by looking at the actual
ref, as well as the latest reflog entry. So we'd always end up
leaking one of those strings.
2. The last-one-wins approach gives us lousy names. For instance, we
first look at all of the refs, and then all of the reflogs. So
rather than seeing "refs/heads/master", we're likely to overwrite
it with "HEAD@{12345678}". We're generally better off using the
first name we find.
And indeed, the test in t1450 expects this ugly HEAD@{} name. After
this patch, we've switched to using fsck_put_object_name()'s
first-one-wins semantics, and we output the more human-friendly
"refs/tags/julius" (and the test is updated accordingly).
Signed-off-by: Jeff King <peff@peff.net>
Signed-off-by: Junio C Hamano <gitster@pobox.com>
2019-10-18 06:56:13 +02:00
|
|
|
const char *fmt, ...)
|
2016-07-17 12:59:49 +02:00
|
|
|
{
|
|
|
|
va_list ap;
|
|
|
|
struct strbuf buf = STRBUF_INIT;
|
2019-10-18 06:57:37 +02:00
|
|
|
khiter_t pos;
|
|
|
|
int hashret;
|
2016-07-17 12:59:49 +02:00
|
|
|
|
|
|
|
if (!options->object_names)
|
|
|
|
return;
|
2019-10-18 06:57:37 +02:00
|
|
|
|
|
|
|
pos = kh_put_oid_map(options->object_names, *oid, &hashret);
|
|
|
|
if (!hashret)
|
2016-07-17 12:59:49 +02:00
|
|
|
return;
|
|
|
|
va_start(ap, fmt);
|
|
|
|
strbuf_vaddf(&buf, fmt, ap);
|
2019-10-18 06:57:37 +02:00
|
|
|
kh_value(options->object_names, pos) = strbuf_detach(&buf, NULL);
|
2016-07-17 12:59:49 +02:00
|
|
|
va_end(ap);
|
|
|
|
}
|
|
|
|
|
fsck: unify object-name code
Commit 90cf590f53 (fsck: optionally show more helpful info for broken
links, 2016-07-17) added a system for decorating objects with names. The
code is split across builtin/fsck.c (which gives the initial names) and
fsck.c (which adds to the names as it traverses the object graph). This
leads to some duplication, where both sites have near-identical
describe_object() functions (the difference being that the one in
builtin/fsck.c uses a circular array of buffers to allow multiple calls
in a single printf).
Let's provide a unified object_name API for fsck. That lets us drop the
duplication, as well as making the interface boundaries more clear
(which will let us refactor the implementation more in a future patch).
We'll leave describe_object() in builtin/fsck.c as a thin wrapper around
the new API, as it relies on a static global to make its many callers a
bit shorter.
We'll also convert the bare add_decoration() calls in builtin/fsck.c to
put_object_name(). This fixes two minor bugs:
1. We leak many small strings. add_decoration() has a last-one-wins
approach: it updates the decoration to the new string and returns
the old one. But we ignore the return value, leaking the old
string. This is quite common to trigger, since we look at reflogs:
the tip of any ref will be described both by looking at the actual
ref, as well as the latest reflog entry. So we'd always end up
leaking one of those strings.
2. The last-one-wins approach gives us lousy names. For instance, we
first look at all of the refs, and then all of the reflogs. So
rather than seeing "refs/heads/master", we're likely to overwrite
it with "HEAD@{12345678}". We're generally better off using the
first name we find.
And indeed, the test in t1450 expects this ugly HEAD@{} name. After
this patch, we've switched to using fsck_put_object_name()'s
first-one-wins semantics, and we output the more human-friendly
"refs/tags/julius" (and the test is updated accordingly).
Signed-off-by: Jeff King <peff@peff.net>
Signed-off-by: Junio C Hamano <gitster@pobox.com>
2019-10-18 06:56:13 +02:00
|
|
|
const char *fsck_describe_object(struct fsck_options *options,
|
2019-10-18 06:57:37 +02:00
|
|
|
const struct object_id *oid)
|
2016-07-17 13:00:02 +02:00
|
|
|
{
|
fsck: unify object-name code
Commit 90cf590f53 (fsck: optionally show more helpful info for broken
links, 2016-07-17) added a system for decorating objects with names. The
code is split across builtin/fsck.c (which gives the initial names) and
fsck.c (which adds to the names as it traverses the object graph). This
leads to some duplication, where both sites have near-identical
describe_object() functions (the difference being that the one in
builtin/fsck.c uses a circular array of buffers to allow multiple calls
in a single printf).
Let's provide a unified object_name API for fsck. That lets us drop the
duplication, as well as making the interface boundaries more clear
(which will let us refactor the implementation more in a future patch).
We'll leave describe_object() in builtin/fsck.c as a thin wrapper around
the new API, as it relies on a static global to make its many callers a
bit shorter.
We'll also convert the bare add_decoration() calls in builtin/fsck.c to
put_object_name(). This fixes two minor bugs:
1. We leak many small strings. add_decoration() has a last-one-wins
approach: it updates the decoration to the new string and returns
the old one. But we ignore the return value, leaking the old
string. This is quite common to trigger, since we look at reflogs:
the tip of any ref will be described both by looking at the actual
ref, as well as the latest reflog entry. So we'd always end up
leaking one of those strings.
2. The last-one-wins approach gives us lousy names. For instance, we
first look at all of the refs, and then all of the reflogs. So
rather than seeing "refs/heads/master", we're likely to overwrite
it with "HEAD@{12345678}". We're generally better off using the
first name we find.
And indeed, the test in t1450 expects this ugly HEAD@{} name. After
this patch, we've switched to using fsck_put_object_name()'s
first-one-wins semantics, and we output the more human-friendly
"refs/tags/julius" (and the test is updated accordingly).
Signed-off-by: Jeff King <peff@peff.net>
Signed-off-by: Junio C Hamano <gitster@pobox.com>
2019-10-18 06:56:13 +02:00
|
|
|
static struct strbuf bufs[] = {
|
|
|
|
STRBUF_INIT, STRBUF_INIT, STRBUF_INIT, STRBUF_INIT
|
|
|
|
};
|
|
|
|
static int b = 0;
|
|
|
|
struct strbuf *buf;
|
2019-10-18 06:57:37 +02:00
|
|
|
const char *name = fsck_get_object_name(options, oid);
|
fsck: unify object-name code
Commit 90cf590f53 (fsck: optionally show more helpful info for broken
links, 2016-07-17) added a system for decorating objects with names. The
code is split across builtin/fsck.c (which gives the initial names) and
fsck.c (which adds to the names as it traverses the object graph). This
leads to some duplication, where both sites have near-identical
describe_object() functions (the difference being that the one in
builtin/fsck.c uses a circular array of buffers to allow multiple calls
in a single printf).
Let's provide a unified object_name API for fsck. That lets us drop the
duplication, as well as making the interface boundaries more clear
(which will let us refactor the implementation more in a future patch).
We'll leave describe_object() in builtin/fsck.c as a thin wrapper around
the new API, as it relies on a static global to make its many callers a
bit shorter.
We'll also convert the bare add_decoration() calls in builtin/fsck.c to
put_object_name(). This fixes two minor bugs:
1. We leak many small strings. add_decoration() has a last-one-wins
approach: it updates the decoration to the new string and returns
the old one. But we ignore the return value, leaking the old
string. This is quite common to trigger, since we look at reflogs:
the tip of any ref will be described both by looking at the actual
ref, as well as the latest reflog entry. So we'd always end up
leaking one of those strings.
2. The last-one-wins approach gives us lousy names. For instance, we
first look at all of the refs, and then all of the reflogs. So
rather than seeing "refs/heads/master", we're likely to overwrite
it with "HEAD@{12345678}". We're generally better off using the
first name we find.
And indeed, the test in t1450 expects this ugly HEAD@{} name. After
this patch, we've switched to using fsck_put_object_name()'s
first-one-wins semantics, and we output the more human-friendly
"refs/tags/julius" (and the test is updated accordingly).
Signed-off-by: Jeff King <peff@peff.net>
Signed-off-by: Junio C Hamano <gitster@pobox.com>
2019-10-18 06:56:13 +02:00
|
|
|
|
|
|
|
buf = bufs + b;
|
|
|
|
b = (b + 1) % ARRAY_SIZE(bufs);
|
|
|
|
strbuf_reset(buf);
|
2019-10-18 06:57:37 +02:00
|
|
|
strbuf_addstr(buf, oid_to_hex(oid));
|
fsck: unify object-name code
Commit 90cf590f53 (fsck: optionally show more helpful info for broken
links, 2016-07-17) added a system for decorating objects with names. The
code is split across builtin/fsck.c (which gives the initial names) and
fsck.c (which adds to the names as it traverses the object graph). This
leads to some duplication, where both sites have near-identical
describe_object() functions (the difference being that the one in
builtin/fsck.c uses a circular array of buffers to allow multiple calls
in a single printf).
Let's provide a unified object_name API for fsck. That lets us drop the
duplication, as well as making the interface boundaries more clear
(which will let us refactor the implementation more in a future patch).
We'll leave describe_object() in builtin/fsck.c as a thin wrapper around
the new API, as it relies on a static global to make its many callers a
bit shorter.
We'll also convert the bare add_decoration() calls in builtin/fsck.c to
put_object_name(). This fixes two minor bugs:
1. We leak many small strings. add_decoration() has a last-one-wins
approach: it updates the decoration to the new string and returns
the old one. But we ignore the return value, leaking the old
string. This is quite common to trigger, since we look at reflogs:
the tip of any ref will be described both by looking at the actual
ref, as well as the latest reflog entry. So we'd always end up
leaking one of those strings.
2. The last-one-wins approach gives us lousy names. For instance, we
first look at all of the refs, and then all of the reflogs. So
rather than seeing "refs/heads/master", we're likely to overwrite
it with "HEAD@{12345678}". We're generally better off using the
first name we find.
And indeed, the test in t1450 expects this ugly HEAD@{} name. After
this patch, we've switched to using fsck_put_object_name()'s
first-one-wins semantics, and we output the more human-friendly
"refs/tags/julius" (and the test is updated accordingly).
Signed-off-by: Jeff King <peff@peff.net>
Signed-off-by: Junio C Hamano <gitster@pobox.com>
2019-10-18 06:56:13 +02:00
|
|
|
if (name)
|
|
|
|
strbuf_addf(buf, " (%s)", name);
|
2016-07-17 13:00:02 +02:00
|
|
|
|
fsck: unify object-name code
Commit 90cf590f53 (fsck: optionally show more helpful info for broken
links, 2016-07-17) added a system for decorating objects with names. The
code is split across builtin/fsck.c (which gives the initial names) and
fsck.c (which adds to the names as it traverses the object graph). This
leads to some duplication, where both sites have near-identical
describe_object() functions (the difference being that the one in
builtin/fsck.c uses a circular array of buffers to allow multiple calls
in a single printf).
Let's provide a unified object_name API for fsck. That lets us drop the
duplication, as well as making the interface boundaries more clear
(which will let us refactor the implementation more in a future patch).
We'll leave describe_object() in builtin/fsck.c as a thin wrapper around
the new API, as it relies on a static global to make its many callers a
bit shorter.
We'll also convert the bare add_decoration() calls in builtin/fsck.c to
put_object_name(). This fixes two minor bugs:
1. We leak many small strings. add_decoration() has a last-one-wins
approach: it updates the decoration to the new string and returns
the old one. But we ignore the return value, leaking the old
string. This is quite common to trigger, since we look at reflogs:
the tip of any ref will be described both by looking at the actual
ref, as well as the latest reflog entry. So we'd always end up
leaking one of those strings.
2. The last-one-wins approach gives us lousy names. For instance, we
first look at all of the refs, and then all of the reflogs. So
rather than seeing "refs/heads/master", we're likely to overwrite
it with "HEAD@{12345678}". We're generally better off using the
first name we find.
And indeed, the test in t1450 expects this ugly HEAD@{} name. After
this patch, we've switched to using fsck_put_object_name()'s
first-one-wins semantics, and we output the more human-friendly
"refs/tags/julius" (and the test is updated accordingly).
Signed-off-by: Jeff King <peff@peff.net>
Signed-off-by: Junio C Hamano <gitster@pobox.com>
2019-10-18 06:56:13 +02:00
|
|
|
return buf->buf;
|
2016-07-17 13:00:02 +02:00
|
|
|
}
|
|
|
|
|
2015-06-22 17:25:00 +02:00
|
|
|
static int fsck_walk_tree(struct tree *tree, void *data, struct fsck_options *options)
|
2008-02-25 22:46:04 +01:00
|
|
|
{
|
|
|
|
struct tree_desc desc;
|
|
|
|
struct name_entry entry;
|
|
|
|
int res = 0;
|
2016-07-17 12:59:49 +02:00
|
|
|
const char *name;
|
2008-02-25 22:46:04 +01:00
|
|
|
|
|
|
|
if (parse_tree(tree))
|
|
|
|
return -1;
|
|
|
|
|
2019-10-18 06:57:37 +02:00
|
|
|
name = fsck_get_object_name(options, &tree->object.oid);
|
2016-09-27 22:59:51 +02:00
|
|
|
if (init_tree_desc_gently(&desc, tree->buffer, tree->size))
|
|
|
|
return -1;
|
|
|
|
while (tree_entry_gently(&desc, &entry)) {
|
2016-07-17 12:59:49 +02:00
|
|
|
struct object *obj;
|
2008-02-25 22:46:04 +01:00
|
|
|
int result;
|
|
|
|
|
|
|
|
if (S_ISGITLINK(entry.mode))
|
|
|
|
continue;
|
2016-07-17 12:59:49 +02:00
|
|
|
|
|
|
|
if (S_ISDIR(entry.mode)) {
|
2019-01-15 01:39:44 +01:00
|
|
|
obj = (struct object *)lookup_tree(the_repository, &entry.oid);
|
2017-10-05 21:41:26 +02:00
|
|
|
if (name && obj)
|
2019-10-18 06:57:37 +02:00
|
|
|
fsck_put_object_name(options, &entry.oid, "%s%s/",
|
fsck: unify object-name code
Commit 90cf590f53 (fsck: optionally show more helpful info for broken
links, 2016-07-17) added a system for decorating objects with names. The
code is split across builtin/fsck.c (which gives the initial names) and
fsck.c (which adds to the names as it traverses the object graph). This
leads to some duplication, where both sites have near-identical
describe_object() functions (the difference being that the one in
builtin/fsck.c uses a circular array of buffers to allow multiple calls
in a single printf).
Let's provide a unified object_name API for fsck. That lets us drop the
duplication, as well as making the interface boundaries more clear
(which will let us refactor the implementation more in a future patch).
We'll leave describe_object() in builtin/fsck.c as a thin wrapper around
the new API, as it relies on a static global to make its many callers a
bit shorter.
We'll also convert the bare add_decoration() calls in builtin/fsck.c to
put_object_name(). This fixes two minor bugs:
1. We leak many small strings. add_decoration() has a last-one-wins
approach: it updates the decoration to the new string and returns
the old one. But we ignore the return value, leaking the old
string. This is quite common to trigger, since we look at reflogs:
the tip of any ref will be described both by looking at the actual
ref, as well as the latest reflog entry. So we'd always end up
leaking one of those strings.
2. The last-one-wins approach gives us lousy names. For instance, we
first look at all of the refs, and then all of the reflogs. So
rather than seeing "refs/heads/master", we're likely to overwrite
it with "HEAD@{12345678}". We're generally better off using the
first name we find.
And indeed, the test in t1450 expects this ugly HEAD@{} name. After
this patch, we've switched to using fsck_put_object_name()'s
first-one-wins semantics, and we output the more human-friendly
"refs/tags/julius" (and the test is updated accordingly).
Signed-off-by: Jeff King <peff@peff.net>
Signed-off-by: Junio C Hamano <gitster@pobox.com>
2019-10-18 06:56:13 +02:00
|
|
|
name, entry.path);
|
2016-07-17 12:59:49 +02:00
|
|
|
result = options->walk(obj, OBJ_TREE, data, options);
|
|
|
|
}
|
|
|
|
else if (S_ISREG(entry.mode) || S_ISLNK(entry.mode)) {
|
2019-01-15 01:39:44 +01:00
|
|
|
obj = (struct object *)lookup_blob(the_repository, &entry.oid);
|
2017-10-05 21:41:26 +02:00
|
|
|
if (name && obj)
|
2019-10-18 06:57:37 +02:00
|
|
|
fsck_put_object_name(options, &entry.oid, "%s%s",
|
fsck: unify object-name code
Commit 90cf590f53 (fsck: optionally show more helpful info for broken
links, 2016-07-17) added a system for decorating objects with names. The
code is split across builtin/fsck.c (which gives the initial names) and
fsck.c (which adds to the names as it traverses the object graph). This
leads to some duplication, where both sites have near-identical
describe_object() functions (the difference being that the one in
builtin/fsck.c uses a circular array of buffers to allow multiple calls
in a single printf).
Let's provide a unified object_name API for fsck. That lets us drop the
duplication, as well as making the interface boundaries more clear
(which will let us refactor the implementation more in a future patch).
We'll leave describe_object() in builtin/fsck.c as a thin wrapper around
the new API, as it relies on a static global to make its many callers a
bit shorter.
We'll also convert the bare add_decoration() calls in builtin/fsck.c to
put_object_name(). This fixes two minor bugs:
1. We leak many small strings. add_decoration() has a last-one-wins
approach: it updates the decoration to the new string and returns
the old one. But we ignore the return value, leaking the old
string. This is quite common to trigger, since we look at reflogs:
the tip of any ref will be described both by looking at the actual
ref, as well as the latest reflog entry. So we'd always end up
leaking one of those strings.
2. The last-one-wins approach gives us lousy names. For instance, we
first look at all of the refs, and then all of the reflogs. So
rather than seeing "refs/heads/master", we're likely to overwrite
it with "HEAD@{12345678}". We're generally better off using the
first name we find.
And indeed, the test in t1450 expects this ugly HEAD@{} name. After
this patch, we've switched to using fsck_put_object_name()'s
first-one-wins semantics, and we output the more human-friendly
"refs/tags/julius" (and the test is updated accordingly).
Signed-off-by: Jeff King <peff@peff.net>
Signed-off-by: Junio C Hamano <gitster@pobox.com>
2019-10-18 06:56:13 +02:00
|
|
|
name, entry.path);
|
2016-07-17 12:59:49 +02:00
|
|
|
result = options->walk(obj, OBJ_BLOB, data, options);
|
|
|
|
}
|
2008-02-25 22:46:04 +01:00
|
|
|
else {
|
2012-04-30 02:28:45 +02:00
|
|
|
result = error("in tree %s: entry %s has bad mode %.6o",
|
2019-10-18 06:57:37 +02:00
|
|
|
fsck_describe_object(options, &tree->object.oid),
|
fsck: unify object-name code
Commit 90cf590f53 (fsck: optionally show more helpful info for broken
links, 2016-07-17) added a system for decorating objects with names. The
code is split across builtin/fsck.c (which gives the initial names) and
fsck.c (which adds to the names as it traverses the object graph). This
leads to some duplication, where both sites have near-identical
describe_object() functions (the difference being that the one in
builtin/fsck.c uses a circular array of buffers to allow multiple calls
in a single printf).
Let's provide a unified object_name API for fsck. That lets us drop the
duplication, as well as making the interface boundaries more clear
(which will let us refactor the implementation more in a future patch).
We'll leave describe_object() in builtin/fsck.c as a thin wrapper around
the new API, as it relies on a static global to make its many callers a
bit shorter.
