Commit Graph

47331 Commits

Author SHA1 Message Date
Junio C Hamano
1df0306d9b Sync with 2.12.5
Signed-off-by: Junio C Hamano <gitster@pobox.com>
2017-09-22 14:48:08 +09:00
Junio C Hamano
9752ad0bb7 Git 2.12.5
Signed-off-by: Junio C Hamano <gitster@pobox.com>
2017-09-22 14:47:41 +09:00
Junio C Hamano
65c9d4bd7b Sync with 2.11.4
Signed-off-by: Junio C Hamano <gitster@pobox.com>
2017-09-22 14:45:30 +09:00
Junio C Hamano
39aaab1099 Git 2.11.4
Signed-off-by: Junio C Hamano <gitster@pobox.com>
2017-09-22 14:44:45 +09:00
Junio C Hamano
0a4986d951 Sync with 2.10.5
Signed-off-by: Junio C Hamano <gitster@pobox.com>
2017-09-22 14:43:17 +09:00
Junio C Hamano
27dea4683b Git 2.10.5
Signed-off-by: Junio C Hamano <gitster@pobox.com>
2017-09-22 14:42:22 +09:00
Junio C Hamano
dca89d4e56 Merge branch 'jk/safe-pipe-capture' into maint-2.10 2017-09-22 14:34:34 +09:00
Junio C Hamano
6d6e2f812d Merge branch 'jk/cvsimport-quoting' into maint-2.10 2017-09-22 14:34:34 +09:00
Junio C Hamano
31add46823 Merge branch 'jc/cvsserver' into maint-2.10 2017-09-22 14:34:34 +09:00
Junio C Hamano
985f59c042 Merge branch 'jk/git-shell-drop-cvsserver' into maint-2.10 2017-09-22 14:34:34 +09:00
Jeff King
5b4efea666 cvsimport: shell-quote variable used in backticks
We run `git rev-parse` though the shell, and quote its
argument only with single-quotes. This prevents most
metacharacters from being a problem, but misses the obvious
case when $name itself has single-quotes in it. We can fix
this by applying the usual shell-quoting formula.

Signed-off-by: Jeff King <peff@peff.net>
Signed-off-by: Junio C Hamano <gitster@pobox.com>
2017-09-12 11:10:22 +09:00
Jeff King
8d0fad0a7a archimport: use safe_pipe_capture for user input
Refnames can contain shell metacharacters which need to be
passed verbatim to sub-processes. Using safe_pipe_capture
skips the shell entirely.

Signed-off-by: Jeff King <peff@peff.net>
Signed-off-by: Junio C Hamano <gitster@pobox.com>
2017-09-12 11:08:15 +09:00
Jeff King
9a42c03cb7 shell: drop git-cvsserver support by default
The git-cvsserver script is old and largely unmaintained
these days. But git-shell allows untrusted users to run it
out of the box, significantly increasing its attack surface.

Let's drop it from git-shell's list of internal handlers so
that it cannot be run by default.  This is not backwards
compatible. But given the age and development activity on
CVS-related parts of Git, this is likely to impact very few
users, while helping many more (i.e., anybody who runs
git-shell and had no intention of supporting CVS).

There's no configuration mechanism in git-shell for us to
add a boolean and flip it to "off". But there is a mechanism
for adding custom commands, and adding CVS support here is
fairly trivial. Let's document it to give guidance to
anybody who really is still running cvsserver.

Signed-off-by: Jeff King <peff@peff.net>
Signed-off-by: Junio C Hamano <gitster@pobox.com>
2017-09-12 11:05:58 +09:00
Junio C Hamano
46203ac24d cvsserver: use safe_pipe_capture for constant commands as well
This is not strictly necessary, but it is a good code hygiene.

Signed-off-by: Junio C Hamano <gitster@pobox.com>
2017-09-11 14:52:29 +09:00
joernchen
27dd73871f cvsserver: use safe_pipe_capture instead of backticks
This makes the script pass arguments that are derived from end-user
input in safer way when invoking subcommands.

