Git 2.9.5

-----BEGIN PGP SIGNATURE-----
 Version: GnuPG v1
 
 iQIcBAABCAAGBQJZflVaAAoJELC16IaWr+bL/5QP/1NoUGqrwB+zwJ8+oDqd+Djl
 PX8qyafoMXJr/w/fACk8r/tCSGKgK8Gx9FqZ9GIBCAZVNXkQnheRElOjiuRg4rbl
 +USiN2XM4ue/X7GqEBc7YVAmd+ifFFQ+ckm1g72A53B4Qh4/Ca4MnPYLOi7eKfC1
 85f+/zMj/5pYsmboFZzFiUPq+Khyb2e85Mm9ok+l/8zAXt4ER5cf4mhY3KSEtnfA
 6qGVUJ3fS9FzE4ud+/cx2qidsTrzZI/Hpv+3TVVXzSv5j32D3srnumLs+XnVIarV
 nJFoVUZV/XSC80YUkwbcdY6Rs2gVfhHJK6zVcs8MfHC28o+ZJDM+ceGVnUKcdpDW
 Gejsc7l0Blt0IodLoHAemBOsF3eeQBh5M5vodHdEFTiCdGRcCX3lvPxikCILW1Fv
 4FPmrjfOlWEz0ktV4eKacX+DVAa2p9P09v0B6pKFt/l5MiHKla8qdYXLjEnEHHaN
 ywIJPK0Lbgr+rjf3XcEQ96sjP+2XOcmtwTxychEcQ7Z2IwqyJA/GtdyCh1/jinap
 0M9odRHtYHRk1qUcZBLosM3C3Y0rgc2k1RZJRgdAY1kiBezctoU6FkH5Pb7LFRtH
 hr3/llk9X1ivh6fruLZ6Lu2EZ/vJVOwtUNLFqPO8fLP4cABkhDdxX13o5PS+qYMJ
 THXReDUV4vgtmzKrgJ+7
 =w1+M
 -----END PGP SIGNATURE-----

Merge tag 'v2.9.5' into maint-2.10

Git 2.9.5
This commit is contained in:
Junio C Hamano 2017-07-30 14:57:33 -07:00
commit d78f06a1b7
9 changed files with 108 additions and 0 deletions

View File

@ -0,0 +1,25 @@
Git v2.7.6 Release Notes
========================
Fixes since v2.7.5
------------------
* A "ssh://..." URL can result in a "ssh" command line with a
hostname that begins with a dash "-", which would cause the "ssh"
command to instead (mis)treat it as an option. This is now
prevented by forbidding such a hostname (which will not be
necessary in the real world).
* Similarly, when GIT_PROXY_COMMAND is configured, the command is
run with host and port that are parsed out from "ssh://..." URL;
a poorly written GIT_PROXY_COMMAND could be tricked into treating
a string that begins with a dash "-". This is now prevented by
forbidding such a hostname and port number (again, which will not
be necessary in the real world).
* In the same spirit, a repository name that begins with a dash "-"
is also forbidden now.
Credits go to Brian Neel at GitLab, Joern Schneeweisz of Recurity
Labs and Jeff King at GitHub.

View File

@ -0,0 +1,4 @@
Git v2.8.6 Release Notes
========================
This release forward-ports the fix for "ssh://..." URL from Git v2.7.6

View File

@ -0,0 +1,4 @@
Git v2.9.5 Release Notes
========================
This release forward-ports the fix for "ssh://..." URL from Git v2.7.6

View File

@ -1042,6 +1042,14 @@ char *strip_path_suffix(const char *path, const char *suffix);
int daemon_avoid_alias(const char *path);
extern int is_ntfs_dotgit(const char *name);
/*
* Returns true iff "str" could be confused as a command-line option when
* passed to a sub-program like "ssh". Note that this has nothing to do with
* shell-quoting, which should be handled separately; we're assuming here that
* the string makes it verbatim to the sub-program.
*/
int looks_like_command_line_option(const char *str);
/**
* Return a newly allocated string with the evaluation of
* "$XDG_CONFIG_HOME/git/$filename" if $XDG_CONFIG_HOME is non-empty, otherwise