We'll also convert the bare add_decoration() calls in builtin/fsck.c to
put_object_name(). This fixes two minor bugs:
1. We leak many small strings. add_decoration() has a last-one-wins
approach: it updates the decoration to the new string and returns
the old one. But we ignore the return value, leaking the old
string. This is quite common to trigger, since we look at reflogs:
the tip of any ref will be described both by looking at the actual
ref, as well as the latest reflog entry. So we'd always end up
leaking one of those strings.
2. The last-one-wins approach gives us lousy names. For instance, we
first look at all of the refs, and then all of the reflogs. So
rather than seeing "refs/heads/master", we're likely to overwrite
it with "HEAD@{12345678}". We're generally better off using the
first name we find.
And indeed, the test in t1450 expects this ugly HEAD@{} name. After
this patch, we've switched to using fsck_put_object_name()'s
first-one-wins semantics, and we output the more human-friendly
"refs/tags/julius" (and the test is updated accordingly).
Signed-off-by: Jeff King <peff@peff.net>
Signed-off-by: Junio C Hamano <gitster@pobox.com>
2019-10-18 06:56:13 +02:00
|
|
|
entry.path, entry.mode);
|
2008-02-25 22:46:04 +01:00
|
|
|
}
|
|
|
|
if (result < 0)
|
|
|
|
return result;
|
|
|
|
if (!res)
|
|
|
|
res = result;
|
|
|
|
}
|
|
|
|
return res;
|
|
|
|
}
|
|
|
|
|
2015-06-22 17:25:00 +02:00
|
|
|
static int fsck_walk_commit(struct commit *commit, void *data, struct fsck_options *options)
|
2008-02-25 22:46:04 +01:00
|
|
|
{
|
2016-07-17 12:59:49 +02:00
|
|
|
int counter = 0, generation = 0, name_prefix_len = 0;
|
2008-02-25 22:46:04 +01:00
|
|
|
struct commit_list *parents;
|
|
|
|
int res;
|
|
|
|
int result;
|
2016-07-17 12:59:49 +02:00
|
|
|
const char *name;
|
2008-02-25 22:46:04 +01:00
|
|
|
|
|
|
|
if (parse_commit(commit))
|
|
|
|
return -1;
|
|
|
|
|
2019-10-18 06:57:37 +02:00
|
|
|
name = fsck_get_object_name(options, &commit->object.oid);
|
2016-07-17 12:59:49 +02:00
|
|
|
if (name)
|
2019-10-18 06:57:37 +02:00
|
|
|
fsck_put_object_name(options, get_commit_tree_oid(commit),
|
fsck: unify object-name code
Commit 90cf590f53 (fsck: optionally show more helpful info for broken
links, 2016-07-17) added a system for decorating objects with names. The
code is split across builtin/fsck.c (which gives the initial names) and
fsck.c (which adds to the names as it traverses the object graph). This
leads to some duplication, where both sites have near-identical
describe_object() functions (the difference being that the one in
builtin/fsck.c uses a circular array of buffers to allow multiple calls
in a single printf).
Let's provide a unified object_name API for fsck. That lets us drop the
duplication, as well as making the interface boundaries more clear
(which will let us refactor the implementation more in a future patch).
We'll leave describe_object() in builtin/fsck.c as a thin wrapper around
the new API, as it relies on a static global to make its many callers a
bit shorter.
We'll also convert the bare add_decoration() calls in builtin/fsck.c to
put_object_name(). This fixes two minor bugs:
1. We leak many small strings. add_decoration() has a last-one-wins
approach: it updates the decoration to the new string and returns
the old one. But we ignore the return value, leaking the old
string. This is quite common to trigger, since we look at reflogs:
the tip of any ref will be described both by looking at the actual
ref, as well as the latest reflog entry. So we'd always end up
leaking one of those strings.
2. The last-one-wins approach gives us lousy names. For instance, we
first look at all of the refs, and then all of the reflogs. So
rather than seeing "refs/heads/master", we're likely to overwrite
it with "HEAD@{12345678}". We're generally better off using the
first name we find.
And indeed, the test in t1450 expects this ugly HEAD@{} name. After
this patch, we've switched to using fsck_put_object_name()'s
first-one-wins semantics, and we output the more human-friendly
"refs/tags/julius" (and the test is updated accordingly).
Signed-off-by: Jeff King <peff@peff.net>
Signed-off-by: Junio C Hamano <gitster@pobox.com>
2019-10-18 06:56:13 +02:00
|
|
|
"%s:", name);
|
2016-07-17 12:59:49 +02:00
|
|
|
|
2018-04-06 21:09:38 +02:00
|
|
|
result = options->walk((struct object *)get_commit_tree(commit),
|
|
|
|
OBJ_TREE, data, options);
|
2008-02-25 22:46:04 +01:00
|
|
|
if (result < 0)
|
|
|
|
return result;
|
|
|
|
res = result;
|
|
|
|
|
|
|
|
parents = commit->parents;
|
2016-07-17 12:59:49 +02:00
|
|
|
if (name && parents) {
|
|
|
|
int len = strlen(name), power;
|
|
|
|
|
|
|
|
if (len && name[len - 1] == '^') {
|
|
|
|
generation = 1;
|
|
|
|
name_prefix_len = len - 1;
|
|
|
|
}
|
|
|
|
else { /* parse ~<generation> suffix */
|
|
|
|
for (generation = 0, power = 1;
|
|
|
|
len && isdigit(name[len - 1]);
|
|
|
|
power *= 10)
|
|
|
|
generation += power * (name[--len] - '0');
|
|
|
|
if (power > 1 && len && name[len - 1] == '~')
|
|
|
|
name_prefix_len = len - 1;
|
2021-02-10 19:01:30 +01:00
|
|
|
else {
|
|
|
|
/* Maybe a non-first parent, e.g. HEAD^2 */
|
|
|
|
generation = 0;
|
|
|
|
name_prefix_len = len;
|
|
|
|
}
|
2016-07-17 12:59:49 +02:00
|
|
|
}
|
|
|
|
}
|
|
|
|
|
2008-02-25 22:46:04 +01:00
|
|
|
while (parents) {
|
2016-07-17 12:59:49 +02:00
|
|
|
if (name) {
|
2019-10-18 06:57:37 +02:00
|
|
|
struct object_id *oid = &parents->item->object.oid;
|
2016-07-17 12:59:49 +02:00
|
|
|
|
2018-10-24 03:25:12 +02:00
|
|
|
if (counter++)
|
2019-10-18 06:57:37 +02:00
|
|
|
fsck_put_object_name(options, oid, "%s^%d",
|
fsck: unify object-name code
Commit 90cf590f53 (fsck: optionally show more helpful info for broken
links, 2016-07-17) added a system for decorating objects with names. The
code is split across builtin/fsck.c (which gives the initial names) and
fsck.c (which adds to the names as it traverses the object graph). This
leads to some duplication, where both sites have near-identical
describe_object() functions (the difference being that the one in
builtin/fsck.c uses a circular array of buffers to allow multiple calls
in a single printf).
Let's provide a unified object_name API for fsck. That lets us drop the
duplication, as well as making the interface boundaries more clear
(which will let us refactor the implementation more in a future patch).
We'll leave describe_object() in builtin/fsck.c as a thin wrapper around
the new API, as it relies on a static global to make its many callers a
bit shorter.
We'll also convert the bare add_decoration() calls in builtin/fsck.c to
put_object_name(). This fixes two minor bugs:
1. We leak many small strings. add_decoration() has a last-one-wins
approach: it updates the decoration to the new string and returns
the old one. But we ignore the return value, leaking the old
string. This is quite common to trigger, since we look at reflogs:
the tip of any ref will be described both by looking at the actual
ref, as well as the latest reflog entry. So we'd always end up
leaking one of those strings.
2. The last-one-wins approach gives us lousy names. For instance, we
first look at all of the refs, and then all of the reflogs. So
rather than seeing "refs/heads/master", we're likely to overwrite
it with "HEAD@{12345678}". We're generally better off using the
first name we find.
And indeed, the test in t1450 expects this ugly HEAD@{} name. After
this patch, we've switched to using fsck_put_object_name()'s
first-one-wins semantics, and we output the more human-friendly
"refs/tags/julius" (and the test is updated accordingly).
Signed-off-by: Jeff King <peff@peff.net>
Signed-off-by: Junio C Hamano <gitster@pobox.com>
2019-10-18 06:56:13 +02:00
|
|
|
name, counter);
|
2016-07-17 12:59:49 +02:00
|
|
|
else if (generation > 0)
|
2019-10-18 06:57:37 +02:00
|
|
|
fsck_put_object_name(options, oid, "%.*s~%d",
|
fsck: unify object-name code
Commit 90cf590f53 (fsck: optionally show more helpful info for broken
links, 2016-07-17) added a system for decorating objects with names. The
code is split across builtin/fsck.c (which gives the initial names) and
fsck.c (which adds to the names as it traverses the object graph). This
leads to some duplication, where both sites have near-identical
describe_object() functions (the difference being that the one in
builtin/fsck.c uses a circular array of buffers to allow multiple calls
in a single printf).
Let's provide a unified object_name API for fsck. That lets us drop the
duplication, as well as making the interface boundaries more clear
(which will let us refactor the implementation more in a future patch).
We'll leave describe_object() in builtin/fsck.c as a thin wrapper around
the new API, as it relies on a static global to make its many callers a
bit shorter.
We'll also convert the bare add_decoration() calls in builtin/fsck.c to
put_object_name(). This fixes two minor bugs:
1. We leak many small strings. add_decoration() has a last-one-wins
approach: it updates the decoration to the new string and returns
the old one. But we ignore the return value, leaking the old
string. This is quite common to trigger, since we look at reflogs:
the tip of any ref will be described both by looking at the actual
ref, as well as the latest reflog entry. So we'd always end up
leaking one of those strings.
2. The last-one-wins approach gives us lousy names. For instance, we
first look at all of the refs, and then all of the reflogs. So
rather than seeing "refs/heads/master", we're likely to overwrite
it with "HEAD@{12345678}". We're generally better off using the
first name we find.
And indeed, the test in t1450 expects this ugly HEAD@{} name. After
this patch, we've switched to using fsck_put_object_name()'s
first-one-wins semantics, and we output the more human-friendly
"refs/tags/julius" (and the test is updated accordingly).
Signed-off-by: Jeff King <peff@peff.net>
Signed-off-by: Junio C Hamano <gitster@pobox.com>
2019-10-18 06:56:13 +02:00
|
|
|
name_prefix_len, name,
|
|
|
|
generation + 1);
|
2016-07-17 12:59:49 +02:00
|
|
|
else
|
2019-10-18 06:57:37 +02:00
|
|
|
fsck_put_object_name(options, oid, "%s^", name);
|
2016-07-17 12:59:49 +02:00
|
|
|
}
|
2015-06-22 17:25:00 +02:00
|
|
|
result = options->walk((struct object *)parents->item, OBJ_COMMIT, data, options);
|
2008-02-25 22:46:04 +01:00
|
|
|
if (result < 0)
|
|
|
|
return result;
|
|
|
|
if (!res)
|
|
|
|
res = result;
|
|
|
|
parents = parents->next;
|
|
|
|
}
|
|
|
|
return res;
|
|
|
|
}
|
|
|
|
|
2015-06-22 17:25:00 +02:00
|
|
|
static int fsck_walk_tag(struct tag *tag, void *data, struct fsck_options *options)
|
2008-02-25 22:46:04 +01:00
|
|
|
{
|
2019-10-18 06:57:37 +02:00
|
|
|
const char *name = fsck_get_object_name(options, &tag->object.oid);
|
2016-07-17 12:59:49 +02:00
|
|
|
|
2008-02-25 22:46:04 +01:00
|
|
|
if (parse_tag(tag))
|
|
|
|
return -1;
|
2016-07-17 12:59:49 +02:00
|
|
|
if (name)
|
2019-10-18 06:57:37 +02:00
|
|
|
fsck_put_object_name(options, &tag->tagged->oid, "%s", name);
|
2015-06-22 17:25:00 +02:00
|
|
|
return options->walk(tag->tagged, OBJ_ANY, data, options);
|
2008-02-25 22:46:04 +01:00
|
|
|
}
|
|
|
|
|
2015-06-22 17:25:00 +02:00
|
|
|
int fsck_walk(struct object *obj, void *data, struct fsck_options *options)
|
2008-02-25 22:46:04 +01:00
|
|
|
{
|
|
|
|
if (!obj)
|
|
|
|
return -1;
|
fsck: lazily load types under --connectivity-only
The recent fixes to "fsck --connectivity-only" load all of
the objects with their correct types. This keeps the
connectivity-only code path close to the regular one, but it
also introduces some unnecessary inefficiency. While getting
the type of an object is cheap compared to actually opening
and parsing the object (as the non-connectivity-only case
would do), it's still not free.
For reachable non-blob objects, we end up having to parse
them later anyway (to see what they point to), making our
type lookup here redundant.
For unreachable objects, we might never hit them at all in
the reachability traversal, making the lookup completely
wasted. And in some cases, we might have quite a few
unreachable objects (e.g., when alternates are used for
shared object storage between repositories, it's normal for
there to be objects reachable from other repositories but
not the one running fsck).
The comment in mark_object_for_connectivity() claims two
benefits to getting the type up front:
1. We need to know the types during fsck_walk(). (And not
explicitly mentioned, but we also need them when
printing the types of broken or dangling commits).
We can address this by lazy-loading the types as
necessary. Most objects never need this lazy-load at
all, because they fall into one of these categories:
a. Reachable from our tips, and are coerced into the
correct type as we traverse (e.g., a parent link
will call lookup_commit(), which converts OBJ_NONE
to OBJ_COMMIT).
b. Unreachable, but not at the tip of a chunk of
unreachable history. We only mention the tips as
"dangling", so an unreachable commit which links
to hundreds of other objects needs only report the
type of the tip commit.
2. It serves as a cross-check that the coercion in (1a) is
correct (i.e., we'll complain about a parent link that
points to a blob). But we get most of this for free
already, because right after coercing, we'll parse any
non-blob objects. So we'd notice then if we expected a
commit and got a blob.
The one exception is when we expect a blob, in which
case we never actually read the object contents.
So this is a slight weakening, but given that the whole
point of --connectivity-only is to sacrifice some data
integrity checks for speed, this seems like an
acceptable tradeoff.
Here are before and after timings for an extreme case with
~5M reachable objects and another ~12M unreachable (it's the
torvalds/linux repository on GitHub, connected to shared
storage for all of the other kernel forks):
[before]
$ time git fsck --no-dangling --connectivity-only
real 3m4.323s
user 1m25.121s
sys 1m38.710s
[after]
$ time git fsck --no-dangling --connectivity-only
real 0m51.497s
user 0m49.575s
sys 0m1.776s
Signed-off-by: Jeff King <peff@peff.net>
Signed-off-by: Junio C Hamano <gitster@pobox.com>
2017-01-26 05:12:07 +01:00
|
|
|
|
|
|
|
if (obj->type == OBJ_NONE)
|
2018-06-29 03:21:51 +02:00
|
|
|
parse_object(the_repository, &obj->oid);
|
fsck: lazily load types under --connectivity-only
The recent fixes to "fsck --connectivity-only" load all of
the objects with their correct types. This keeps the
connectivity-only code path close to the regular one, but it
also introduces some unnecessary inefficiency. While getting
the type of an object is cheap compared to actually opening
and parsing the object (as the non-connectivity-only case
would do), it's still not free.
For reachable non-blob objects, we end up having to parse
them later anyway (to see what they point to), making our
type lookup here redundant.
For unreachable objects, we might never hit them at all in
the reachability traversal, making the lookup completely
wasted. And in some cases, we might have quite a few
unreachable objects (e.g., when alternates are used for
shared object storage between repositories, it's normal for
there to be objects reachable from other repositories but
not the one running fsck).
The comment in mark_object_for_connectivity() claims two
benefits to getting the type up front:
1. We need to know the types during fsck_walk(). (And not
explicitly mentioned, but we also need them when
printing the types of broken or dangling commits).
We can address this by lazy-loading the types as
necessary. Most objects never need this lazy-load at
all, because they fall into one of these categories:
a. Reachable from our tips, and are coerced into the
correct type as we traverse (e.g., a parent link
will call lookup_commit(), which converts OBJ_NONE
to OBJ_COMMIT).
b. Unreachable, but not at the tip of a chunk of
unreachable history. We only mention the tips as
"dangling", so an unreachable commit which links
to hundreds of other objects needs only report the
type of the tip commit.
2. It serves as a cross-check that the coercion in (1a) is
correct (i.e., we'll complain about a parent link that
points to a blob). But we get most of this for free
already, because right after coercing, we'll parse any
non-blob objects. So we'd notice then if we expected a
commit and got a blob.
The one exception is when we expect a blob, in which
case we never actually read the object contents.
So this is a slight weakening, but given that the whole
point of --connectivity-only is to sacrifice some data
integrity checks for speed, this seems like an
acceptable tradeoff.
Here are before and after timings for an extreme case with
~5M reachable objects and another ~12M unreachable (it's the
torvalds/linux repository on GitHub, connected to shared
storage for all of the other kernel forks):
[before]
$ time git fsck --no-dangling --connectivity-only
real 3m4.323s
user 1m25.121s
sys 1m38.710s
[after]
$ time git fsck --no-dangling --connectivity-only
real 0m51.497s
user 0m49.575s
sys 0m1.776s
Signed-off-by: Jeff King <peff@peff.net>
Signed-off-by: Junio C Hamano <gitster@pobox.com>
2017-01-26 05:12:07 +01:00
|
|
|
|
2008-02-25 22:46:04 +01:00
|
|
|
switch (obj->type) {
|
|
|
|
case OBJ_BLOB:
|
|
|
|
return 0;
|
|
|
|
case OBJ_TREE:
|
2015-06-22 17:25:00 +02:00
|
|
|
return fsck_walk_tree((struct tree *)obj, data, options);
|
2008-02-25 22:46:04 +01:00
|
|
|
case OBJ_COMMIT:
|
2015-06-22 17:25:00 +02:00
|
|
|
return fsck_walk_commit((struct commit *)obj, data, options);
|
2008-02-25 22:46:04 +01:00
|
|
|
case OBJ_TAG:
|
2015-06-22 17:25:00 +02:00
|
|
|
return fsck_walk_tag((struct tag *)obj, data, options);
|
2008-02-25 22:46:04 +01:00
|
|
|
default:
|
fsck: unify object-name code
Commit 90cf590f53 (fsck: optionally show more helpful info for broken
links, 2016-07-17) added a system for decorating objects with names. The
code is split across builtin/fsck.c (which gives the initial names) and
fsck.c (which adds to the names as it traverses the object graph). This
leads to some duplication, where both sites have near-identical
describe_object() functions (the difference being that the one in
builtin/fsck.c uses a circular array of buffers to allow multiple calls
in a single printf).
Let's provide a unified object_name API for fsck. That lets us drop the
duplication, as well as making the interface boundaries more clear
(which will let us refactor the implementation more in a future patch).
We'll leave describe_object() in builtin/fsck.c as a thin wrapper around
the new API, as it relies on a static global to make its many callers a
bit shorter.
We'll also convert the bare add_decoration() calls in builtin/fsck.c to
put_object_name(). This fixes two minor bugs:
1. We leak many small strings. add_decoration() has a last-one-wins
approach: it updates the decoration to the new string and returns
the old one. But we ignore the return value, leaking the old
string. This is quite common to trigger, since we look at reflogs:
the tip of any ref will be described both by looking at the actual
ref, as well as the latest reflog entry. So we'd always end up
leaking one of those strings.