Reported-by: joernchen <joernchen@phenoelit.de>
Signed-off-by: joernchen <joernchen@phenoelit.de>
Signed-off-by: Junio C Hamano <gitster@pobox.com>
2017-09-11 14:52:29 +09:00
Junio C Hamano
fce13af5d2 cvsserver: move safe_pipe_capture() to the main package
As a preparation for replacing `command` with a call to this
function from outside GITCVS::updater package, move it to the main
package.

Signed-off-by: Junio C Hamano <gitster@pobox.com>
2017-09-11 14:52:29 +09:00
Junio C Hamano
7234152e66 Git 2.13.5
Signed-off-by: Junio C Hamano <gitster@pobox.com>
2017-08-01 12:30:00 -07:00
Junio C Hamano
e312af164c Git 2.12.4
-----BEGIN PGP SIGNATURE-----
 Version: GnuPG v1
 
 iQIcBAABCAAGBQJZflhUAAoJELC16IaWr+bLDyAP/jWDc9ic8S1ZH8W4ijAB24vP
 YRyQ1gbnRLhpEpbHYCUp7Uw9mrJBfdwYFlqxGJPH4JZL9qYLJUe5DJMWi5uAEptg
 tYPpPMLV5hgvGICwJbOaS5NlNf2NzLjRvzziOpUnE5CcR5Bw7doCPk4Uw6AVvAvK
 0x/6KDNLdKCBl3ZIoLdp9eW2PrTfYx6AK+Wf9oEgdMSB9+23acL7R/QEmH7oh9gl
 BS0riRQVHnku5akybMnRjeba7SvdhJlIV8rPc4WpuMRz0g2lPzOKQ+okeRtdQrfi
 REdEZ920EJR65KtxUgxYLrpPpmdRBxNI0jXC3Sm2Kac85MLvjFqhaosBWhTQuoOf
 tra68Gb9WSVkKLwRhRBYOG+dx00m1UETs7cYm6pw37RiMss1pcZWNdzjNNouVEEp
 3LBXcPJSpCbEjI+U/H2CqLqCk9gMfKLJXB9hK4b9jBcB9yrON2d75tPMhOcNx+Ej
 x6vZ4Zql6r1Bhe8y7T6KMnLe6vdli8Vrd7Tj5btogcEUmVfRQVHZzV94utevv9A5
 UEXLeCjJSjcY7rYtTdSLXgESioHW8WNfG+TPiyxjujSybtxGKmkcrSGCrugT26K8
 UT5VH2mYJOuHRtWnjWEEEhjayaXLv0mHNQ5XVfNDNPEFqRBQmIhLhcIf/aOF6r+F
 4Q6qN9QceJUEiaFnHsyO
 =ZBXN
 -----END PGP SIGNATURE-----

Merge tag 'v2.12.4' into maint
2017-08-01 12:27:31 -07:00
Junio C Hamano
cf8899d285 Git 2.13.4
Signed-off-by: Junio C Hamano <gitster@pobox.com>
2017-08-01 11:45:17 -07:00
Junio C Hamano
c94ef19041 Preparation for 2.13.4 continues
Signed-off-by: Junio C Hamano <gitster@pobox.com>
2017-07-31 13:52:40 -07:00
Junio C Hamano
0baf0b839b Merge branch 'ks/doc-fixes' into maint
Doc clean-up.

* ks/doc-fixes:
  doc: reformat the paragraph containing the 'cut-line'
  doc: camelCase the i18n config variables to improve readability
2017-07-31 13:51:06 -07:00
Junio C Hamano
42dbdef1ca Merge branch 'jk/test-copy-bytes-fix' into maint
A test fix.

* jk/test-copy-bytes-fix:
  t: handle EOF in test_copy_bytes()
2017-07-31 13:51:06 -07:00
Junio C Hamano
c6767f45e3 Merge branch 'pw/unquote-path-in-git-pm' into maint
Code refactoring.