View File

@ -557,6 +557,11 @@ static struct child_process *git_proxy_connect(int fd[2], char *host)
get_host_and_port(&host, &port);
if (looks_like_command_line_option(host))
die("strange hostname '%s' blocked", host);
if (looks_like_command_line_option(port))
die("strange port '%s' blocked", port);
proxy = xmalloc(sizeof(*proxy));
child_process_init(proxy);
argv_array_push(&proxy->args, git_proxy_command);
@ -739,6 +744,9 @@ struct child_process *git_connect(int fd[2], const char *url,
conn = xmalloc(sizeof(*conn));
child_process_init(conn);
if (looks_like_command_line_option(path))
die("strange pathname '%s' blocked", path);
strbuf_addstr(&cmd, prog);
strbuf_addch(&cmd, ' ');
sq_quote_buf(&cmd, path);
@ -771,6 +779,9 @@ struct child_process *git_connect(int fd[2], const char *url,
return NULL;
}
if (looks_like_command_line_option(ssh_host))
die("strange hostname '%s' blocked", ssh_host);
ssh = get_ssh_command();
if (!ssh) {
const char *base;

5
path.c
View File

@ -1225,6 +1225,11 @@ int is_ntfs_dotgit(const char *name)
}
}
int looks_like_command_line_option(const char *str)
{
return str && str[0] == '-';
}
char *xdg_config_home(const char *filename)
{
const char *home, *config_home;

View File

@ -43,4 +43,9 @@ test_expect_success 'fetch through proxy works' '
test_cmp expect actual
'
test_expect_success 'funny hostnames are rejected before running proxy' '
test_must_fail git fetch git://-remote/repo.git 2>stderr &&
! grep "proxying for" stderr
'
test_done

View File

@ -11,4 +11,27 @@ test_expect_success 'setup repository to clone' '
test_proto "file://" file "file://$PWD"
test_proto "path" file .
test_expect_success 'setup repo with dash' '
git init --bare repo.git &&
git push repo.git HEAD &&
mv repo.git "$PWD/-repo.git"
'
# This will fail even without our rejection because upload-pack will
# complain about the bogus option. So let's make sure that GIT_TRACE
# doesn't show us even running upload-pack.
#
# We must also be sure to use "fetch" and not "clone" here, as the latter
# actually canonicalizes our input into an absolute path (which is fine
# to allow).
test_expect_success 'repo names starting with dash are rejected' '
rm -f trace.out &&
test_must_fail env GIT_TRACE="$PWD/trace.out" git fetch -- -repo.git &&
! grep upload-pack trace.out
'
test_expect_success 'full paths still work' '
git fetch "$PWD/-repo.git"
'
test_done

View File

@ -17,4 +17,27 @@ test_proto "host:path" ssh "remote:repo.git"
test_proto "ssh://" ssh "ssh://remote$PWD/remote/repo.git"
test_proto "git+ssh://" ssh "git+ssh://remote$PWD/remote/repo.git"
# Don't even bother setting up a "-remote" directory, as ssh would generally
# complain about the bogus option rather than completing our request. Our
# fake wrapper actually _can_ handle this case, but it's more robust to
# simply confirm from its output that it did not run at all.
test_expect_success 'hostnames starting with dash are rejected' '
test_must_fail git clone ssh://-remote/repo.git dash-host 2>stderr &&
! grep ^ssh: stderr
'
test_expect_success 'setup repo with dash' '
git init --bare remote/-repo.git &&
git push remote/-repo.git HEAD
'
test_expect_success 'repo names starting with dash are rejected' '
test_must_fail git clone remote:-repo.git dash-path 2>stderr &&
! grep ^ssh: stderr
'
test_expect_success 'full paths still work' '
git clone "remote:$PWD/remote/-repo.git" dash-path
'
test_done