2. The last-one-wins approach gives us lousy names. For instance, we
first look at all of the refs, and then all of the reflogs. So
rather than seeing "refs/heads/master", we're likely to overwrite
it with "HEAD@{12345678}". We're generally better off using the
first name we find.
And indeed, the test in t1450 expects this ugly HEAD@{} name. After
this patch, we've switched to using fsck_put_object_name()'s
first-one-wins semantics, and we output the more human-friendly
"refs/tags/julius" (and the test is updated accordingly).
Signed-off-by: Jeff King <peff@peff.net>
Signed-off-by: Junio C Hamano <gitster@pobox.com>
2019-10-18 06:56:13 +02:00
|
|
|
error("Unknown object type for %s",
|
2019-10-18 06:57:37 +02:00
|
|
|
fsck_describe_object(options, &obj->oid));
|
2008-02-25 22:46:04 +01:00
|
|
|
return -1;
|
|
|
|
}
|
|
|
|
}
|
2008-02-25 22:46:08 +01:00
|
|
|
|
2020-05-10 18:12:16 +02:00
|
|
|
struct name_stack {
|
|
|
|
const char **names;
|
|
|
|
size_t nr, alloc;
|
|
|
|
};
|
|
|
|
|
|
|
|
static void name_stack_push(struct name_stack *stack, const char *name)
|
|
|
|
{
|
|
|
|
ALLOC_GROW(stack->names, stack->nr + 1, stack->alloc);
|
|
|
|
stack->names[stack->nr++] = name;
|
|
|
|
}
|
|
|
|
|
|
|
|
static const char *name_stack_pop(struct name_stack *stack)
|
|
|
|
{
|
|
|
|
return stack->nr ? stack->names[--stack->nr] : NULL;
|
|
|
|
}
|
|
|
|
|
|
|
|
static void name_stack_clear(struct name_stack *stack)
|
|
|
|
{
|
|
|
|
FREE_AND_NULL(stack->names);
|
|
|
|
stack->nr = stack->alloc = 0;
|
|
|
|
}
|
|
|
|
|
2008-02-25 22:46:08 +01:00
|
|
|
/*
|
|
|
|
* The entries in a tree are ordered in the _path_ order,
|
|
|
|
* which means that a directory entry is ordered by adding
|
|
|
|
* a slash to the end of it.
|
|
|
|
*
|
|
|
|
* So a directory called "a" is ordered _after_ a file
|
|
|
|
* called "a.c", because "a/" sorts after "a.c".
|
|
|
|
*/
|
|
|
|
#define TREE_UNORDERED (-1)
|
|
|
|
#define TREE_HAS_DUPS (-2)
|
|
|
|
|
2020-05-10 18:12:16 +02:00
|
|
|
static int is_less_than_slash(unsigned char c)
|
|
|
|
{
|
|
|
|
return '\0' < c && c < '/';
|
|
|
|
}
|
|
|
|
|
|
|
|
static int verify_ordered(unsigned mode1, const char *name1,
|
|
|
|
unsigned mode2, const char *name2,
|
|
|
|
struct name_stack *candidates)
|
2008-02-25 22:46:08 +01:00
|
|
|
{
|
|
|
|
int len1 = strlen(name1);
|
|
|
|
int len2 = strlen(name2);
|
|
|
|
int len = len1 < len2 ? len1 : len2;
|
|
|
|
unsigned char c1, c2;
|
|
|
|
int cmp;
|
|
|
|
|
|
|
|
cmp = memcmp(name1, name2, len);
|
|
|
|
if (cmp < 0)
|
|
|
|
return 0;
|
|
|
|
if (cmp > 0)
|
|
|
|
return TREE_UNORDERED;
|
|
|
|
|
|
|
|
/*
|
|
|
|
* Ok, the first <len> characters are the same.
|
|
|
|
* Now we need to order the next one, but turn
|
|
|
|
* a '\0' into a '/' for a directory entry.
|
|
|
|
*/
|
|
|
|
c1 = name1[len];
|
|
|
|
c2 = name2[len];
|
|
|
|
if (!c1 && !c2)
|
|
|
|
/*
|
|
|
|
* git-write-tree used to write out a nonsense tree that has
|
|
|
|
* entries with the same name, one blob and one tree. Make
|
|
|
|
* sure we do not have duplicate entries.
|
|
|
|
*/
|
|
|
|
return TREE_HAS_DUPS;
|
|
|
|
if (!c1 && S_ISDIR(mode1))
|
|
|
|
c1 = '/';
|
|
|
|
if (!c2 && S_ISDIR(mode2))
|
|
|
|
c2 = '/';
|
2020-05-10 18:12:16 +02:00
|
|
|
|
|
|
|
/*
|
|
|
|
* There can be non-consecutive duplicates due to the implicitly
|
2020-05-21 11:52:04 +02:00
|
|
|
* added slash, e.g.:
|
2020-05-10 18:12:16 +02:00
|
|
|
*
|
|
|
|
* foo
|
|
|
|
* foo.bar
|
|
|
|
* foo.bar.baz
|
|
|
|
* foo.bar/
|
|
|
|
* foo/
|
|
|
|
*
|
|
|
|
* Record non-directory candidates (like "foo" and "foo.bar" in
|
|
|
|
* the example) on a stack and check directory candidates (like
|
|
|
|
* foo/" and "foo.bar/") against that stack.
|
|
|
|
*/
|
|
|
|
if (!c1 && is_less_than_slash(c2)) {
|
|
|
|
name_stack_push(candidates, name1);
|
|
|
|
} else if (c2 == '/' && is_less_than_slash(c1)) {
|
|
|
|
for (;;) {
|
|
|
|
const char *p;
|
|
|
|
const char *f_name = name_stack_pop(candidates);
|
|
|
|
|
|
|
|
if (!f_name)
|
|
|
|
break;
|
|
|
|
if (!skip_prefix(name2, f_name, &p))
|
2020-05-21 11:52:54 +02:00
|
|
|
continue;
|
2020-05-10 18:12:16 +02:00
|
|
|
if (!*p)
|
|
|
|
return TREE_HAS_DUPS;
|
|
|
|
if (is_less_than_slash(*p)) {
|
|
|
|
name_stack_push(candidates, f_name);
|
|
|
|
break;
|
|
|
|
}
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
2008-02-25 22:46:08 +01:00
|
|
|
return c1 < c2 ? 0 : TREE_UNORDERED;
|
|
|
|
}
|
|
|
|
|
2019-10-18 07:02:08 +02:00
|
|
|
static int fsck_tree(const struct object_id *oid,
|
fsck: require an actual buffer for non-blobs
The fsck_object() function takes in a buffer, but also a "struct
object". The rules for using these vary between types:
- for a commit, we'll use the provided buffer; if it's NULL, we'll
fall back to get_commit_buffer(), which loads from either an
in-memory cache or from disk. If the latter fails, we'd die(), which
is non-ideal for fsck.
- for a tag, a NULL buffer will fall back to loading the object from
disk (and failure would lead to an fsck error)
- for a tree, we _never_ look at the provided buffer, and always use
tree->buffer
- for a blob, we usually don't look at the buffer at all, unless it
has been marked as a .gitmodule file. In that case we check the
buffer given to us, or assume a NULL buffer is a very large blob
(and complain about it)
This is much more complex than it needs to be. It turns out that nobody
ever feeds a NULL buffer that isn't a blob:
- git-fsck calls fsck_object() only from fsck_obj(). That in turn is
called by one of:
- fsck_obj_buffer(), which is a callback to verify_pack(), which
unpacks everything except large blobs into a buffer (see
pack-check.c, lines 131-141).
- fsck_loose(), which hits a BUG() on non-blobs with a NULL buffer
(builtin/fsck.c, lines 639-640)
And in either case, we'll have just called parse_object_buffer()
anyway, which would segfault on a NULL buffer for commits or tags
(not for trees, but it would install a NULL tree->buffer which would
later cause a segfault)
- git-index-pack asserts that the buffer is non-NULL unless the object
is a blob (see builtin/index-pack.c, line 832)
- git-unpack-objects always writes a non-NULL buffer into its
obj_buffer hash, which is then fed to fsck_object(). (There is
actually a funny thing here where it does not store blob buffers at
all, nor does it call fsck on them; it does check any needed blobs
via fsck_finish() though).
Let's make the rules simpler, which reduces the amount of code and gives
us more flexibility in refactoring the fsck code. The new rules are:
- only blobs are allowed to pass a NULL buffer
- we always use the provided buffer, never pulling information from
the object struct
We don't have to adjust any callers, because they were already adhering
to these. Note that we do drop a few fsck identifiers for missing tags,
but that was all dead code (because nobody passed a NULL tag buffer).
Signed-off-by: Jeff King <peff@peff.net>
Signed-off-by: Junio C Hamano <gitster@pobox.com>
2019-10-18 06:54:12 +02:00
|
|
|
const char *buffer, unsigned long size,
|
|
|
|
struct fsck_options *options)
|
2008-02-25 22:46:08 +01:00
|
|
|
{
|
2016-09-27 22:59:51 +02:00
|
|
|
int retval = 0;
|
2012-07-28 17:06:29 +02:00
|
|
|
int has_null_sha1 = 0;
|
2008-02-25 22:46:08 +01:00
|
|
|
int has_full_path = 0;
|
|
|
|
int has_empty_name = 0;
|
2012-11-28 03:27:37 +01:00
|
|
|
int has_dot = 0;
|
|
|
|
int has_dotdot = 0;
|
2012-11-28 22:35:29 +01:00
|
|
|
int has_dotgit = 0;
|
2008-02-25 22:46:08 +01:00
|
|
|
int has_zero_pad = 0;
|
|
|
|
int has_bad_modes = 0;
|
|
|
|
int has_dup_entries = 0;
|
|
|
|
int not_properly_sorted = 0;
|
|
|
|
struct tree_desc desc;
|
|
|
|
unsigned o_mode;
|
|
|
|
const char *o_name;
|
2020-05-10 18:12:16 +02:00
|
|
|
struct name_stack df_dup_candidates = { NULL };
|
2008-02-25 22:46:08 +01:00
|
|
|
|
fsck: require an actual buffer for non-blobs
The fsck_object() function takes in a buffer, but also a "struct
object". The rules for using these vary between types:
- for a commit, we'll use the provided buffer; if it's NULL, we'll
fall back to get_commit_buffer(), which loads from either an
in-memory cache or from disk. If the latter fails, we'd die(), which
is non-ideal for fsck.
- for a tag, a NULL buffer will fall back to loading the object from
disk (and failure would lead to an fsck error)
- for a tree, we _never_ look at the provided buffer, and always use
tree->buffer
- for a blob, we usually don't look at the buffer at all, unless it
has been marked as a .gitmodule file. In that case we check the
buffer given to us, or assume a NULL buffer is a very large blob
(and complain about it)
This is much more complex than it needs to be. It turns out that nobody
ever feeds a NULL buffer that isn't a blob:
- git-fsck calls fsck_object() only from fsck_obj(). That in turn is
called by one of:
- fsck_obj_buffer(), which is a callback to verify_pack(), which
unpacks everything except large blobs into a buffer (see
pack-check.c, lines 131-141).
- fsck_loose(), which hits a BUG() on non-blobs with a NULL buffer
(builtin/fsck.c, lines 639-640)
And in either case, we'll have just called parse_object_buffer()
anyway, which would segfault on a NULL buffer for commits or tags
(not for trees, but it would install a NULL tree->buffer which would
later cause a segfault)
- git-index-pack asserts that the buffer is non-NULL unless the object
is a blob (see builtin/index-pack.c, line 832)
- git-unpack-objects always writes a non-NULL buffer into its
obj_buffer hash, which is then fed to fsck_object(). (There is
actually a funny thing here where it does not store blob buffers at
all, nor does it call fsck on them; it does check any needed blobs
via fsck_finish() though).
Let's make the rules simpler, which reduces the amount of code and gives
us more flexibility in refactoring the fsck code. The new rules are:
- only blobs are allowed to pass a NULL buffer
- we always use the provided buffer, never pulling information from
the object struct
We don't have to adjust any callers, because they were already adhering
to these. Note that we do drop a few fsck identifiers for missing tags,
but that was all dead code (because nobody passed a NULL tag buffer).
Signed-off-by: Jeff King <peff@peff.net>
Signed-off-by: Junio C Hamano <gitster@pobox.com>
2019-10-18 06:54:12 +02:00
|
|
|
if (init_tree_desc_gently(&desc, buffer, size)) {
|
2019-10-18 07:02:08 +02:00
|
|
|
retval += report(options, oid, OBJ_TREE, FSCK_MSG_BAD_TREE, "cannot be parsed as a tree");
|
2016-09-27 22:59:51 +02:00
|
|
|
return retval;
|
|
|
|
}
|
2008-02-25 22:46:08 +01:00
|
|
|
|
|
|
|
o_mode = 0;
|
|
|
|
o_name = NULL;
|
|
|
|
|
|
|
|
while (desc.size) {
|
2019-04-05 17:00:12 +02:00
|
|
|
unsigned short mode;
|
is_ntfs_dotgit(): only verify the leading segment
The config setting `core.protectNTFS` is specifically designed to work
not only on Windows, but anywhere, to allow for repositories hosted on,
say, Linux servers to be protected against NTFS-specific attack vectors.
As a consequence, `is_ntfs_dotgit()` manually splits backslash-separated
paths (but does not do the same for paths separated by forward slashes),
under the assumption that the backslash might not be a valid directory
separator on the _current_ Operating System.
However, the two callers, `verify_path()` and `fsck_tree()`, are
supposed to feed only individual path segments to the `is_ntfs_dotgit()`
function.
This causes a lot of duplicate scanning (and very inefficient scanning,
too, as the inner loop of `is_ntfs_dotgit()` was optimized for
readability rather than for speed.
Let's simplify the design of `is_ntfs_dotgit()` by putting the burden of
splitting the paths by backslashes as directory separators on the
callers of said function.
Consequently, the `verify_path()` function, which already splits the
path by directory separators, now treats backslashes as directory
separators _explicitly_ when `core.protectNTFS` is turned on, even on
platforms where the backslash is _not_ a directory separator.
Note that we have to repeat some code in `verify_path()`: if the
backslash is not a directory separator on the current Operating System,
we want to allow file names like `\`, but we _do_ want to disallow paths
that are clearly intended to cause harm when the repository is cloned on
Windows.
The `fsck_tree()` function (the other caller of `is_ntfs_dotgit()`) now
needs to look for backslashes in tree entries' names specifically when
`core.protectNTFS` is turned on. While it would be tempting to
completely disallow backslashes in that case (much like `fsck` reports
names containing forward slashes as "full paths"), this would be
overzealous: when `core.protectNTFS` is turned on in a non-Windows
setup, backslashes are perfectly valid characters in file names while we
_still_ want to disallow tree entries that are clearly designed to
exploit NTFS-specific behavior.
This simplification will make subsequent changes easier to implement,
such as turning `core.protectNTFS` on by default (not only on Windows)
or protecting against attack vectors involving NTFS Alternate Data
Streams.
Incidentally, this change allows for catching malicious repositories
that contain tree entries of the form `dir\.gitmodules` already on the
server side rather than only on the client side (and previously only on
Windows): in contrast to `is_ntfs_dotgit()`, the
`is_ntfs_dotgitmodules()` function already expects the caller to split
the paths by directory separators.
Signed-off-by: Johannes Schindelin <johannes.schindelin@gmx.de>
2019-09-23 08:58:11 +02:00
|
|
|
const char *name, *backslash;
|
2016-04-18 01:10:40 +02:00
|
|
|
const struct object_id *oid;
|
2008-02-25 22:46:08 +01:00
|
|
|
|
2016-04-18 01:10:40 +02:00
|
|
|
oid = tree_entry_extract(&desc, &name, &mode);
|
2008-02-25 22:46:08 +01:00
|
|
|
|
2016-04-18 01:10:40 +02:00
|
|
|
has_null_sha1 |= is_null_oid(oid);
|
2014-03-20 00:02:04 +01:00
|
|
|
has_full_path |= !!strchr(name, '/');
|
|
|
|
has_empty_name |= !*name;
|
|
|
|
has_dot |= !strcmp(name, ".");
|
|
|
|
has_dotdot |= !strcmp(name, "..");
|
2018-05-13 18:35:37 +02:00
|
|
|
has_dotgit |= is_hfs_dotgit(name) || is_ntfs_dotgit(name);
|
2008-02-25 22:46:08 +01:00
|
|
|
has_zero_pad |= *(char *)desc.buffer == '0';
|
fsck: detect gitmodules files
In preparation for performing fsck checks on .gitmodules
files, this commit plumbs in the actual detection of the
files. Note that unlike most other fsck checks, this cannot
be a property of a single object: we must know that the
object is found at a ".gitmodules" path at the root tree of
a commit.
Since the fsck code only sees one object at a time, we have
to mark the related objects to fit the puzzle together. When
we see a commit we mark its tree as a root tree, and when
we see a root tree with a .gitmodules file, we mark the
corresponding blob to be checked.
In an ideal world, we'd check the objects in topological
order: commits followed by trees followed by blobs. In that
case we can avoid ever loading an object twice, since all
markings would be complete by the time we get to the marked
objects. And indeed, if we are checking a single packfile,
this is the order in which Git will generally write the
objects. But we can't count on that:
1. git-fsck may show us the objects in arbitrary order
(loose objects are fed in sha1 order, but we may also
have multiple packs, and we process each pack fully in
sequence).
2. The type ordering is just what git-pack-objects happens
to write now. The pack format does not require a
specific order, and it's possible that future versions
of Git (or a custom version trying to fool official
Git's fsck checks!) may order it differently.
3. We may not even be fscking all of the relevant objects
at once. Consider pushing with transfer.fsckObjects,
where one push adds a blob at path "foo", and then a
second push adds the same blob at path ".gitmodules".
The blob is not part of the second push at all, but we
need to mark and check it.
So in the general case, we need to make up to three passes
over the objects: once to make sure we've seen all commits,
then once to cover any trees we might have missed, and then
a final pass to cover any .gitmodules blobs we found in the
second pass.
We can simplify things a bit by loosening the requirement
that we find .gitmodules only at root trees. Technically
a file like "subdir/.gitmodules" is not parsed by Git, but
it's not unreasonable for us to declare that Git is aware of
all ".gitmodules" files and make them eligible for checking.
That lets us drop the root-tree requirement, which
eliminates one pass entirely. And it makes our worst case
much better: instead of potentially queueing every root tree
to be re-examined, the worst case is that we queue each
unique .gitmodules blob for a second look.
This patch just adds the boilerplate to find .gitmodules
files. The actual content checks will come in a subsequent
commit.
Signed-off-by: Jeff King <peff@peff.net>
2018-05-02 23:20:08 +02:00
|
|
|
|
2018-05-05 02:03:35 +02:00
|
|
|
if (is_hfs_dotgitmodules(name) || is_ntfs_dotgitmodules(name)) {
|
|
|
|
if (!S_ISLNK(mode))
|
|
|
|
oidset_insert(&gitmodules_found, oid);
|
|
|
|
else
|
2019-10-18 06:59:15 +02:00
|
|
|
retval += report(options,
|
2019-10-18 07:02:08 +02:00
|
|
|
oid, OBJ_TREE,
|
2018-05-05 02:03:35 +02:00
|
|
|
FSCK_MSG_GITMODULES_SYMLINK,
|
|
|
|
".gitmodules is a symbolic link");
|
|
|
|
}
|
fsck: detect gitmodules files
In preparation for performing fsck checks on .gitmodules
files, this commit plumbs in the actual detection of the
files. Note that unlike most other fsck checks, this cannot
be a property of a single object: we must know that the
object is found at a ".gitmodules" path at the root tree of
a commit.