* pw/unquote-path-in-git-pm:
  t9700: add tests for Git::unquote_path()
  Git::unquote_path(): throw an exception on bad path
  Git::unquote_path(): handle '\a'
  add -i: move unquote_path() to Git.pm
2017-07-31 13:51:05 -07:00
Junio C Hamano
133578a020 Merge branch 'jk/gc-pre-detach-under-hook' into maint
We run an early part of "git gc" that deals with refs before
daemonising (and not under lock) even when running a background
auto-gc, which caused multiple gc processes attempting to run the
early part at the same time.  This is now prevented by running the
early part also under the GC lock.

* jk/gc-pre-detach-under-hook:
  gc: run pre-detach operations under lock
2017-07-31 13:51:05 -07:00
Junio C Hamano
309ff914d5 Merge branch 'jn/hooks-pre-rebase-sample-fix' into maint
Code clean-up, that makes us in sync with Debian by one patch.

* jn/hooks-pre-rebase-sample-fix:
  pre-rebase hook: capture documentation in a <<here document
2017-07-31 13:51:05 -07:00
Junio C Hamano
4f77f618d9 Merge branch 'rs/progress-overall-throughput-at-the-end' into maint
The progress meter did not give a useful output when we haven't had
0.5 seconds to measure the throughput during the interval.  Instead
show the overall throughput rate at the end, which is a much more
useful number.

* rs/progress-overall-throughput-at-the-end:
  progress: show overall rate in last update
2017-07-31 13:51:04 -07:00
Junio C Hamano
49f1e2eb1b Merge branch 'tb/push-to-cygwin-unc-path' into maint
On Cygwin, similar to Windows, "git push //server/share/repository"
ought to mean a repository on a network share that can be accessed
locally, but this did not work correctly due to stripping the double
slashes at the beginning.

This may need to be heavily tested before it gets unleashed to the
wild, as the change is at a fairly low-level code and would affect
not just the code to decide if the push destination is local.  There
may be unexpected fallouts in the path normalization.

* tb/push-to-cygwin-unc-path:
  cygwin: allow pushing to UNC paths
2017-07-31 13:51:04 -07:00
Junio C Hamano
bc2c50fc2c Merge branch 'rs/apply-avoid-over-reading' into maint
Code cleanup.

* rs/apply-avoid-over-reading:
  apply: use strcmp(3) for comparing strings in gitdiff_verify_name()
  apply: use starts_with() in gitdiff_verify_name()
2017-07-31 13:51:04 -07:00
Junio C Hamano
3d9c5b5c44 Git 2.12.4
Signed-off-by: Junio C Hamano <gitster@pobox.com>
2017-07-30 15:06:06 -07:00
Junio C Hamano
3def5e9a8d Git 2.11.3
-----BEGIN PGP SIGNATURE-----
 Version: GnuPG v1
 
 iQIcBAABCAAGBQJZfleHAAoJELC16IaWr+bLxB8QANsdFCtO+/PFnda2CmadVt/J
 d4AGMSu+cD74aUp5wzMscROCggn3vMHVeDMdVJ3ihcY6nLjJRy0EC/VJ5yTpSGli
 iq2GjmoH/oTS2tq2JWbTe86VMVYAzuWlWyowwH6OymDLkBQcAOap1WfUHTmKehUi
 BV2br1x15c7hRGToFqN8yed39iVmQoDJ5ETTBgFqkVyVHDdlyc81FRt0RfiA2x3N
 nm5/gOOWvH5X4Cyu7yP2C9GSV9p1mufEtw1DNwp+MV3n3wa2P4wJeNnYYmW85hpS
 ZzuWEM9QcU3fbShHxHcwHCyy2imXUUsfm1/Y6rCH3ZVSzo1icz5ghL2rnmcxdZvS
 JMp60EKbaapUiIkI23R2Yvlh81J5frwOp739DYytlai3rZF7le9KYGQnsUrv95Ie
 CvFGr3Btiy3oEVOP7xRiGnGtThmVRP4mFsIIIgf3YsBJqRXRwxqn1D6jbkHBqu7z
 VfFnpp63BsKY59Udo1qilkxS2qQ35gAS+TNczPV9D0m3n3bZ5UXEMuonahAE5YwG
 d20wBNOd86oK4khtMWcxXx4BBx+tlA99FfQOgxvn3XWnHmTAJE3+L0uEajZpEpcU
 gkHLo0EutMY+xmX9+jwszmBS9gNL9xzFADtAoYIoAsmpaD7jBJsTjwyzstTyXLvr
 5jcZT/hyX4iZtOUlC67J
 =fCBm
 -----END PGP SIGNATURE-----