Since the fsck code only sees one object at a time, we have
to mark the related objects to fit the puzzle together. When
we see a commit we mark its tree as a root tree, and when
we see a root tree with a .gitmodules file, we mark the
corresponding blob to be checked.
In an ideal world, we'd check the objects in topological
order: commits followed by trees followed by blobs. In that
case we can avoid ever loading an object twice, since all
markings would be complete by the time we get to the marked
objects. And indeed, if we are checking a single packfile,
this is the order in which Git will generally write the
objects. But we can't count on that:
1. git-fsck may show us the objects in arbitrary order
(loose objects are fed in sha1 order, but we may also
have multiple packs, and we process each pack fully in
sequence).
2. The type ordering is just what git-pack-objects happens
to write now. The pack format does not require a
specific order, and it's possible that future versions
of Git (or a custom version trying to fool official
Git's fsck checks!) may order it differently.
3. We may not even be fscking all of the relevant objects
at once. Consider pushing with transfer.fsckObjects,
where one push adds a blob at path "foo", and then a
second push adds the same blob at path ".gitmodules".
The blob is not part of the second push at all, but we
need to mark and check it.
So in the general case, we need to make up to three passes
over the objects: once to make sure we've seen all commits,
then once to cover any trees we might have missed, and then
a final pass to cover any .gitmodules blobs we found in the
second pass.
We can simplify things a bit by loosening the requirement
that we find .gitmodules only at root trees. Technically
a file like "subdir/.gitmodules" is not parsed by Git, but
it's not unreasonable for us to declare that Git is aware of
all ".gitmodules" files and make them eligible for checking.
That lets us drop the root-tree requirement, which
eliminates one pass entirely. And it makes our worst case
much better: instead of potentially queueing every root tree
to be re-examined, the worst case is that we queue each
unique .gitmodules blob for a second look.
This patch just adds the boilerplate to find .gitmodules
files. The actual content checks will come in a subsequent
commit.
Signed-off-by: Jeff King <peff@peff.net>
2018-05-02 23:20:08 +02:00
|
|
|
|
is_ntfs_dotgit(): only verify the leading segment
The config setting `core.protectNTFS` is specifically designed to work
not only on Windows, but anywhere, to allow for repositories hosted on,
say, Linux servers to be protected against NTFS-specific attack vectors.
As a consequence, `is_ntfs_dotgit()` manually splits backslash-separated
paths (but does not do the same for paths separated by forward slashes),
under the assumption that the backslash might not be a valid directory
separator on the _current_ Operating System.
However, the two callers, `verify_path()` and `fsck_tree()`, are
supposed to feed only individual path segments to the `is_ntfs_dotgit()`
function.
This causes a lot of duplicate scanning (and very inefficient scanning,
too, as the inner loop of `is_ntfs_dotgit()` was optimized for
readability rather than for speed.
Let's simplify the design of `is_ntfs_dotgit()` by putting the burden of
splitting the paths by backslashes as directory separators on the
callers of said function.
Consequently, the `verify_path()` function, which already splits the
path by directory separators, now treats backslashes as directory
separators _explicitly_ when `core.protectNTFS` is turned on, even on
platforms where the backslash is _not_ a directory separator.
Note that we have to repeat some code in `verify_path()`: if the
backslash is not a directory separator on the current Operating System,
we want to allow file names like `\`, but we _do_ want to disallow paths
that are clearly intended to cause harm when the repository is cloned on
Windows.
The `fsck_tree()` function (the other caller of `is_ntfs_dotgit()`) now
needs to look for backslashes in tree entries' names specifically when
`core.protectNTFS` is turned on. While it would be tempting to
completely disallow backslashes in that case (much like `fsck` reports
names containing forward slashes as "full paths"), this would be
overzealous: when `core.protectNTFS` is turned on in a non-Windows
setup, backslashes are perfectly valid characters in file names while we
_still_ want to disallow tree entries that are clearly designed to
exploit NTFS-specific behavior.
This simplification will make subsequent changes easier to implement,
such as turning `core.protectNTFS` on by default (not only on Windows)
or protecting against attack vectors involving NTFS Alternate Data
Streams.
Incidentally, this change allows for catching malicious repositories
that contain tree entries of the form `dir\.gitmodules` already on the
server side rather than only on the client side (and previously only on
Windows): in contrast to `is_ntfs_dotgit()`, the
`is_ntfs_dotgitmodules()` function already expects the caller to split
the paths by directory separators.
Signed-off-by: Johannes Schindelin <johannes.schindelin@gmx.de>
2019-09-23 08:58:11 +02:00
|
|
|
if ((backslash = strchr(name, '\\'))) {
|
|
|
|
while (backslash) {
|
|
|
|
backslash++;
|
|
|
|
has_dotgit |= is_ntfs_dotgit(backslash);
|
2019-12-04 21:52:10 +01:00
|
|
|
if (is_ntfs_dotgitmodules(backslash)) {
|
|
|
|
if (!S_ISLNK(mode))
|
|
|
|
oidset_insert(&gitmodules_found, oid);
|
|
|
|
else
|
2019-12-10 07:17:55 +01:00
|
|
|
retval += report(options, oid, OBJ_TREE,
|
2019-12-04 21:52:10 +01:00
|
|
|
FSCK_MSG_GITMODULES_SYMLINK,
|
|
|
|
".gitmodules is a symbolic link");
|
|
|
|
}
|
is_ntfs_dotgit(): only verify the leading segment
The config setting `core.protectNTFS` is specifically designed to work
not only on Windows, but anywhere, to allow for repositories hosted on,
say, Linux servers to be protected against NTFS-specific attack vectors.
As a consequence, `is_ntfs_dotgit()` manually splits backslash-separated
paths (but does not do the same for paths separated by forward slashes),
under the assumption that the backslash might not be a valid directory
separator on the _current_ Operating System.
However, the two callers, `verify_path()` and `fsck_tree()`, are
supposed to feed only individual path segments to the `is_ntfs_dotgit()`
function.
This causes a lot of duplicate scanning (and very inefficient scanning,
too, as the inner loop of `is_ntfs_dotgit()` was optimized for
readability rather than for speed.
Let's simplify the design of `is_ntfs_dotgit()` by putting the burden of
splitting the paths by backslashes as directory separators on the
callers of said function.
Consequently, the `verify_path()` function, which already splits the
path by directory separators, now treats backslashes as directory
separators _explicitly_ when `core.protectNTFS` is turned on, even on
platforms where the backslash is _not_ a directory separator.
Note that we have to repeat some code in `verify_path()`: if the
backslash is not a directory separator on the current Operating System,
we want to allow file names like `\`, but we _do_ want to disallow paths
that are clearly intended to cause harm when the repository is cloned on
Windows.
The `fsck_tree()` function (the other caller of `is_ntfs_dotgit()`) now
needs to look for backslashes in tree entries' names specifically when
`core.protectNTFS` is turned on. While it would be tempting to
completely disallow backslashes in that case (much like `fsck` reports
names containing forward slashes as "full paths"), this would be
overzealous: when `core.protectNTFS` is turned on in a non-Windows
setup, backslashes are perfectly valid characters in file names while we
_still_ want to disallow tree entries that are clearly designed to
exploit NTFS-specific behavior.
This simplification will make subsequent changes easier to implement,
such as turning `core.protectNTFS` on by default (not only on Windows)
or protecting against attack vectors involving NTFS Alternate Data
Streams.
Incidentally, this change allows for catching malicious repositories
that contain tree entries of the form `dir\.gitmodules` already on the
server side rather than only on the client side (and previously only on
Windows): in contrast to `is_ntfs_dotgit()`, the
`is_ntfs_dotgitmodules()` function already expects the caller to split
the paths by directory separators.
Signed-off-by: Johannes Schindelin <johannes.schindelin@gmx.de>
2019-09-23 08:58:11 +02:00
|
|
|
backslash = strchr(backslash, '\\');
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
2016-09-27 22:59:51 +02:00
|
|
|
if (update_tree_entry_gently(&desc)) {
|
2019-10-18 07:02:08 +02:00
|
|
|
retval += report(options, oid, OBJ_TREE, FSCK_MSG_BAD_TREE, "cannot be parsed as a tree");
|
2016-09-27 22:59:51 +02:00
|
|
|
break;
|
|
|
|
}
|
2008-02-25 22:46:08 +01:00
|
|
|
|
|
|
|
switch (mode) {
|
|
|
|
/*
|
|
|
|
* Standard modes..
|
|
|
|
*/
|
|
|
|
case S_IFREG | 0755:
|
|
|
|
case S_IFREG | 0644:
|
|
|
|
case S_IFLNK:
|
|
|
|
case S_IFDIR:
|
|
|
|
case S_IFGITLINK:
|
|
|
|
break;
|
|
|
|
/*
|
|
|
|
* This is nonstandard, but we had a few of these
|
|
|
|
* early on when we honored the full set of mode
|
|
|
|
* bits..
|
|
|
|
*/
|
|
|
|
case S_IFREG | 0664:
|
2015-06-22 17:25:00 +02:00
|
|
|
if (!options->strict)
|
2008-02-25 22:46:08 +01:00
|
|
|
break;
|
consistently use "fallthrough" comments in switches
Gcc 7 adds -Wimplicit-fallthrough, which can warn when a
switch case falls through to the next case. The general idea
is that the compiler can't tell if this was intentional or
not, so you should annotate any intentional fall-throughs as
such, leaving it to complain about any unannotated ones.
There's a GNU __attribute__ which can be used for
annotation, but of course we'd have to #ifdef it away on
non-gcc compilers. Gcc will also recognize
specially-formatted comments, which matches our current
practice. Let's extend that practice to all of the
unannotated sites (which I did look over and verify that
they were behaving as intended).
Ideally in each case we'd actually give some reasons in the
comment about why we're falling through, or what we're
falling through to. And gcc does support that with
-Wimplicit-fallthrough=2, which relaxes the comment pattern
matching to anything that contains "fallthrough" (or a
variety of spelling variants). However, this isn't the
default for -Wimplicit-fallthrough, nor for -Wextra. In the
name of simplicity, it's probably better for us to support
the default level, which requires "fallthrough" to be the
only thing in the comment (modulo some window dressing like
"else" and some punctuation; see the gcc manual for the
complete set of patterns).
This patch suppresses all warnings due to
-Wimplicit-fallthrough. We might eventually want to add that
to the DEVELOPER Makefile knob, but we should probably wait
until gcc 7 is more widely adopted (since earlier versions
will complain about the unknown warning type).
Signed-off-by: Jeff King <peff@peff.net>
Signed-off-by: Junio C Hamano <gitster@pobox.com>
2017-09-21 08:25:41 +02:00
|
|
|
/* fallthrough */
|
2008-02-25 22:46:08 +01:00
|
|
|
default:
|
|
|
|
has_bad_modes = 1;
|
|
|
|
}
|
|
|
|
|
|
|
|
if (o_name) {
|
2020-05-10 18:12:16 +02:00
|
|
|
switch (verify_ordered(o_mode, o_name, mode, name,
|
|
|
|
&df_dup_candidates)) {
|
2008-02-25 22:46:08 +01:00
|
|
|
case TREE_UNORDERED:
|
|
|
|
not_properly_sorted = 1;
|
|
|
|
break;
|
|
|
|
case TREE_HAS_DUPS:
|
|
|
|
has_dup_entries = 1;
|
|
|
|
break;
|
|
|
|
default:
|
|
|
|
break;
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
|
|
|
o_mode = mode;
|
|
|
|
o_name = name;
|
|
|
|
}
|
|
|
|
|
2020-05-10 18:12:16 +02:00
|
|
|
name_stack_clear(&df_dup_candidates);
|
|
|
|
|
2012-07-28 17:06:29 +02:00
|
|
|
if (has_null_sha1)
|
2019-10-18 07:02:08 +02:00
|
|
|
retval += report(options, oid, OBJ_TREE, FSCK_MSG_NULL_SHA1, "contains entries pointing to null sha1");
|
2008-02-25 22:46:08 +01:00
|
|
|
if (has_full_path)
|
2019-10-18 07:02:08 +02:00
|
|
|
retval += report(options, oid, OBJ_TREE, FSCK_MSG_FULL_PATHNAME, "contains full pathnames");
|
2008-02-25 22:46:08 +01:00
|
|
|
if (has_empty_name)
|
2019-10-18 07:02:08 +02:00
|
|
|
retval += report(options, oid, OBJ_TREE, FSCK_MSG_EMPTY_NAME, "contains empty pathname");
|
2012-11-28 03:27:37 +01:00
|
|
|
if (has_dot)
|
2019-10-18 07:02:08 +02:00
|
|
|
retval += report(options, oid, OBJ_TREE, FSCK_MSG_HAS_DOT, "contains '.'");
|
2012-11-28 03:27:37 +01:00
|
|
|
if (has_dotdot)
|
2019-10-18 07:02:08 +02:00
|
|
|
retval += report(options, oid, OBJ_TREE, FSCK_MSG_HAS_DOTDOT, "contains '..'");
|
2012-11-28 22:35:29 +01:00
|
|
|
if (has_dotgit)
|
2019-10-18 07:02:08 +02:00
|
|
|
retval += report(options, oid, OBJ_TREE, FSCK_MSG_HAS_DOTGIT, "contains '.git'");
|
2008-02-25 22:46:08 +01:00
|
|
|
if (has_zero_pad)
|
2019-10-18 07:02:08 +02:00
|
|
|
retval += report(options, oid, OBJ_TREE, FSCK_MSG_ZERO_PADDED_FILEMODE, "contains zero-padded file modes");
|
2008-02-25 22:46:08 +01:00
|
|
|
if (has_bad_modes)
|
2019-10-18 07:02:08 +02:00
|
|
|
retval += report(options, oid, OBJ_TREE, FSCK_MSG_BAD_FILEMODE, "contains bad file modes");
|
2008-02-25 22:46:08 +01:00
|
|
|
if (has_dup_entries)
|
2019-10-18 07:02:08 +02:00
|
|
|
retval += report(options, oid, OBJ_TREE, FSCK_MSG_DUPLICATE_ENTRIES, "contains duplicate file entries");
|
2008-02-25 22:46:08 +01:00
|
|
|
if (not_properly_sorted)
|
2019-10-18 07:02:08 +02:00
|
|
|
retval += report(options, oid, OBJ_TREE, FSCK_MSG_TREE_NOT_SORTED, "not properly sorted");
|
2008-02-25 22:46:08 +01:00
|
|
|
return retval;
|
|
|
|
}
|
|
|
|
|
2015-06-28 20:18:31 +02:00
|
|
|
static int verify_headers(const void *data, unsigned long size,
|
2019-10-18 07:00:50 +02:00
|
|
|
const struct object_id *oid, enum object_type type,
|
|
|
|
struct fsck_options *options)
|
2014-09-11 16:26:33 +02:00
|
|
|
{
|
|
|
|
const char *buffer = (const char *)data;
|
|
|
|
unsigned long i;
|
|
|
|
|
|
|
|
for (i = 0; i < size; i++) {
|
|
|
|
switch (buffer[i]) {
|
|
|
|
case '\0':
|
2019-10-18 07:00:50 +02:00
|
|
|
return report(options, oid, type,
|
2015-06-22 17:25:09 +02:00
|
|
|
FSCK_MSG_NUL_IN_HEADER,
|
|
|
|
"unterminated header: NUL at offset %ld", i);
|
2014-09-11 16:26:33 +02:00
|
|
|
case '\n':
|
|
|
|
if (i + 1 < size && buffer[i + 1] == '\n')
|
|
|
|
return 0;
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
2015-06-28 20:18:31 +02:00
|
|
|
/*
|
|
|
|
* We did not find double-LF that separates the header
|
|
|
|
* and the body. Not having a body is not a crime but
|
|
|
|
* we do want to see the terminating LF for the last header
|
|
|
|
* line.
|
|
|
|
*/
|
|
|
|
if (size && buffer[size - 1] == '\n')
|
|
|
|
return 0;
|
|
|
|
|
2019-10-18 07:00:50 +02:00
|
|
|
return report(options, oid, type,
|
2015-06-22 17:25:09 +02:00
|
|
|
FSCK_MSG_UNTERMINATED_HEADER, "unterminated header");
|
2014-09-11 16:26:33 +02:00
|
|
|
}
|
|
|
|
|
2019-10-18 07:00:04 +02:00
|
|
|
static int fsck_ident(const char **ident,
|
|
|
|
const struct object_id *oid, enum object_type type,
|
|
|
|
struct fsck_options *options)
|
2010-04-24 18:06:08 +02:00
|
|
|
{
|
2015-06-22 17:26:03 +02:00
|
|
|
const char *p = *ident;
|
fsck: report integer overflow in author timestamps
When we check commit objects, we complain if commit->date is
ULONG_MAX, which is an indication that we saw integer
overflow when parsing it. However, we do not do any check at
all for author lines, which also contain a timestamp.
Let's actually check the timestamps on each ident line
with strtoul. This catches both author and committer lines,
and we can get rid of the now-redundant commit->date check.
Note that like the existing check, we compare only against
ULONG_MAX. Now that we are calling strtoul at the site of
the check, we could be slightly more careful and also check
that errno is set to ERANGE. However, this will make further
refactoring in future patches a little harder, and it
doesn't really matter in practice.
For 32-bit systems, one would have to create a commit at the
exact wrong second in 2038. But by the time we get close to
that, all systems will hopefully have moved to 64-bit (and
if they haven't, they have a real problem one second later).
For 64-bit systems, by the time we get close to ULONG_MAX,
all systems will hopefully have been consumed in the fiery
wrath of our expanding Sun.
Signed-off-by: Jeff King <peff@peff.net>
Signed-off-by: Junio C Hamano <gitster@pobox.com>
2014-02-24 08:39:04 +01:00
|
|
|
char *end;
|
|
|
|
|
2015-06-22 17:26:03 +02:00
|
|
|
*ident = strchrnul(*ident, '\n');
|
|
|
|
if (**ident == '\n')
|
|
|
|
(*ident)++;
|
|
|
|
|
|
|
|
if (*p == '<')
|
2019-10-18 07:00:04 +02:00
|
|
|
return report(options, oid, type, FSCK_MSG_MISSING_NAME_BEFORE_EMAIL, "invalid author/committer line - missing space before email");
|
2015-06-22 17:26:03 +02:00
|
|
|
p += strcspn(p, "<>\n");
|
|
|
|
if (*p == '>')
|
2019-10-18 07:00:04 +02:00
|
|
|
return report(options, oid, type, FSCK_MSG_BAD_NAME, "invalid author/committer line - bad name");
|
2015-06-22 17:26:03 +02:00
|
|
|
if (*p != '<')
|
2019-10-18 07:00:04 +02:00
|
|
|
return report(options, oid, type, FSCK_MSG_MISSING_EMAIL, "invalid author/committer line - missing email");
|
2015-06-22 17:26:03 +02:00
|
|
|
if (p[-1] != ' ')
|
2019-10-18 07:00:04 +02:00
|
|
|
return report(options, oid, type, FSCK_MSG_MISSING_SPACE_BEFORE_EMAIL, "invalid author/committer line - missing space before email");
|
2015-06-22 17:26:03 +02:00
|
|
|
p++;
|
|
|
|
p += strcspn(p, "<>\n");
|
|
|
|
if (*p != '>')
|
2019-10-18 07:00:04 +02:00
|
|
|
return report(options, oid, type, FSCK_MSG_BAD_EMAIL, "invalid author/committer line - bad email");
|
2015-06-22 17:26:03 +02:00
|
|
|
p++;
|
|
|
|
if (*p != ' ')
|
2019-10-18 07:00:04 +02:00
|
|
|
return report(options, oid, type, FSCK_MSG_MISSING_SPACE_BEFORE_DATE, "invalid author/committer line - missing space before date");
|
2015-06-22 17:26:03 +02:00
|
|
|
p++;
|
|
|
|
if (*p == '0' && p[1] != ' ')
|
2019-10-18 07:00:04 +02:00
|
|
|
return report(options, oid, type, FSCK_MSG_ZERO_PADDED_DATE, "invalid author/committer line - zero-padded date");
|
2017-04-21 12:45:44 +02:00
|
|
|
if (date_overflows(parse_timestamp(p, &end, 10)))
|
2019-10-18 07:00:04 +02:00
|
|
|
return report(options, oid, type, FSCK_MSG_BAD_DATE_OVERFLOW, "invalid author/committer line - date causes integer overflow");
|
2015-06-22 17:26:03 +02:00
|
|
|
if ((end == p || *end != ' '))
|
2019-10-18 07:00:04 +02:00
|
|
|
return report(options, oid, type, FSCK_MSG_BAD_DATE, "invalid author/committer line - bad date");
|
2015-06-22 17:26:03 +02:00
|
|
|
p = end + 1;
|
|
|
|
if ((*p != '+' && *p != '-') ||
|
|
|
|
!isdigit(p[1]) ||
|
|
|
|
!isdigit(p[2]) ||
|
|
|
|
!isdigit(p[3]) ||
|
|
|
|
!isdigit(p[4]) ||
|
|
|
|
(p[5] != '\n'))
|
2019-10-18 07:00:04 +02:00
|
|
|
return report(options, oid, type, FSCK_MSG_BAD_TIMEZONE, "invalid author/committer line - bad time zone");
|
2015-06-22 17:26:03 +02:00
|
|
|
p += 6;
|
2010-04-24 18:06:08 +02:00
|
|
|
return 0;
|
|
|
|
}
|
|
|
|
|
2019-10-18 07:01:48 +02:00
|
|
|
static int fsck_commit(const struct object_id *oid,
|
|
|
|
const char *buffer, unsigned long size,
|
|
|
|
struct fsck_options *options)
|
2008-02-25 22:46:08 +01:00
|
|
|
{
|
2019-10-18 07:00:59 +02:00
|
|
|
struct object_id tree_oid, parent_oid;
|
fsck: stop checking commit->parent counts
In 4516338243 (builtin-fsck: reports missing parent commits,
2008-02-25), we added code to check that fsck found the same number of
parents from parsing the commit itself as we see in the commit struct we
got from parse_commit_buffer(). Back then the rationale was that the
normal commit parser might skip some bad parents.
But earlier in this series, we started treating that reliably as a
parsing error, meaning that we'd complain about it before we even hit
the code in fsck.c.
Let's drop this code, which now makes fsck_commit_buffer() completely
independent of any parsed values in the commit struct (that's
conceptually cleaner, and also opens up more refactoring options).
Note that we can also drop the MISSING_PARENT and MISSING_GRAFT fsck
identifiers. This is no loss, as these would not trigger reliably
anyway. We'd hit them only when lookup_commit() failed, which occurs
only if we happen to have seen the object with another type already in
the same process. In most cases, we'd actually run into the problem
during the connectivity walk, not here.
Signed-off-by: Jeff King <peff@peff.net>
Signed-off-by: Junio C Hamano <gitster@pobox.com>
2019-10-18 06:49:10 +02:00
|
|
|
unsigned author_count;
|
2010-04-24 18:06:08 +02:00
|
|
|
int err;
|
2016-04-14 19:58:22 +02:00
|
|
|
const char *buffer_begin = buffer;
|
2018-05-02 02:25:41 +02:00
|
|
|
const char *p;
|
2008-02-25 22:46:08 +01:00
|
|
|
|
2019-10-18 07:01:48 +02:00
|
|
|
if (verify_headers(buffer, size, oid, OBJ_COMMIT, options))
|
2014-09-11 16:26:33 +02:00
|
|
|
return -1;
|
|
|
|
|
refactor skip_prefix to return a boolean
The skip_prefix() function returns a pointer to the content
past the prefix, or NULL if the prefix was not found. While
this is nice and simple, in practice it makes it hard to use
for two reasons:
1. When you want to conditionally skip or keep the string
as-is, you have to introduce a temporary variable.
For example:
tmp = skip_prefix(buf, "foo");
if (tmp)
buf = tmp;
2. It is verbose to check the outcome in a conditional, as
you need extra parentheses to silence compiler
warnings. For example:
if ((cp = skip_prefix(buf, "foo"))
/* do something with cp */
Both of these make it harder to use for long if-chains, and
we tend to use starts_with() instead. However, the first line
of "do something" is often to then skip forward in buf past
the prefix, either using a magic constant or with an extra
strlen(3) (which is generally computed at compile time, but
means we are repeating ourselves).
This patch refactors skip_prefix() to return a simple boolean,
and to provide the pointer value as an out-parameter. If the
prefix is not found, the out-parameter is untouched. This
lets you write:
if (skip_prefix(arg, "foo ", &arg))
do_foo(arg);
else if (skip_prefix(arg, "bar ", &arg))
do_bar(arg);
Signed-off-by: Jeff King <peff@peff.net>
Signed-off-by: Junio C Hamano <gitster@pobox.com>
2014-06-18 21:44:19 +02:00
|
|
|
if (!skip_prefix(buffer, "tree ", &buffer))
|
2019-10-18 07:01:48 +02:00
|
|
|
return report(options, oid, OBJ_COMMIT, FSCK_MSG_MISSING_TREE, "invalid format - expected 'tree' line");
|
2018-05-02 02:25:41 +02:00
|
|
|
if (parse_oid_hex(buffer, &tree_oid, &p) || *p != '\n') {
|
2019-10-18 07:01:48 +02:00
|
|
|
err = report(options, oid, OBJ_COMMIT, FSCK_MSG_BAD_TREE_SHA1, "invalid 'tree' line format - bad sha1");
|
2015-06-22 17:26:11 +02:00
|
|
|
if (err)
|
|
|
|
return err;
|
|
|
|
}
|
2018-05-02 02:25:41 +02:00
|
|
|
buffer = p + 1;
|
refactor skip_prefix to return a boolean
The skip_prefix() function returns a pointer to the content
past the prefix, or NULL if the prefix was not found. While
this is nice and simple, in practice it makes it hard to use
for two reasons:
1. When you want to conditionally skip or keep the string
as-is, you have to introduce a temporary variable.
For example:
tmp = skip_prefix(buf, "foo");
if (tmp)
buf = tmp;
2. It is verbose to check the outcome in a conditional, as
you need extra parentheses to silence compiler
warnings. For example:
if ((cp = skip_prefix(buf, "foo"))
/* do something with cp */
Both of these make it harder to use for long if-chains, and
we tend to use starts_with() instead. However, the first line
of "do something" is often to then skip forward in buf past
the prefix, either using a magic constant or with an extra
strlen(3) (which is generally computed at compile time, but
means we are repeating ourselves).
This patch refactors skip_prefix() to return a simple boolean,
and to provide the pointer value as an out-parameter. If the
prefix is not found, the out-parameter is untouched. This
lets you write:
if (skip_prefix(arg, "foo ", &arg))
do_foo(arg);
else if (skip_prefix(arg, "bar ", &arg))
do_bar(arg);
Signed-off-by: Jeff King <peff@peff.net>
Signed-off-by: Junio C Hamano <gitster@pobox.com>
2014-06-18 21:44:19 +02:00
|
|
|
while (skip_prefix(buffer, "parent ", &buffer)) {
|
2019-10-18 07:00:59 +02:00
|
|
|
if (parse_oid_hex(buffer, &parent_oid, &p) || *p != '\n') {
|
2019-10-18 07:01:48 +02:00
|
|
|
err = report(options, oid, OBJ_COMMIT, FSCK_MSG_BAD_PARENT_SHA1, "invalid 'parent' line format - bad sha1");
|
2015-06-22 17:26:11 +02:00
|
|
|
if (err)
|
|
|
|
return err;
|
|
|
|
}
|
2018-05-02 02:25:41 +02:00
|
|
|
buffer = p + 1;
|
2008-02-25 22:46:08 +01:00
|
|
|
}
|
2015-06-22 17:26:23 +02:00
|
|
|
author_count = 0;
|
|
|
|
while (skip_prefix(buffer, "author ", &buffer)) {
|
|
|
|
author_count++;
|
2019-10-18 07:01:48 +02:00
|
|
|
err = fsck_ident(&buffer, oid, OBJ_COMMIT, options);
|
2015-06-22 17:26:23 +02:00
|
|
|
if (err)
|
|
|
|
return err;
|
2008-02-25 22:46:08 +01:00
|
|
|
}
|
2015-06-22 17:26:23 +02:00
|
|
|
if (author_count < 1)
|
2019-10-18 07:01:48 +02:00
|
|
|
err = report(options, oid, OBJ_COMMIT, FSCK_MSG_MISSING_AUTHOR, "invalid format - expected 'author' line");
|
2015-06-22 17:26:23 +02:00
|
|
|
else if (author_count > 1)
|
2019-10-18 07:01:48 +02:00
|
|
|
err = report(options, oid, OBJ_COMMIT, FSCK_MSG_MULTIPLE_AUTHORS, "invalid format - multiple 'author' lines");
|
2010-04-24 18:06:08 +02:00
|
|
|
if (err)
|
|
|
|
return err;
|
refactor skip_prefix to return a boolean
The skip_prefix() function returns a pointer to the content
past the prefix, or NULL if the prefix was not found. While
this is nice and simple, in practice it makes it hard to use
for two reasons:
1. When you want to conditionally skip or keep the string
as-is, you have to introduce a temporary variable.
For example:
tmp = skip_prefix(buf, "foo");
if (tmp)
buf = tmp;
2. It is verbose to check the outcome in a conditional, as
you need extra parentheses to silence compiler
warnings. For example:
if ((cp = skip_prefix(buf, "foo"))
/* do something with cp */
Both of these make it harder to use for long if-chains, and
we tend to use starts_with() instead. However, the first line
of "do something" is often to then skip forward in buf past
the prefix, either using a magic constant or with an extra
strlen(3) (which is generally computed at compile time, but
means we are repeating ourselves).
This patch refactors skip_prefix() to return a simple boolean,
and to provide the pointer value as an out-parameter. If the
prefix is not found, the out-parameter is untouched. This
lets you write:
if (skip_prefix(arg, "foo ", &arg))
do_foo(arg);
else if (skip_prefix(arg, "bar ", &arg))
do_bar(arg);
Signed-off-by: Jeff King <peff@peff.net>
Signed-off-by: Junio C Hamano <gitster@pobox.com>
2014-06-18 21:44:19 +02:00
|
|
|
if (!skip_prefix(buffer, "committer ", &buffer))
|
2019-10-18 07:01:48 +02:00
|
|
|
return report(options, oid, OBJ_COMMIT, FSCK_MSG_MISSING_COMMITTER, "invalid format - expected 'committer' line");
|
|
|
|
err = fsck_ident(&buffer, oid, OBJ_COMMIT, options);
|
2010-04-24 18:06:08 +02:00
|
|
|
if (err)
|
|
|
|
return err;
|
2016-04-14 19:58:22 +02:00
|
|
|
if (memchr(buffer_begin, '\0', size)) {
|
2019-10-18 07:01:48 +02:00
|
|
|
err = report(options, oid, OBJ_COMMIT, FSCK_MSG_NUL_IN_COMMIT,
|
2016-04-14 19:58:22 +02:00
|
|
|
"NUL byte in the commit object body");
|
|
|
|
if (err)
|
|
|
|
return err;
|
|
|
|
}
|
2008-02-25 22:46:08 +01:00
|
|
|
return 0;
|
|
|
|
}
|
|
|
|
|
2019-10-18 07:01:26 +02:00
|
|
|
static int fsck_tag(const struct object_id *oid, const char *buffer,
|
fsck: stop checking tag->tagged
Way back in 92d4c85d24 (fsck-cache: fix SIGSEGV on bad tag object,
2005-05-03), we added an fsck check that the "tagged" field of a tag
struct isn't NULL. But that was mainly protecting the printing code for
"--tags", and that code wasn't moved along with the check as part of
ba002f3b28 (builtin-fsck: move common object checking code to fsck.c,
2008-02-25).
It could also serve to detect type mismatch problems (where a tag points
to object X as a commit, but really X is a blob), but it couldn't do so
reliably (we'd call lookup_commit(X), but it will only notice the
problem if we happen to have previously called lookup_blob(X) in the
same process). And as of a commit earlier in this series, we'd consider
that a parse error and complain about the object even before getting to
this point anyway.
So let's drop this "tag->tagged" check. It's not helping anything, and
getting rid of it makes the function conceptually cleaner, as it really
is just checking the buffer we feed it. In fact, we can get rid of our
one-line wrapper and just unify fsck_tag() and fsck_tag_buffer().
Signed-off-by: Jeff King <peff@peff.net>
Signed-off-by: Junio C Hamano <gitster@pobox.com>
2019-10-18 06:51:19 +02:00
|
|
|
unsigned long size, struct fsck_options *options)
|
2014-09-11 16:26:38 +02:00
|
|
|
{
|
2019-10-18 07:00:59 +02:00
|
|
|
struct object_id tagged_oid;
|
mktag: use fsck instead of custom verify_tag()
Change the validation logic in "mktag" to use fsck's fsck_tag()
instead of its own custom parser. Curiously the logic for both dates
back to the same commit[1]. Let's unify them so we're not maintaining
two sets functions to verify that a tag is OK.
The behavior of fsck_tag() and the old "mktag" code being removed here
is different in few aspects.
I think it makes sense to remove some of those checks, namely:
A. fsck only cares that the timezone matches [-+][0-9]{4}. The mktag
code disallowed values larger than 1400.
Yes there's currently no timezone with a greater offset[2], but
since we allow any number of non-offical timezones (e.g. +1234)
passing this through seems fine. Git also won't break in the
future if e.g. French Polynesia decides it needs to outdo the Line
Islands when it comes to timezone extravagance.
B. fsck allows missing author names such as "tagger <email>", mktag
wouldn't, but would allow e.g. "tagger [2 spaces] <email>" (but
not "tagger [1 space] <email>"). Now we allow all of these.
C. Like B, but "mktag" disallowed spaces in the <email> part, fsck
allows it.
In some ways fsck_tag() is stricter than "mktag" was, namely:
D. fsck disallows zero-padded dates, but mktag didn't care. So
e.g. the timestamp "0000000000 +0000" produces an error now. A
test in "t1006-cat-file.sh" relied on this, it's been changed to
use "hash-object" (without fsck) instead.
There was one check I deemed worth keeping by porting it over to
fsck_tag():
E. "mktag" did not allow any custom headers, and by extension (as an
empty commit is allowed) also forbade an extra stray trailing
newline after the headers it knew about.
Add a new check in the "ignore" category to fsck and use it. This
somewhat abuses the facility added in efaba7cc77f (fsck:
optionally ignore specific fsck issues completely, 2015-06-22).
This is somewhat of hack, but probably the least invasive change
we can make here. The fsck command will shuffle these categories
around, e.g. under --strict the "info" becomes a "warn" and "warn"
becomes "error". Existing users of fsck's (and others,
e.g. index-pack) --strict option rely on this.
So we need to put something into a category that'll be ignored by
all existing users of the API. Pretending that
fsck.extraHeaderEntry=error ("ignore" by default) was set serves
to do this for us.
1. ec4465adb38 (Add "tag" objects that can be used to sign other
objects., 2005-04-25)
2. https://en.wikipedia.org/wiki/List_of_UTC_time_offsets
Signed-off-by: Ævar Arnfjörð Bjarmason <avarab@gmail.com>
Signed-off-by: Junio C Hamano <gitster@pobox.com>
2021-01-05 20:42:46 +01:00
|
|
|
int tagged_type;
|
|
|
|
return fsck_tag_standalone(oid, buffer, size, options, &tagged_oid,
|
|
|
|
&tagged_type);
|
|
|
|
}
|
|
|
|
|
|
|
|
int fsck_tag_standalone(const struct object_id *oid, const char *buffer,
|
|
|
|
unsigned long size, struct fsck_options *options,
|
|
|
|
struct object_id *tagged_oid,
|
|
|
|
int *tagged_type)
|
|
|
|
{
|
2014-09-11 16:26:38 +02:00
|
|
|
int ret = 0;
|
fsck: require an actual buffer for non-blobs
The fsck_object() function takes in a buffer, but also a "struct
object". The rules for using these vary between types:
- for a commit, we'll use the provided buffer; if it's NULL, we'll
fall back to get_commit_buffer(), which loads from either an
in-memory cache or from disk. If the latter fails, we'd die(), which
is non-ideal for fsck.
- for a tag, a NULL buffer will fall back to loading the object from
disk (and failure would lead to an fsck error)
- for a tree, we _never_ look at the provided buffer, and always use
tree->buffer
- for a blob, we usually don't look at the buffer at all, unless it
has been marked as a .gitmodule file. In that case we check the
buffer given to us, or assume a NULL buffer is a very large blob
(and complain about it)
This is much more complex than it needs to be. It turns out that nobody
ever feeds a NULL buffer that isn't a blob:
- git-fsck calls fsck_object() only from fsck_obj(). That in turn is
called by one of:
- fsck_obj_buffer(), which is a callback to verify_pack(), which
unpacks everything except large blobs into a buffer (see
pack-check.c, lines 131-141).
- fsck_loose(), which hits a BUG() on non-blobs with a NULL buffer
(builtin/fsck.c, lines 639-640)
And in either case, we'll have just called parse_object_buffer()
anyway, which would segfault on a NULL buffer for commits or tags
(not for trees, but it would install a NULL tree->buffer which would
later cause a segfault)
- git-index-pack asserts that the buffer is non-NULL unless the object
is a blob (see builtin/index-pack.c, line 832)
- git-unpack-objects always writes a non-NULL buffer into its
obj_buffer hash, which is then fed to fsck_object(). (There is
actually a funny thing here where it does not store blob buffers at
all, nor does it call fsck on them; it does check any needed blobs
via fsck_finish() though).
Let's make the rules simpler, which reduces the amount of code and gives
us more flexibility in refactoring the fsck code. The new rules are:
- only blobs are allowed to pass a NULL buffer
- we always use the provided buffer, never pulling information from
the object struct
We don't have to adjust any callers, because they were already adhering
to these. Note that we do drop a few fsck identifiers for missing tags,
but that was all dead code (because nobody passed a NULL tag buffer).
Signed-off-by: Jeff King <peff@peff.net>
Signed-off-by: Junio C Hamano <gitster@pobox.com>
2019-10-18 06:54:12 +02:00
|
|
|
char *eol;
|
2014-09-11 16:26:38 +02:00
|
|
|
struct strbuf sb = STRBUF_INIT;
|
2018-05-02 02:25:41 +02:00
|
|
|
const char *p;
|
2014-09-11 16:26:38 +02:00
|
|
|
|
2019-10-18 07:01:26 +02:00
|
|
|
ret = verify_headers(buffer, size, oid, OBJ_TAG, options);
|
2015-11-19 17:25:31 +01:00
|
|
|
if (ret)
|
2014-09-11 16:26:38 +02:00
|
|
|
goto done;
|
|
|
|
|
|
|
|
if (!skip_prefix(buffer, "object ", &buffer)) {
|
2019-10-18 07:01:26 +02:00
|
|
|
ret = report(options, oid, OBJ_TAG, FSCK_MSG_MISSING_OBJECT, "invalid format - expected 'object' line");
|
2014-09-11 16:26:38 +02:00
|
|
|
goto done;
|
|
|
|
}
|
mktag: use fsck instead of custom verify_tag()
Change the validation logic in "mktag" to use fsck's fsck_tag()
instead of its own custom parser. Curiously the logic for both dates
back to the same commit[1]. Let's unify them so we're not maintaining
two sets functions to verify that a tag is OK.