Merge tag 'v2.11.3' into maint-2.12

Git 2.11.3
2017-07-30 15:04:22 -07:00
Junio C Hamano
9315f271e3 Merge branch 'jk/lib-proto-disable-cleanup' into maint-2.12 2017-07-30 15:03:21 -07:00
Junio C Hamano
3b82744481 Git 2.11.3
Signed-off-by: Junio C Hamano <gitster@pobox.com>
2017-07-30 15:02:37 -07:00
Junio C Hamano
05bb78abc1 Git 2.10.4
-----BEGIN PGP SIGNATURE-----
 Version: GnuPG v1
 
 iQIcBAABCAAGBQJZflbsAAoJELC16IaWr+bLUUAQAONDi4Ty/I9K79Nwv9/15HcV
 4oMfCC56Y8nLUs83GsS0aZadX15iABsOACtZUA0kPQB8PV2XYcUnM6rPFtpeovRI
 sfs0XqfK5l+cVDoMMb2sGAfQYEBIXRy8sUb1EXIuJ4MzHxfRbmm1sKd7ko3lg6hN
 JHhGsNpzIVRspuUZh+yXp0Qa8CKKnekhwEntVd5b71eahG3lJNBO7UXvDAkDyl33
 amoc5eqKdoGvjs3yYBvOV0qX8ePV53wieKwL5uBG6LdjMrjtWpLJOuMk6IYR18Sm
 ++A+WiCb14lQ/6Wfu+r7WhjaWIXHHMPV/5YMhm1OzrWKiw+DuucLVaorl3cSPA2G
 zNPoHGUGxfnKz0NLiMkpbjUfB0gYqqLKts5pcnKeTconUcLZlpYKEYNpypfgbJyr
 XvIgkjAt3KwRa8mrGvCURkelmYKzFzd+hZdxvXiJ/flk4CcssgMgYorWCMwwy86a
 uErlgWDcGh9wtV9Pwy8M7EwXcRDggBND5jqH2dpFUaQ+8Kzm11lX5BRseZIOASzL
 ++MuZGEQiETz2HkWb+DWMIDAJMej2N2DF1eq7DnsmEUZgOarf2ZP3Lsd84W43WLI
 PdLhA1zpL2YVz9EEeFT/hLSX3fC16+lkeVQhtV5pJlIiLumHOdWYBElsnX694Nv3
 JTE4X1l38kCBQ4on8eEo
 =R9MM
 -----END PGP SIGNATURE-----

Merge tag 'v2.10.4' into maint-2.11

Git 2.10.4
2017-07-30 15:01:31 -07:00
Junio C Hamano
0bfff8146f Git 2.10.4
Signed-off-by: Junio C Hamano <gitster@pobox.com>
2017-07-30 15:00:04 -07:00
Junio C Hamano
d78f06a1b7 Git 2.9.5
-----BEGIN PGP SIGNATURE-----
 Version: GnuPG v1
 