The behavior of fsck_tag() and the old "mktag" code being removed here
is different in few aspects.
I think it makes sense to remove some of those checks, namely:
A. fsck only cares that the timezone matches [-+][0-9]{4}. The mktag
code disallowed values larger than 1400.
Yes there's currently no timezone with a greater offset[2], but
since we allow any number of non-offical timezones (e.g. +1234)
passing this through seems fine. Git also won't break in the
future if e.g. French Polynesia decides it needs to outdo the Line
Islands when it comes to timezone extravagance.
B. fsck allows missing author names such as "tagger <email>", mktag
wouldn't, but would allow e.g. "tagger [2 spaces] <email>" (but
not "tagger [1 space] <email>"). Now we allow all of these.
C. Like B, but "mktag" disallowed spaces in the <email> part, fsck
allows it.
In some ways fsck_tag() is stricter than "mktag" was, namely:
D. fsck disallows zero-padded dates, but mktag didn't care. So
e.g. the timestamp "0000000000 +0000" produces an error now. A
test in "t1006-cat-file.sh" relied on this, it's been changed to
use "hash-object" (without fsck) instead.
There was one check I deemed worth keeping by porting it over to
fsck_tag():
E. "mktag" did not allow any custom headers, and by extension (as an
empty commit is allowed) also forbade an extra stray trailing
newline after the headers it knew about.
Add a new check in the "ignore" category to fsck and use it. This
somewhat abuses the facility added in efaba7cc77f (fsck:
optionally ignore specific fsck issues completely, 2015-06-22).
This is somewhat of hack, but probably the least invasive change
we can make here. The fsck command will shuffle these categories
around, e.g. under --strict the "info" becomes a "warn" and "warn"
becomes "error". Existing users of fsck's (and others,
e.g. index-pack) --strict option rely on this.
So we need to put something into a category that'll be ignored by
all existing users of the API. Pretending that
fsck.extraHeaderEntry=error ("ignore" by default) was set serves
to do this for us.
1. ec4465adb38 (Add "tag" objects that can be used to sign other
objects., 2005-04-25)
2. https://en.wikipedia.org/wiki/List_of_UTC_time_offsets
Signed-off-by: Ævar Arnfjörð Bjarmason <avarab@gmail.com>
Signed-off-by: Junio C Hamano <gitster@pobox.com>
2021-01-05 20:42:46 +01:00
|
|
|
if (parse_oid_hex(buffer, tagged_oid, &p) || *p != '\n') {
|
2019-10-18 07:01:26 +02:00
|
|
|
ret = report(options, oid, OBJ_TAG, FSCK_MSG_BAD_OBJECT_SHA1, "invalid 'object' line format - bad sha1");
|
2015-06-22 17:26:30 +02:00
|
|
|
if (ret)
|
|
|
|
goto done;
|
2014-09-11 16:26:38 +02:00
|
|
|
}
|
2018-05-02 02:25:41 +02:00
|
|
|
buffer = p + 1;
|
2014-09-11 16:26:38 +02:00
|
|
|
|
|
|
|
if (!skip_prefix(buffer, "type ", &buffer)) {
|
2019-10-18 07:01:26 +02:00
|
|
|
ret = report(options, oid, OBJ_TAG, FSCK_MSG_MISSING_TYPE_ENTRY, "invalid format - expected 'type' line");
|
2014-09-11 16:26:38 +02:00
|
|
|
goto done;
|
|
|
|
}
|
|
|
|
eol = strchr(buffer, '\n');
|
|
|
|
if (!eol) {
|
2019-10-18 07:01:26 +02:00
|
|
|
ret = report(options, oid, OBJ_TAG, FSCK_MSG_MISSING_TYPE, "invalid format - unexpected end after 'type' line");
|
2014-09-11 16:26:38 +02:00
|
|
|
goto done;
|
|
|
|
}
|
mktag: use fsck instead of custom verify_tag()
Change the validation logic in "mktag" to use fsck's fsck_tag()
instead of its own custom parser. Curiously the logic for both dates
back to the same commit[1]. Let's unify them so we're not maintaining
two sets functions to verify that a tag is OK.
The behavior of fsck_tag() and the old "mktag" code being removed here
is different in few aspects.
I think it makes sense to remove some of those checks, namely:
A. fsck only cares that the timezone matches [-+][0-9]{4}. The mktag
code disallowed values larger than 1400.
Yes there's currently no timezone with a greater offset[2], but
since we allow any number of non-offical timezones (e.g. +1234)
passing this through seems fine. Git also won't break in the
future if e.g. French Polynesia decides it needs to outdo the Line
Islands when it comes to timezone extravagance.
B. fsck allows missing author names such as "tagger <email>", mktag
wouldn't, but would allow e.g. "tagger [2 spaces] <email>" (but
not "tagger [1 space] <email>"). Now we allow all of these.
C. Like B, but "mktag" disallowed spaces in the <email> part, fsck
allows it.
In some ways fsck_tag() is stricter than "mktag" was, namely:
D. fsck disallows zero-padded dates, but mktag didn't care. So
e.g. the timestamp "0000000000 +0000" produces an error now. A
test in "t1006-cat-file.sh" relied on this, it's been changed to
use "hash-object" (without fsck) instead.
There was one check I deemed worth keeping by porting it over to
fsck_tag():
E. "mktag" did not allow any custom headers, and by extension (as an
empty commit is allowed) also forbade an extra stray trailing
newline after the headers it knew about.
Add a new check in the "ignore" category to fsck and use it. This
somewhat abuses the facility added in efaba7cc77f (fsck:
optionally ignore specific fsck issues completely, 2015-06-22).
This is somewhat of hack, but probably the least invasive change
we can make here. The fsck command will shuffle these categories
around, e.g. under --strict the "info" becomes a "warn" and "warn"
becomes "error". Existing users of fsck's (and others,
e.g. index-pack) --strict option rely on this.
So we need to put something into a category that'll be ignored by
all existing users of the API. Pretending that
fsck.extraHeaderEntry=error ("ignore" by default) was set serves
to do this for us.
1. ec4465adb38 (Add "tag" objects that can be used to sign other
objects., 2005-04-25)
2. https://en.wikipedia.org/wiki/List_of_UTC_time_offsets
Signed-off-by: Ævar Arnfjörð Bjarmason <avarab@gmail.com>
Signed-off-by: Junio C Hamano <gitster@pobox.com>
2021-01-05 20:42:46 +01:00
|
|
|
*tagged_type = type_from_string_gently(buffer, eol - buffer, 1);
|
|
|
|
if (*tagged_type < 0)
|
2019-10-18 07:01:26 +02:00
|
|
|
ret = report(options, oid, OBJ_TAG, FSCK_MSG_BAD_TYPE, "invalid 'type' value");
|
2014-09-11 16:26:38 +02:00
|
|
|
if (ret)
|
|
|
|
goto done;
|
|
|
|
buffer = eol + 1;
|
|
|
|
|
|
|
|
if (!skip_prefix(buffer, "tag ", &buffer)) {
|
2019-10-18 07:01:26 +02:00
|
|
|
ret = report(options, oid, OBJ_TAG, FSCK_MSG_MISSING_TAG_ENTRY, "invalid format - expected 'tag' line");
|
2014-09-11 16:26:38 +02:00
|
|
|
goto done;
|
|
|
|
}
|
|
|
|
eol = strchr(buffer, '\n');
|
|
|
|
if (!eol) {
|
2019-10-18 07:01:26 +02:00
|
|
|
ret = report(options, oid, OBJ_TAG, FSCK_MSG_MISSING_TAG, "invalid format - unexpected end after 'type' line");
|
2014-09-11 16:26:38 +02:00
|
|
|
goto done;
|
|
|
|
}
|
|
|
|
strbuf_addf(&sb, "refs/tags/%.*s", (int)(eol - buffer), buffer);
|
2015-06-22 17:26:54 +02:00
|
|
|
if (check_refname_format(sb.buf, 0)) {
|
2019-10-18 07:01:26 +02:00
|
|
|
ret = report(options, oid, OBJ_TAG,
|
2019-10-18 06:59:15 +02:00
|
|
|
FSCK_MSG_BAD_TAG_NAME,
|
|
|
|
"invalid 'tag' name: %.*s",
|
|
|
|
(int)(eol - buffer), buffer);
|
2015-06-22 17:26:54 +02:00
|
|
|
if (ret)
|
|
|
|
goto done;
|
|
|
|
}
|
2014-09-11 16:26:38 +02:00
|
|
|
buffer = eol + 1;
|
|
|
|
|
2015-06-22 17:26:54 +02:00
|
|
|
if (!skip_prefix(buffer, "tagger ", &buffer)) {
|
2014-09-11 16:26:38 +02:00
|
|
|
/* early tags do not contain 'tagger' lines; warn only */
|
2019-10-18 07:01:26 +02:00
|
|
|
ret = report(options, oid, OBJ_TAG, FSCK_MSG_MISSING_TAGGER_ENTRY, "invalid format - expected 'tagger' line");
|
2015-06-22 17:26:54 +02:00
|
|
|
if (ret)
|
|
|
|
goto done;
|
|
|
|
}
|
2014-09-11 16:26:38 +02:00
|
|
|
else
|
2019-10-18 07:01:26 +02:00
|
|
|
ret = fsck_ident(&buffer, oid, OBJ_TAG, options);
|
2021-01-05 20:42:49 +01:00
|
|
|
if (!*buffer)
|
|
|
|
goto done;
|
2014-09-11 16:26:38 +02:00
|
|
|
|
mktag: use fsck instead of custom verify_tag()
Change the validation logic in "mktag" to use fsck's fsck_tag()
instead of its own custom parser. Curiously the logic for both dates
back to the same commit[1]. Let's unify them so we're not maintaining
two sets functions to verify that a tag is OK.
The behavior of fsck_tag() and the old "mktag" code being removed here
is different in few aspects.
I think it makes sense to remove some of those checks, namely:
A. fsck only cares that the timezone matches [-+][0-9]{4}. The mktag
code disallowed values larger than 1400.
Yes there's currently no timezone with a greater offset[2], but
since we allow any number of non-offical timezones (e.g. +1234)
passing this through seems fine. Git also won't break in the
future if e.g. French Polynesia decides it needs to outdo the Line
Islands when it comes to timezone extravagance.
B. fsck allows missing author names such as "tagger <email>", mktag
wouldn't, but would allow e.g. "tagger [2 spaces] <email>" (but
not "tagger [1 space] <email>"). Now we allow all of these.
C. Like B, but "mktag" disallowed spaces in the <email> part, fsck
allows it.
In some ways fsck_tag() is stricter than "mktag" was, namely:
D. fsck disallows zero-padded dates, but mktag didn't care. So
e.g. the timestamp "0000000000 +0000" produces an error now. A
test in "t1006-cat-file.sh" relied on this, it's been changed to
use "hash-object" (without fsck) instead.
There was one check I deemed worth keeping by porting it over to
fsck_tag():
E. "mktag" did not allow any custom headers, and by extension (as an
empty commit is allowed) also forbade an extra stray trailing
newline after the headers it knew about.
Add a new check in the "ignore" category to fsck and use it. This
somewhat abuses the facility added in efaba7cc77f (fsck:
optionally ignore specific fsck issues completely, 2015-06-22).
This is somewhat of hack, but probably the least invasive change
we can make here. The fsck command will shuffle these categories
around, e.g. under --strict the "info" becomes a "warn" and "warn"
becomes "error". Existing users of fsck's (and others,
e.g. index-pack) --strict option rely on this.
So we need to put something into a category that'll be ignored by
all existing users of the API. Pretending that
fsck.extraHeaderEntry=error ("ignore" by default) was set serves
to do this for us.
1. ec4465adb38 (Add "tag" objects that can be used to sign other
objects., 2005-04-25)
2. https://en.wikipedia.org/wiki/List_of_UTC_time_offsets
Signed-off-by: Ævar Arnfjörð Bjarmason <avarab@gmail.com>
Signed-off-by: Junio C Hamano <gitster@pobox.com>
2021-01-05 20:42:46 +01:00
|
|
|
if (!starts_with(buffer, "\n")) {
|
|
|
|
/*
|
|
|
|
* The verify_headers() check will allow
|
|
|
|
* e.g. "[...]tagger <tagger>\nsome
|
|
|
|
* garbage\n\nmessage" to pass, thinking "some
|
|
|
|
* garbage" could be a custom header. E.g. "mktag"
|
|
|
|
* doesn't want any unknown headers.
|
|
|
|
*/
|
|
|
|
ret = report(options, oid, OBJ_TAG, FSCK_MSG_EXTRA_HEADER_ENTRY, "invalid format - extra header(s) after 'tagger'");
|
|
|
|
if (ret)
|
|
|
|
goto done;
|
|
|
|
}
|
|
|
|
|
2014-09-11 16:26:38 +02:00
|
|
|
done:
|
|
|
|
strbuf_release(&sb);
|
|
|
|
return ret;
|
|
|
|
}
|
|
|
|
|
2020-04-19 05:52:34 +02:00
|
|
|
/*
|
|
|
|
* Like builtin/submodule--helper.c's starts_with_dot_slash, but without
|
|
|
|
* relying on the platform-dependent is_dir_sep helper.
|
|
|
|
*
|
|
|
|
* This is for use in checking whether a submodule URL is interpreted as
|
|
|
|
* relative to the current directory on any platform, since \ is a
|
|
|
|
* directory separator on Windows but not on other platforms.
|
|
|
|
*/
|
|
|
|
static int starts_with_dot_slash(const char *str)
|
|
|
|
{
|
|
|
|
return str[0] == '.' && (str[1] == '/' || str[1] == '\\');
|
|
|
|
}
|
|
|
|
|
|
|
|
/*
|
|
|
|
* Like starts_with_dot_slash, this is a variant of submodule--helper's
|
|
|
|
* helper of the same name with the twist that it accepts backslash as a
|
|
|
|
* directory separator even on non-Windows platforms.
|
|
|
|
*/
|
|
|
|
static int starts_with_dot_dot_slash(const char *str)
|
|
|
|
{
|
|
|
|
return str[0] == '.' && starts_with_dot_slash(str + 1);
|
|
|
|
}
|
|
|
|
|
|
|
|
static int submodule_url_is_relative(const char *url)
|
|
|
|
{
|
|
|
|
return starts_with_dot_slash(url) || starts_with_dot_dot_slash(url);
|
|
|
|
}
|
|
|
|
|
credential: treat URL without scheme as invalid
libcurl permits making requests without a URL scheme specified. In
this case, it guesses the URL from the hostname, so I can run
git ls-remote http::ftp.example.com/path/to/repo
and it would make an FTP request.
Any user intentionally using such a URL is likely to have made a typo.
Unfortunately, credential_from_url is not able to determine the host and
protocol in order to determine appropriate credentials to send, and
until "credential: refuse to operate when missing host or protocol",
this resulted in another host's credentials being leaked to the named
host.
Teach credential_from_url_gently to consider such a URL to be invalid
so that fsck can detect and block gitmodules files with such URLs,
allowing server operators to avoid serving them to downstream users
running older versions of Git.
This also means that when such URLs are passed on the command line, Git
will print a clearer error so affected users can switch to the simpler
URL that explicitly specifies the host and protocol they intend.
One subtlety: .gitmodules files can contain relative URLs, representing
a URL relative to the URL they were cloned from. The relative URL
resolver used for .gitmodules can follow ".." components out of the path
part and past the host part of a URL, meaning that such a relative URL
can be used to traverse from a https://foo.example.com/innocent
superproject to a https::attacker.example.com/exploit submodule.
Fortunately a leading ':' in the first path component after a series of
leading './' and '../' components is unlikely to show up in other
contexts, so we can catch this by detecting that pattern.
Reported-by: Jeff King <peff@peff.net>
Signed-off-by: Jonathan Nieder <jrnieder@gmail.com>
Reviewed-by: Jeff King <peff@peff.net>
2020-04-19 05:54:13 +02:00
|
|
|
/*
|
|
|
|
* Count directory components that a relative submodule URL should chop
|
|
|
|
* from the remote_url it is to be resolved against.
|
|
|
|
*
|
|
|
|
* In other words, this counts "../" components at the start of a
|
|
|
|
* submodule URL.
|
|
|
|
*
|
|
|
|
* Returns the number of directory components to chop and writes a
|
|
|
|
* pointer to the next character of url after all leading "./" and
|
|
|
|
* "../" components to out.
|
|
|
|
*/
|
|
|
|
static int count_leading_dotdots(const char *url, const char **out)
|
|
|
|
{
|
|
|
|
int result = 0;
|
|
|
|
while (1) {
|
|
|
|
if (starts_with_dot_dot_slash(url)) {
|
|
|
|
result++;
|
|
|
|
url += strlen("../");
|
|
|
|
continue;
|
|
|
|
}
|
|
|
|
if (starts_with_dot_slash(url)) {
|
|
|
|
url += strlen("./");
|
|
|
|
continue;
|
|
|
|
}
|
|
|
|
*out = url;
|
|
|
|
return result;
|
|
|
|
}
|
|
|
|
}
|
2020-04-19 05:52:34 +02:00
|
|
|
/*
|
|
|
|
* Check whether a transport is implemented by git-remote-curl.
|
|
|
|
*
|
|
|
|
* If it is, returns 1 and writes the URL that would be passed to
|
|
|
|
* git-remote-curl to the "out" parameter.
|
|
|
|
*
|
|
|
|
* Otherwise, returns 0 and leaves "out" untouched.
|
|
|
|
*
|
|
|
|
* Examples:
|
|
|
|
* http::https://example.com/repo.git -> 1, https://example.com/repo.git
|
|
|
|
* https://example.com/repo.git -> 1, https://example.com/repo.git
|
|
|
|
* git://example.com/repo.git -> 0
|
|
|
|
*
|
|
|
|
* This is for use in checking for previously exploitable bugs that
|
|
|
|
* required a submodule URL to be passed to git-remote-curl.
|
|
|
|
*/
|
|
|
|
static int url_to_curl_url(const char *url, const char **out)
|
|
|
|
{
|
|
|
|
/*
|
|
|
|
* We don't need to check for case-aliases, "http.exe", and so
|
|
|
|
* on because in the default configuration, is_transport_allowed
|
|
|
|
* prevents URLs with those schemes from being cloned
|
|
|
|
* automatically.
|
|
|
|
*/
|
|
|
|
if (skip_prefix(url, "http::", out) ||
|
|
|
|
skip_prefix(url, "https::", out) ||
|
|
|
|
skip_prefix(url, "ftp::", out) ||
|
|
|
|
skip_prefix(url, "ftps::", out))
|
|
|
|
return 1;
|
|
|
|
if (starts_with(url, "http://") ||
|
|
|
|
starts_with(url, "https://") ||
|
|
|
|
starts_with(url, "ftp://") ||
|
|
|
|
starts_with(url, "ftps://")) {
|
|
|
|
*out = url;
|
|
|
|
return 1;
|
|
|
|
}
|
|
|
|
return 0;
|
|
|
|
}
|
|
|
|
|
2020-03-11 23:48:24 +01:00
|
|
|
static int check_submodule_url(const char *url)
|
|
|
|
{
|
2020-04-19 05:52:34 +02:00
|
|
|
const char *curl_url;
|
2020-03-11 23:48:24 +01:00
|
|
|
|
|
|
|
if (looks_like_command_line_option(url))
|
|
|
|
return -1;
|
|
|
|
|
2021-01-07 10:44:17 +01:00
|
|
|
if (submodule_url_is_relative(url) || starts_with(url, "git://")) {
|
credential: treat URL without scheme as invalid
libcurl permits making requests without a URL scheme specified. In
this case, it guesses the URL from the hostname, so I can run
git ls-remote http::ftp.example.com/path/to/repo
and it would make an FTP request.
Any user intentionally using such a URL is likely to have made a typo.
Unfortunately, credential_from_url is not able to determine the host and
protocol in order to determine appropriate credentials to send, and
until "credential: refuse to operate when missing host or protocol",
this resulted in another host's credentials being leaked to the named
host.
Teach credential_from_url_gently to consider such a URL to be invalid
so that fsck can detect and block gitmodules files with such URLs,
allowing server operators to avoid serving them to downstream users
running older versions of Git.
This also means that when such URLs are passed on the command line, Git
will print a clearer error so affected users can switch to the simpler
URL that explicitly specifies the host and protocol they intend.
One subtlety: .gitmodules files can contain relative URLs, representing
a URL relative to the URL they were cloned from. The relative URL
resolver used for .gitmodules can follow ".." components out of the path
part and past the host part of a URL, meaning that such a relative URL
can be used to traverse from a https://foo.example.com/innocent
superproject to a https::attacker.example.com/exploit submodule.
Fortunately a leading ':' in the first path component after a series of
leading './' and '../' components is unlikely to show up in other
contexts, so we can catch this by detecting that pattern.
Reported-by: Jeff King <peff@peff.net>
Signed-off-by: Jonathan Nieder <jrnieder@gmail.com>
Reviewed-by: Jeff King <peff@peff.net>
2020-04-19 05:54:13 +02:00
|
|
|
char *decoded;
|
|
|
|
const char *next;
|
|
|
|
int has_nl;
|
|
|
|
|
2020-04-19 05:52:34 +02:00
|
|
|
/*
|
|
|
|
* This could be appended to an http URL and url-decoded;
|
|
|
|
* check for malicious characters.
|
|
|
|
*/
|
credential: treat URL without scheme as invalid
libcurl permits making requests without a URL scheme specified. In
this case, it guesses the URL from the hostname, so I can run
git ls-remote http::ftp.example.com/path/to/repo
and it would make an FTP request.
Any user intentionally using such a URL is likely to have made a typo.
Unfortunately, credential_from_url is not able to determine the host and
protocol in order to determine appropriate credentials to send, and
until "credential: refuse to operate when missing host or protocol",
this resulted in another host's credentials being leaked to the named
host.
Teach credential_from_url_gently to consider such a URL to be invalid
so that fsck can detect and block gitmodules files with such URLs,
allowing server operators to avoid serving them to downstream users
running older versions of Git.
This also means that when such URLs are passed on the command line, Git
will print a clearer error so affected users can switch to the simpler
URL that explicitly specifies the host and protocol they intend.
One subtlety: .gitmodules files can contain relative URLs, representing
a URL relative to the URL they were cloned from. The relative URL
resolver used for .gitmodules can follow ".." components out of the path
part and past the host part of a URL, meaning that such a relative URL
can be used to traverse from a https://foo.example.com/innocent
superproject to a https::attacker.example.com/exploit submodule.
Fortunately a leading ':' in the first path component after a series of
leading './' and '../' components is unlikely to show up in other
contexts, so we can catch this by detecting that pattern.
Reported-by: Jeff King <peff@peff.net>
Signed-off-by: Jonathan Nieder <jrnieder@gmail.com>
Reviewed-by: Jeff King <peff@peff.net>
2020-04-19 05:54:13 +02:00
|
|
|
decoded = url_decode(url);
|
|
|
|
has_nl = !!strchr(decoded, '\n');
|
|
|
|
|
2020-04-19 05:52:34 +02:00
|
|
|
free(decoded);
|
|
|
|
if (has_nl)
|
|
|
|
return -1;
|
credential: treat URL without scheme as invalid
libcurl permits making requests without a URL scheme specified. In
this case, it guesses the URL from the hostname, so I can run
git ls-remote http::ftp.example.com/path/to/repo
and it would make an FTP request.
Any user intentionally using such a URL is likely to have made a typo.
Unfortunately, credential_from_url is not able to determine the host and
protocol in order to determine appropriate credentials to send, and
until "credential: refuse to operate when missing host or protocol",
this resulted in another host's credentials being leaked to the named
host.
Teach credential_from_url_gently to consider such a URL to be invalid
so that fsck can detect and block gitmodules files with such URLs,
allowing server operators to avoid serving them to downstream users
running older versions of Git.
This also means that when such URLs are passed on the command line, Git
will print a clearer error so affected users can switch to the simpler
URL that explicitly specifies the host and protocol they intend.
One subtlety: .gitmodules files can contain relative URLs, representing
a URL relative to the URL they were cloned from. The relative URL
resolver used for .gitmodules can follow ".." components out of the path
part and past the host part of a URL, meaning that such a relative URL
can be used to traverse from a https://foo.example.com/innocent
superproject to a https::attacker.example.com/exploit submodule.
Fortunately a leading ':' in the first path component after a series of
leading './' and '../' components is unlikely to show up in other
contexts, so we can catch this by detecting that pattern.
Reported-by: Jeff King <peff@peff.net>
Signed-off-by: Jonathan Nieder <jrnieder@gmail.com>
Reviewed-by: Jeff King <peff@peff.net>
2020-04-19 05:54:13 +02:00
|
|
|
|
|
|
|
/*
|
|
|
|
* URLs which escape their root via "../" can overwrite
|
|
|
|
* the host field and previous components, resolving to
|
2020-04-19 05:57:22 +02:00
|
|
|
* URLs like https::example.com/submodule.git and
|
|
|
|
* https:///example.com/submodule.git that were
|
credential: treat URL without scheme as invalid
libcurl permits making requests without a URL scheme specified. In
this case, it guesses the URL from the hostname, so I can run
git ls-remote http::ftp.example.com/path/to/repo
and it would make an FTP request.
Any user intentionally using such a URL is likely to have made a typo.
Unfortunately, credential_from_url is not able to determine the host and
protocol in order to determine appropriate credentials to send, and
until "credential: refuse to operate when missing host or protocol",
this resulted in another host's credentials being leaked to the named
host.
Teach credential_from_url_gently to consider such a URL to be invalid
so that fsck can detect and block gitmodules files with such URLs,
allowing server operators to avoid serving them to downstream users
running older versions of Git.
This also means that when such URLs are passed on the command line, Git
will print a clearer error so affected users can switch to the simpler
URL that explicitly specifies the host and protocol they intend.
One subtlety: .gitmodules files can contain relative URLs, representing
a URL relative to the URL they were cloned from. The relative URL
resolver used for .gitmodules can follow ".." components out of the path
part and past the host part of a URL, meaning that such a relative URL
can be used to traverse from a https://foo.example.com/innocent
superproject to a https::attacker.example.com/exploit submodule.
Fortunately a leading ':' in the first path component after a series of
leading './' and '../' components is unlikely to show up in other
contexts, so we can catch this by detecting that pattern.
Reported-by: Jeff King <peff@peff.net>
Signed-off-by: Jonathan Nieder <jrnieder@gmail.com>
Reviewed-by: Jeff King <peff@peff.net>
2020-04-19 05:54:13 +02:00
|
|
|
* susceptible to CVE-2020-11008.
|
|
|
|
*/
|
|
|
|
if (count_leading_dotdots(url, &next) > 0 &&
|
2020-04-19 05:57:22 +02:00
|
|
|
(*next == ':' || *next == '/'))
|
credential: treat URL without scheme as invalid
libcurl permits making requests without a URL scheme specified. In
this case, it guesses the URL from the hostname, so I can run
git ls-remote http::ftp.example.com/path/to/repo
and it would make an FTP request.
Any user intentionally using such a URL is likely to have made a typo.
Unfortunately, credential_from_url is not able to determine the host and
protocol in order to determine appropriate credentials to send, and
until "credential: refuse to operate when missing host or protocol",
this resulted in another host's credentials being leaked to the named
host.
Teach credential_from_url_gently to consider such a URL to be invalid
so that fsck can detect and block gitmodules files with such URLs,
allowing server operators to avoid serving them to downstream users
running older versions of Git.
This also means that when such URLs are passed on the command line, Git
will print a clearer error so affected users can switch to the simpler
URL that explicitly specifies the host and protocol they intend.
One subtlety: .gitmodules files can contain relative URLs, representing
a URL relative to the URL they were cloned from. The relative URL
resolver used for .gitmodules can follow ".." components out of the path
part and past the host part of a URL, meaning that such a relative URL
can be used to traverse from a https://foo.example.com/innocent
superproject to a https::attacker.example.com/exploit submodule.
Fortunately a leading ':' in the first path component after a series of
leading './' and '../' components is unlikely to show up in other
contexts, so we can catch this by detecting that pattern.
Reported-by: Jeff King <peff@peff.net>
Signed-off-by: Jonathan Nieder <jrnieder@gmail.com>
Reviewed-by: Jeff King <peff@peff.net>
2020-04-19 05:54:13 +02:00
|
|
|
return -1;
|
2020-04-19 05:52:34 +02:00
|
|
|
}
|
|
|
|
|
|
|
|
else if (url_to_curl_url(url, &curl_url)) {
|
|
|
|
struct credential c = CREDENTIAL_INIT;
|
2020-04-19 05:57:22 +02:00
|
|
|
int ret = 0;
|
|
|
|
if (credential_from_url_gently(&c, curl_url, 1) ||
|
|
|
|
!*c.host)
|
|
|
|
ret = -1;
|
2020-04-19 05:52:34 +02:00
|
|
|
credential_clear(&c);
|
|
|
|
return ret;
|
|
|
|
}
|
|
|
|
|
|
|
|
return 0;
|
2020-03-11 23:48:24 +01:00
|
|
|
}
|
|
|
|
|
2018-05-02 23:25:27 +02:00
|
|
|
struct fsck_gitmodules_data {
|
2019-10-18 06:59:29 +02:00
|
|
|
const struct object_id *oid;
|
2018-05-02 23:25:27 +02:00
|
|
|
struct fsck_options *options;
|
|
|
|
int ret;
|
|
|
|
};
|
|
|
|
|
|
|
|
static int fsck_gitmodules_fn(const char *var, const char *value, void *vdata)
|
|
|
|
{
|
|
|
|
struct fsck_gitmodules_data *data = vdata;
|
|
|
|
const char *subsection, *key;
|
2020-04-10 21:44:28 +02:00
|
|
|
size_t subsection_len;
|
2018-05-02 23:25:27 +02:00
|
|
|
char *name;
|
|
|
|
|
|
|
|
if (parse_config_key(var, "submodule", &subsection, &subsection_len, &key) < 0 ||
|
|
|
|
!subsection)
|
|
|
|
return 0;
|
|
|
|
|
|
|
|
name = xmemdupz(subsection, subsection_len);
|
|
|
|
if (check_submodule_name(name) < 0)
|
2019-10-18 06:59:15 +02:00
|
|
|
data->ret |= report(data->options,
|
2019-10-18 06:59:29 +02:00
|
|
|
data->oid, OBJ_BLOB,
|
2018-05-02 23:25:27 +02:00
|
|
|
FSCK_MSG_GITMODULES_NAME,
|
|
|
|
"disallowed submodule name: %s",
|
|
|
|
name);
|
2018-09-24 10:37:17 +02:00
|
|
|
if (!strcmp(key, "url") && value &&
|
2020-03-11 23:48:24 +01:00
|
|
|
check_submodule_url(value) < 0)
|
2019-10-18 06:59:15 +02:00
|
|
|
data->ret |= report(data->options,
|
2019-10-18 06:59:29 +02:00
|
|
|
data->oid, OBJ_BLOB,
|
2018-09-24 10:37:17 +02:00
|
|
|
FSCK_MSG_GITMODULES_URL,
|
|
|
|
"disallowed submodule url: %s",
|
|
|
|
value);
|
fsck: detect submodule paths starting with dash
As with urls, submodule paths with dashes are ignored by
git, but may end up confusing older versions. Detecting them
via fsck lets us prevent modern versions of git from being a
vector to spread broken .gitmodules to older versions.
Compared to blocking leading-dash urls, though, this
detection may be less of a good idea:
1. While such paths provide confusing and broken results,
they don't seem to actually work as option injections
against anything except "cd". In particular, the
submodule code seems to canonicalize to an absolute
path before running "git clone" (so it passes
/your/clone/-sub).
2. It's more likely that we may one day make such names
actually work correctly. Even after we revert this fsck
check, it will continue to be a hassle until hosting
servers are all updated.
On the other hand, it's not entirely clear that the behavior
in older versions is safe. And if we do want to eventually
allow this, we may end up doing so with a special syntax
anyway (e.g., writing "./-sub" in the .gitmodules file, and
teaching the submodule code to canonicalize it when
comparing).
So on balance, this is probably a good protection.
Signed-off-by: Jeff King <peff@peff.net>
Signed-off-by: Junio C Hamano <gitster@pobox.com>
2018-09-24 10:42:19 +02:00
|
|
|
if (!strcmp(key, "path") && value &&
|
|
|
|
looks_like_command_line_option(value))
|
2019-10-18 06:59:15 +02:00
|
|
|
data->ret |= report(data->options,
|
2019-10-18 06:59:29 +02:00
|
|
|
data->oid, OBJ_BLOB,
|
fsck: detect submodule paths starting with dash
As with urls, submodule paths with dashes are ignored by
git, but may end up confusing older versions. Detecting them
via fsck lets us prevent modern versions of git from being a
vector to spread broken .gitmodules to older versions.
Compared to blocking leading-dash urls, though, this
detection may be less of a good idea:
1. While such paths provide confusing and broken results,
they don't seem to actually work as option injections
against anything except "cd". In particular, the
submodule code seems to canonicalize to an absolute
path before running "git clone" (so it passes
/your/clone/-sub).
2. It's more likely that we may one day make such names
actually work correctly. Even after we revert this fsck
check, it will continue to be a hassle until hosting
servers are all updated.
On the other hand, it's not entirely clear that the behavior
in older versions is safe. And if we do want to eventually
allow this, we may end up doing so with a special syntax
anyway (e.g., writing "./-sub" in the .gitmodules file, and
teaching the submodule code to canonicalize it when
comparing).
So on balance, this is probably a good protection.
Signed-off-by: Jeff King <peff@peff.net>
Signed-off-by: Junio C Hamano <gitster@pobox.com>
2018-09-24 10:42:19 +02:00
|
|
|
FSCK_MSG_GITMODULES_PATH,
|
|
|
|
"disallowed submodule path: %s",
|
|
|
|
value);
|
2019-12-05 10:30:43 +01:00
|
|
|
if (!strcmp(key, "update") && value &&
|
|
|
|
parse_submodule_update_type(value) == SM_UPDATE_COMMAND)
|
2019-12-10 07:17:55 +01:00
|
|
|
data->ret |= report(data->options, data->oid, OBJ_BLOB,
|
2019-12-05 10:30:43 +01:00
|
|
|
FSCK_MSG_GITMODULES_UPDATE,
|
|
|
|
"disallowed submodule update setting: %s",
|
|
|
|
value);
|
2018-05-02 23:25:27 +02:00
|
|
|
free(name);
|
|
|
|
|
|
|
|
return 0;
|
|
|
|
}
|
|
|
|
|
2019-10-18 06:59:29 +02:00
|
|
|
static int fsck_blob(const struct object_id *oid, const char *buf,
|
fsck: actually fsck blob data
Because fscking a blob has always been a noop, we didn't
bother passing around the blob data. In preparation for
content-level checks, let's fix up a few things:
1. The fsck_object() function just returns success for any
blob. Let's a noop fsck_blob(), which we can fill in
with actual logic later.
2. The fsck_loose() function in builtin/fsck.c
just threw away blob content after loading it. Let's
hold onto it until after we've called fsck_object().
The easiest way to do this is to just drop the
parse_loose_object() helper entirely. Incidentally,
this also fixes a memory leak: if we successfully
loaded the object data but did not parse it, we would
have left the function without freeing it.
3. When fsck_loose() loads the object data, it
does so with a custom read_loose_object() helper. This
function streams any blobs, regardless of size, under
the assumption that we're only checking the sha1.
Instead, let's actually load blobs smaller than
big_file_threshold, as the normal object-reading
code-paths would do. This lets us fsck small files, and
a NULL return is an indication that the blob was so big
that it needed to be streamed, and we can pass that
information along to fsck_blob().
Signed-off-by: Jeff King <peff@peff.net>
2018-05-02 21:44:51 +02:00
|
|
|
unsigned long size, struct fsck_options *options)
|
|
|
|
{
|
2018-05-02 23:25:27 +02:00
|
|
|
struct fsck_gitmodules_data data;
|
2018-06-29 00:06:04 +02:00
|
|
|
struct config_options config_opts = { 0 };
|
2018-05-02 23:25:27 +02:00
|
|
|
|
2019-10-18 06:59:29 +02:00
|
|
|
if (!oidset_contains(&gitmodules_found, oid))
|
2018-05-02 23:25:27 +02:00
|
|
|
return 0;
|
2019-10-18 06:59:29 +02:00
|
|
|
oidset_insert(&gitmodules_done, oid);
|
2018-05-02 23:25:27 +02:00
|
|
|
|
2019-10-18 06:59:29 +02:00
|
|
|
if (object_on_skiplist(options, oid))
|
fsck: check skiplist for object in fsck_blob()
Since commit ed8b10f631 ("fsck: check .gitmodules content", 2018-05-02),
fsck will issue an error message for '.gitmodules' content that cannot
be parsed correctly. This is the case, even when the corresponding blob
object has been included on the skiplist. For example, using the cgit
repository, we see the following:
$ git fsck
Checking object directories: 100% (256/256), done.
error: bad config line 5 in blob .gitmodules
error in blob 51dd1eff1edc663674df9ab85d2786a40f7ae3a5: gitmodulesParse: could not parse gitmodules blob
Checking objects: 100% (6626/6626), done.
$
$ git config fsck.skiplist '.git/skip'
$ echo 51dd1eff1edc663674df9ab85d2786a40f7ae3a5 >.git/skip
$
$ git fsck
Checking object directories: 100% (256/256), done.
error: bad config line 5 in blob .gitmodules
Checking objects: 100% (6626/6626), done.
$
Note that the error message issued by the config parser is still
present, despite adding the object-id of the blob to the skiplist.
One solution would be to provide a means of suppressing the messages
issued by the config parser. However, given that (logically) we are
asking fsck to ignore this object, a simpler approach is to just not
call the config parser if the object is to be skipped. Add a check to
the 'fsck_blob()' processing function, to determine if the object is
on the skiplist and, if so, exit the function early.