 iQIcBAABCAAGBQJZflVaAAoJELC16IaWr+bL/5QP/1NoUGqrwB+zwJ8+oDqd+Djl
 PX8qyafoMXJr/w/fACk8r/tCSGKgK8Gx9FqZ9GIBCAZVNXkQnheRElOjiuRg4rbl
 +USiN2XM4ue/X7GqEBc7YVAmd+ifFFQ+ckm1g72A53B4Qh4/Ca4MnPYLOi7eKfC1
 85f+/zMj/5pYsmboFZzFiUPq+Khyb2e85Mm9ok+l/8zAXt4ER5cf4mhY3KSEtnfA
 6qGVUJ3fS9FzE4ud+/cx2qidsTrzZI/Hpv+3TVVXzSv5j32D3srnumLs+XnVIarV
 nJFoVUZV/XSC80YUkwbcdY6Rs2gVfhHJK6zVcs8MfHC28o+ZJDM+ceGVnUKcdpDW
 Gejsc7l0Blt0IodLoHAemBOsF3eeQBh5M5vodHdEFTiCdGRcCX3lvPxikCILW1Fv
 4FPmrjfOlWEz0ktV4eKacX+DVAa2p9P09v0B6pKFt/l5MiHKla8qdYXLjEnEHHaN
 ywIJPK0Lbgr+rjf3XcEQ96sjP+2XOcmtwTxychEcQ7Z2IwqyJA/GtdyCh1/jinap
 0M9odRHtYHRk1qUcZBLosM3C3Y0rgc2k1RZJRgdAY1kiBezctoU6FkH5Pb7LFRtH
 hr3/llk9X1ivh6fruLZ6Lu2EZ/vJVOwtUNLFqPO8fLP4cABkhDdxX13o5PS+qYMJ
 THXReDUV4vgtmzKrgJ+7
 =w1+M
 -----END PGP SIGNATURE-----

Merge tag 'v2.9.5' into maint-2.10

Git 2.9.5
2017-07-30 14:57:33 -07:00
Junio C Hamano
4d4165b80d Git 2.9.5
Signed-off-by: Junio C Hamano <gitster@pobox.com>
2017-07-30 14:53:25 -07:00
Junio C Hamano
af0178aec7 Git 2.8.6
-----BEGIN PGP SIGNATURE-----
 Version: GnuPG v1
 
 iQIcBAABCAAGBQJZflRcAAoJELC16IaWr+bLOnAQAIEtjMActDfpYb+tXftBIzzm
 Od/tBG3WZMRPyq/fWExV9nPO5xYOf6O9PlU6H7rNMDh+2n5/ypxqEXDvjzNHRMyh
 TIk1oAjG0zDiSe/fHO4v3fcCeIne0C0ZDwzYjS9+mSnybmPRLMQ1j8ykV7oBIUlB
 A081Tcb86bxG9kdxO4Sih+0zIglZ1lNA9fH7PqY5v/DqBY9TkaZIuoEjCIo7wUYu
 k+kSrNjXWz8HdYovpO/snhgtU7TFS7OtWmYEvXBg4+p6R1nGCuSWejHeWrbqx3fI
 QPXdLXIua/NqZKdd6ad4K+K91XW1OaqnK49IY58sSzHXYiDRnfnmBDzduyuagEE1
 C3BQhALMvkGZBmkNI1unZBqxsz4E7hviyxeOt1W3Z/I8mt6IGGnLWg+oVEy4b3yj
 TAx4rQJs1xmGU5maR25yBnQI/ElZWHNg+vrtGhdt5XvklASwn8egukjAjUWJodie
 hs/BiMKf+Rk7dVPY6RnK94pHWtNpkTlD9VCaLXhmFN863Zc3DwYBcbUF2D78d5G8
 zLG1pQRtWizAjF9XJ/q01JAutHUyyoYGWwa8lKJvplxQaXwe0bntzPILZN81G1Cy
 mC955bsbyIGv+88elRAeYpu7SxQJ1uGmpMYcamdLr7irDF2bUZp7n55Ogia4IKvK
 LgvwELkejo1WgDBYvqET
 =iOsd
 -----END PGP SIGNATURE-----

Merge tag 'v2.8.6' into maint-2.9

Git 2.8.6
2017-07-30 14:52:14 -07:00
Junio C Hamano
8d7f72f176 Git 2.8.6
Signed-off-by: Junio C Hamano <gitster@pobox.com>
2017-07-30 14:49:08 -07:00
Junio C Hamano
7720c33f63 Git 2.7.6
-----BEGIN PGP SIGNATURE-----
 Version: GnuPG v1
 