Signed-off-by: Ramsay Jones <ramsay@ramsayjones.plus.com>
Signed-off-by: Junio C Hamano <gitster@pobox.com>
2018-06-27 20:39:53 +02:00
|
|
|
return 0;
|
|
|
|
|
2018-05-02 23:25:27 +02:00
|
|
|
if (!buf) {
|
|
|
|
/*
|
|
|
|
* A missing buffer here is a sign that the caller found the
|
|
|
|
* blob too gigantic to load into memory. Let's just consider
|
|
|
|
* that an error.
|
|
|
|
*/
|
2019-10-18 06:59:29 +02:00
|
|
|
return report(options, oid, OBJ_BLOB,
|
2018-07-13 21:39:53 +02:00
|
|
|
FSCK_MSG_GITMODULES_LARGE,
|
2018-05-02 23:25:27 +02:00
|
|
|
".gitmodules too large to parse");
|
|
|
|
}
|
|
|
|
|
2019-10-18 06:59:29 +02:00
|
|
|
data.oid = oid;
|
2018-05-02 23:25:27 +02:00
|
|
|
data.options = options;
|
|
|
|
data.ret = 0;
|
2018-06-29 00:06:04 +02:00
|
|
|
config_opts.error_action = CONFIG_ERROR_SILENT;
|
2018-05-02 23:25:27 +02:00
|
|
|
if (git_config_from_mem(fsck_gitmodules_fn, CONFIG_ORIGIN_BLOB,
|
2018-06-29 00:06:04 +02:00
|
|
|
".gitmodules", buf, size, &data, &config_opts))
|
2019-10-18 06:59:29 +02:00
|
|
|
data.ret |= report(options, oid, OBJ_BLOB,
|
2018-05-02 23:25:27 +02:00
|
|
|
FSCK_MSG_GITMODULES_PARSE,
|
|
|
|
"could not parse gitmodules blob");
|
|
|
|
|
|
|
|
return data.ret;
|
fsck: actually fsck blob data
Because fscking a blob has always been a noop, we didn't
bother passing around the blob data. In preparation for
content-level checks, let's fix up a few things:
1. The fsck_object() function just returns success for any
blob. Let's a noop fsck_blob(), which we can fill in
with actual logic later.
2. The fsck_loose() function in builtin/fsck.c
just threw away blob content after loading it. Let's
hold onto it until after we've called fsck_object().
The easiest way to do this is to just drop the
parse_loose_object() helper entirely. Incidentally,
this also fixes a memory leak: if we successfully
loaded the object data but did not parse it, we would
have left the function without freeing it.
3. When fsck_loose() loads the object data, it
does so with a custom read_loose_object() helper. This
function streams any blobs, regardless of size, under
the assumption that we're only checking the sha1.
Instead, let's actually load blobs smaller than
big_file_threshold, as the normal object-reading
code-paths would do. This lets us fsck small files, and
a NULL return is an indication that the blob was so big
that it needed to be streamed, and we can pass that
information along to fsck_blob().
Signed-off-by: Jeff King <peff@peff.net>
2018-05-02 21:44:51 +02:00
|
|
|
}
|
|
|
|
|
2014-09-10 15:52:51 +02:00
|
|
|
int fsck_object(struct object *obj, void *data, unsigned long size,
|
2015-06-22 17:25:00 +02:00
|
|
|
struct fsck_options *options)
|
2008-02-25 22:46:08 +01:00
|
|
|
{
|
|
|
|
if (!obj)
|
2019-10-18 06:59:15 +02:00
|
|
|
return report(options, NULL, OBJ_NONE, FSCK_MSG_BAD_OBJECT_SHA1, "no valid object to fsck");
|
2008-02-25 22:46:08 +01:00
|
|
|
|
|
|
|
if (obj->type == OBJ_BLOB)
|
2019-10-18 06:59:29 +02:00
|
|
|
return fsck_blob(&obj->oid, data, size, options);
|
2008-02-25 22:46:08 +01:00
|
|
|
if (obj->type == OBJ_TREE)
|
2019-10-18 07:02:08 +02:00
|
|
|
return fsck_tree(&obj->oid, data, size, options);
|
2008-02-25 22:46:08 +01:00
|
|
|
if (obj->type == OBJ_COMMIT)
|
2019-10-18 07:01:48 +02:00
|
|
|
return fsck_commit(&obj->oid, data, size, options);
|
2008-02-25 22:46:08 +01:00
|
|
|
if (obj->type == OBJ_TAG)
|
2019-10-18 07:01:26 +02:00
|
|
|
return fsck_tag(&obj->oid, data, size, options);
|
2008-02-25 22:46:08 +01:00
|
|
|
|
2019-10-18 06:59:15 +02:00
|
|
|
return report(options, &obj->oid, obj->type,
|
|
|
|
FSCK_MSG_UNKNOWN_TYPE,
|
|
|
|
"unknown type '%d' (internal fsck error)",
|
|
|
|
obj->type);
|
2008-02-25 22:46:08 +01:00
|
|
|
}
|
2008-02-25 22:46:09 +01:00
|
|
|
|
2016-07-17 12:59:57 +02:00
|
|
|
int fsck_error_function(struct fsck_options *o,
|
2019-10-18 06:58:40 +02:00
|
|
|
const struct object_id *oid,
|
|
|
|
enum object_type object_type,
|
|
|
|
int msg_type, const char *message)
|
2008-02-25 22:46:09 +01:00
|
|
|
{
|
2015-06-22 17:25:25 +02:00
|
|
|
if (msg_type == FSCK_WARN) {
|
2019-10-18 06:58:40 +02:00
|
|
|
warning("object %s: %s", fsck_describe_object(o, oid), message);
|
2015-06-22 17:25:25 +02:00
|
|
|
return 0;
|
|
|
|
}
|
2019-10-18 06:58:40 +02:00
|
|
|
error("object %s: %s", fsck_describe_object(o, oid), message);
|
2008-02-25 22:46:09 +01:00
|
|
|
return 1;
|
|
|
|
}
|
fsck: detect gitmodules files
In preparation for performing fsck checks on .gitmodules
files, this commit plumbs in the actual detection of the
files. Note that unlike most other fsck checks, this cannot
be a property of a single object: we must know that the
object is found at a ".gitmodules" path at the root tree of
a commit.
Since the fsck code only sees one object at a time, we have
to mark the related objects to fit the puzzle together. When
we see a commit we mark its tree as a root tree, and when
we see a root tree with a .gitmodules file, we mark the
corresponding blob to be checked.
In an ideal world, we'd check the objects in topological
order: commits followed by trees followed by blobs. In that
case we can avoid ever loading an object twice, since all
markings would be complete by the time we get to the marked
objects. And indeed, if we are checking a single packfile,
this is the order in which Git will generally write the
objects. But we can't count on that:
1. git-fsck may show us the objects in arbitrary order
(loose objects are fed in sha1 order, but we may also
have multiple packs, and we process each pack fully in
sequence).
2. The type ordering is just what git-pack-objects happens
to write now. The pack format does not require a
specific order, and it's possible that future versions
of Git (or a custom version trying to fool official
Git's fsck checks!) may order it differently.
3. We may not even be fscking all of the relevant objects
at once. Consider pushing with transfer.fsckObjects,
where one push adds a blob at path "foo", and then a
second push adds the same blob at path ".gitmodules".
The blob is not part of the second push at all, but we
need to mark and check it.
So in the general case, we need to make up to three passes
over the objects: once to make sure we've seen all commits,
then once to cover any trees we might have missed, and then
a final pass to cover any .gitmodules blobs we found in the
second pass.
We can simplify things a bit by loosening the requirement
that we find .gitmodules only at root trees. Technically
a file like "subdir/.gitmodules" is not parsed by Git, but
it's not unreasonable for us to declare that Git is aware of
all ".gitmodules" files and make them eligible for checking.
That lets us drop the root-tree requirement, which
eliminates one pass entirely. And it makes our worst case
much better: instead of potentially queueing every root tree
to be re-examined, the worst case is that we queue each
unique .gitmodules blob for a second look.
This patch just adds the boilerplate to find .gitmodules
files. The actual content checks will come in a subsequent
commit.
Signed-off-by: Jeff King <peff@peff.net>
2018-05-02 23:20:08 +02:00
|
|
|
|
|
|
|
int fsck_finish(struct fsck_options *options)
|
|
|
|
{
|
|
|
|
int ret = 0;
|
|
|
|
struct oidset_iter iter;
|
|
|
|
const struct object_id *oid;
|
|
|
|
|
|
|
|
oidset_iter_init(&gitmodules_found, &iter);
|
|
|
|
while ((oid = oidset_iter_next(&iter))) {
|
|
|
|
enum object_type type;
|
|
|
|
unsigned long size;
|
|
|
|
char *buf;
|
|
|
|
|
|
|
|
if (oidset_contains(&gitmodules_done, oid))
|
|
|
|
continue;
|
|
|
|
|
2018-05-29 10:09:58 +02:00
|
|
|
buf = read_object_file(oid, &type, &size);
|
fsck: detect gitmodules files
In preparation for performing fsck checks on .gitmodules
files, this commit plumbs in the actual detection of the
files. Note that unlike most other fsck checks, this cannot
be a property of a single object: we must know that the
object is found at a ".gitmodules" path at the root tree of
a commit.
Since the fsck code only sees one object at a time, we have
to mark the related objects to fit the puzzle together. When
we see a commit we mark its tree as a root tree, and when
we see a root tree with a .gitmodules file, we mark the
corresponding blob to be checked.
In an ideal world, we'd check the objects in topological
order: commits followed by trees followed by blobs. In that
case we can avoid ever loading an object twice, since all
markings would be complete by the time we get to the marked
objects. And indeed, if we are checking a single packfile,
this is the order in which Git will generally write the
objects. But we can't count on that:
1. git-fsck may show us the objects in arbitrary order
(loose objects are fed in sha1 order, but we may also
have multiple packs, and we process each pack fully in
sequence).
2. The type ordering is just what git-pack-objects happens
to write now. The pack format does not require a
specific order, and it's possible that future versions
of Git (or a custom version trying to fool official
Git's fsck checks!) may order it differently.
3. We may not even be fscking all of the relevant objects
at once. Consider pushing with transfer.fsckObjects,
where one push adds a blob at path "foo", and then a
second push adds the same blob at path ".gitmodules".
The blob is not part of the second push at all, but we
need to mark and check it.
So in the general case, we need to make up to three passes
over the objects: once to make sure we've seen all commits,
then once to cover any trees we might have missed, and then
a final pass to cover any .gitmodules blobs we found in the
second pass.
We can simplify things a bit by loosening the requirement
that we find .gitmodules only at root trees. Technically
a file like "subdir/.gitmodules" is not parsed by Git, but
it's not unreasonable for us to declare that Git is aware of
all ".gitmodules" files and make them eligible for checking.
That lets us drop the root-tree requirement, which
eliminates one pass entirely. And it makes our worst case
much better: instead of potentially queueing every root tree
to be re-examined, the worst case is that we queue each
unique .gitmodules blob for a second look.
This patch just adds the boilerplate to find .gitmodules
files. The actual content checks will come in a subsequent
commit.
Signed-off-by: Jeff King <peff@peff.net>
2018-05-02 23:20:08 +02:00
|
|
|
if (!buf) {
|
2019-10-18 06:59:54 +02:00
|
|
|
if (is_promisor_object(oid))
|
2018-05-14 18:22:48 +02:00
|
|
|
continue;
|
2019-10-18 06:59:15 +02:00
|
|
|
ret |= report(options,
|
2019-10-18 06:59:54 +02:00
|
|
|
oid, OBJ_BLOB,
|
fsck: detect gitmodules files
In preparation for performing fsck checks on .gitmodules
files, this commit plumbs in the actual detection of the
files. Note that unlike most other fsck checks, this cannot
be a property of a single object: we must know that the
object is found at a ".gitmodules" path at the root tree of
a commit.
Since the fsck code only sees one object at a time, we have
to mark the related objects to fit the puzzle together. When
we see a commit we mark its tree as a root tree, and when
we see a root tree with a .gitmodules file, we mark the
corresponding blob to be checked.
In an ideal world, we'd check the objects in topological
order: commits followed by trees followed by blobs. In that
case we can avoid ever loading an object twice, since all
markings would be complete by the time we get to the marked
objects. And indeed, if we are checking a single packfile,
this is the order in which Git will generally write the
objects. But we can't count on that:
1. git-fsck may show us the objects in arbitrary order
(loose objects are fed in sha1 order, but we may also
have multiple packs, and we process each pack fully in
sequence).
2. The type ordering is just what git-pack-objects happens
to write now. The pack format does not require a
specific order, and it's possible that future versions
of Git (or a custom version trying to fool official
Git's fsck checks!) may order it differently.
3. We may not even be fscking all of the relevant objects
at once. Consider pushing with transfer.fsckObjects,
where one push adds a blob at path "foo", and then a
second push adds the same blob at path ".gitmodules".
The blob is not part of the second push at all, but we
need to mark and check it.
So in the general case, we need to make up to three passes
over the objects: once to make sure we've seen all commits,
then once to cover any trees we might have missed, and then
a final pass to cover any .gitmodules blobs we found in the
second pass.
We can simplify things a bit by loosening the requirement
that we find .gitmodules only at root trees. Technically
a file like "subdir/.gitmodules" is not parsed by Git, but
it's not unreasonable for us to declare that Git is aware of
all ".gitmodules" files and make them eligible for checking.
That lets us drop the root-tree requirement, which
eliminates one pass entirely. And it makes our worst case
much better: instead of potentially queueing every root tree
to be re-examined, the worst case is that we queue each
unique .gitmodules blob for a second look.
This patch just adds the boilerplate to find .gitmodules
files. The actual content checks will come in a subsequent
commit.
Signed-off-by: Jeff King <peff@peff.net>
2018-05-02 23:20:08 +02:00
|
|
|
FSCK_MSG_GITMODULES_MISSING,
|
|
|
|
"unable to read .gitmodules blob");
|
|
|
|
continue;
|
|
|
|
}
|
|
|
|
|
|
|
|
if (type == OBJ_BLOB)
|
2019-10-18 06:59:54 +02:00
|
|
|
ret |= fsck_blob(oid, buf, size, options);
|
fsck: detect gitmodules files
In preparation for performing fsck checks on .gitmodules
files, this commit plumbs in the actual detection of the
files. Note that unlike most other fsck checks, this cannot
be a property of a single object: we must know that the
object is found at a ".gitmodules" path at the root tree of
a commit.
Since the fsck code only sees one object at a time, we have
to mark the related objects to fit the puzzle together. When
we see a commit we mark its tree as a root tree, and when
we see a root tree with a .gitmodules file, we mark the
corresponding blob to be checked.
In an ideal world, we'd check the objects in topological
order: commits followed by trees followed by blobs. In that
case we can avoid ever loading an object twice, since all
markings would be complete by the time we get to the marked
objects. And indeed, if we are checking a single packfile,
this is the order in which Git will generally write the
objects. But we can't count on that:
1. git-fsck may show us the objects in arbitrary order
(loose objects are fed in sha1 order, but we may also
have multiple packs, and we process each pack fully in
sequence).
2. The type ordering is just what git-pack-objects happens
to write now. The pack format does not require a
specific order, and it's possible that future versions
of Git (or a custom version trying to fool official
Git's fsck checks!) may order it differently.
3. We may not even be fscking all of the relevant objects
at once. Consider pushing with transfer.fsckObjects,
where one push adds a blob at path "foo", and then a
second push adds the same blob at path ".gitmodules".
The blob is not part of the second push at all, but we
need to mark and check it.
So in the general case, we need to make up to three passes
over the objects: once to make sure we've seen all commits,
then once to cover any trees we might have missed, and then
a final pass to cover any .gitmodules blobs we found in the
second pass.
We can simplify things a bit by loosening the requirement
that we find .gitmodules only at root trees. Technically
a file like "subdir/.gitmodules" is not parsed by Git, but
it's not unreasonable for us to declare that Git is aware of
all ".gitmodules" files and make them eligible for checking.
That lets us drop the root-tree requirement, which
eliminates one pass entirely. And it makes our worst case
much better: instead of potentially queueing every root tree
to be re-examined, the worst case is that we queue each
unique .gitmodules blob for a second look.
This patch just adds the boilerplate to find .gitmodules
files. The actual content checks will come in a subsequent
commit.
Signed-off-by: Jeff King <peff@peff.net>
2018-05-02 23:20:08 +02:00
|
|
|
else
|
2019-10-18 06:59:15 +02:00
|
|
|
ret |= report(options,
|
2019-10-18 06:59:54 +02:00
|
|
|
oid, type,
|
fsck: detect gitmodules files
In preparation for performing fsck checks on .gitmodules
files, this commit plumbs in the actual detection of the
files. Note that unlike most other fsck checks, this cannot
be a property of a single object: we must know that the
object is found at a ".gitmodules" path at the root tree of
a commit.
Since the fsck code only sees one object at a time, we have
to mark the related objects to fit the puzzle together. When
we see a commit we mark its tree as a root tree, and when
we see a root tree with a .gitmodules file, we mark the
corresponding blob to be checked.
In an ideal world, we'd check the objects in topological
order: commits followed by trees followed by blobs. In that
case we can avoid ever loading an object twice, since all
markings would be complete by the time we get to the marked
objects. And indeed, if we are checking a single packfile,
this is the order in which Git will generally write the
objects. But we can't count on that:
1. git-fsck may show us the objects in arbitrary order
(loose objects are fed in sha1 order, but we may also
have multiple packs, and we process each pack fully in
sequence).
2. The type ordering is just what git-pack-objects happens
to write now. The pack format does not require a
specific order, and it's possible that future versions
of Git (or a custom version trying to fool official
Git's fsck checks!) may order it differently.
3. We may not even be fscking all of the relevant objects
at once. Consider pushing with transfer.fsckObjects,
where one push adds a blob at path "foo", and then a
second push adds the same blob at path ".gitmodules".
The blob is not part of the second push at all, but we
need to mark and check it.
So in the general case, we need to make up to three passes
over the objects: once to make sure we've seen all commits,
then once to cover any trees we might have missed, and then
a final pass to cover any .gitmodules blobs we found in the
second pass.
We can simplify things a bit by loosening the requirement
that we find .gitmodules only at root trees. Technically
a file like "subdir/.gitmodules" is not parsed by Git, but
it's not unreasonable for us to declare that Git is aware of
all ".gitmodules" files and make them eligible for checking.
That lets us drop the root-tree requirement, which
eliminates one pass entirely. And it makes our worst case
much better: instead of potentially queueing every root tree
to be re-examined, the worst case is that we queue each
unique .gitmodules blob for a second look.
This patch just adds the boilerplate to find .gitmodules
files. The actual content checks will come in a subsequent
commit.
Signed-off-by: Jeff King <peff@peff.net>
2018-05-02 23:20:08 +02:00
|
|
|
FSCK_MSG_GITMODULES_BLOB,
|
|
|
|
"non-blob found at .gitmodules");
|
|
|
|
free(buf);
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
|
|
oidset_clear(&gitmodules_found);
|
|
|
|
oidset_clear(&gitmodules_done);
|
|
|
|
return ret;
|
|
|
|
}
|
2021-01-05 20:42:47 +01:00
|
|
|
|
|
|
|
int fsck_config_internal(const char *var, const char *value, void *cb,
|
|
|
|
struct fsck_options *options)
|
|
|
|
{
|
|
|
|
if (strcmp(var, "fsck.skiplist") == 0) {
|
|
|
|
const char *path;
|
|
|
|
struct strbuf sb = STRBUF_INIT;
|
|
|
|
|
|
|
|
if (git_config_pathname(&path, var, value))
|
|
|
|
return 1;
|
|
|
|
strbuf_addf(&sb, "skiplist=%s", path);
|
|
|
|
free((char *)path);
|
|
|
|
fsck_set_msg_types(options, sb.buf);
|
|
|
|
strbuf_release(&sb);
|
|
|
|
return 0;
|
|
|
|
}
|
|
|
|
|
|
|
|
if (skip_prefix(var, "fsck.", &var)) {
|
|
|
|
fsck_set_msg_type(options, var, value);
|
|
|
|
return 0;
|
|
|
|
}
|
|
|
|
|
|
|
|
return git_default_config(var, value, cb);
|
|
|
|
}
|