 iQIcBAABCAAGBQJZflNxAAoJELC16IaWr+bLpSsQAIT1s4c/uKAXJBw8CegM4SP1
 SeB5NMnjz7VVtBsdXKPy6fVXBHCjffON/MvNXcXwGqzx3lh6SiMAVNjYknBkQcKN
 b639dD9HEEBRFf62a+QAyRYbFeg0NONVydB25s7RfR57HUNxFibaJDT5SoymO0/5
 YCdmMENuvijvCYcwyb3MSjAKCkwDDErPzyI4NZ2YZpC7IG46Uoxq8BCdHpKhXa5I
 3TNEDruBAd/UJCIQiMW1HP3OMQXzXmCTL5i4QSr/uloO1kNzkWgCZDkkFrSGFPdx
 UeTRXOM0r5QdFXZC36zZNoL5ELflgzrYFSerj6VkCAbiG4FAWL+43CCxuUcq5OkZ
 JsTYObieBMFiaowTn9hKo3ix1xDSjR2+p0bfZbOPy5jMB85oegnjV3Rp/eBoXsDm
 h4qo+5kv0h8H2wKdxcBfVg6LkpBZGsvEOveAtWZIcFIVIOyULj9UAsnTwOotwQiL
 NHO4J2fJhcvSYUj6oGB3SpabKZfcbVXRE2fzZq+3+Mt4DdzSdSmx5CEJfUmxN7sQ
 YLb8UKSr2vv03YfKRghCGxqjOcmQL5vY79O8+QSN3cCDFFAwxzNYaGeHJ+/chvh2
 NySOkUf/uA7H1xQiZmJI1mfwQvi527MEzblCPDButm6n8ty6QyWOQ+kQYzcW5jjI
 kPWdqc5pCZQ+Q+q6lQc0
 =rNay
 -----END PGP SIGNATURE-----

Merge tag 'v2.7.6' into maint-2.8

Git 2.7.6
2017-07-30 14:46:43 -07:00
Junio C Hamano
5e0649dc65 Git 2.7.6
Signed-off-by: Junio C Hamano <gitster@pobox.com>
2017-07-30 14:45:13 -07:00
Junio C Hamano
a4f234bf9b Merge branch 'jk/ssh-funny-url' into maint-2.7 2017-07-28 16:11:54 -07:00
Jeff King
aeeb2d4968 connect: reject paths that look like command line options
If we get a repo path like "-repo.git", we may try to invoke
"git-upload-pack -repo.git". This is going to fail, since
upload-pack will interpret it as a set of bogus options. But
let's reject this before we even run the sub-program, since
we would not want to allow any mischief with repo names that
actually are real command-line options.

You can still ask for such a path via git-daemon, but there's no
security problem there, because git-daemon enters the repo itself
and then passes "."  on the command line.

Signed-off-by: Jeff King <peff@peff.net>
Reviewed-by: Jonathan Nieder <jrnieder@gmail.com>
Signed-off-by: Junio C Hamano <gitster@pobox.com>
2017-07-28 15:54:55 -07:00
Jeff King
3be4cf09cd connect: reject dashed arguments for proxy commands
If you have a GIT_PROXY_COMMAND configured, we will run it
with the host/port on the command-line. If a URL contains a
mischievous host like "--foo", we don't know how the proxy
command may handle it. It's likely to break, but it may also
do something dangerous and unwanted (technically it could
even do something useful, but that seems unlikely).

We should err on the side of caution and reject this before
we even run the command.

The hostname check matches the one we do in a similar
circumstance for ssh. The port check is not present for ssh,
but there it's not necessary because the syntax is "-p
<port>", and there's no ambiguity on the parsing side.

It's not clear whether you can actually get a negative port
to the proxy here or not. Doing:

  git fetch git://remote:-1234/repo.git

keeps the "-1234" as part of the hostname, with the default
port of 9418. But it's a good idea to keep this check close
to the point of running the command to make it clear that
there's no way to circumvent it (and at worst it serves as a
belt-and-suspenders check).

Signed-off-by: Jeff King <peff@peff.net>
Reviewed-by: Jonathan Nieder <jrnieder@gmail.com>
Signed-off-by: Junio C Hamano <gitster@pobox.com>
2017-07-28 15:52:18 -07:00
Jeff King
2491f77b90 connect: factor out "looks like command line option" check
We reject hostnames that start with a dash because they may
be confused for command-line options. Let's factor out that
notion into a helper function, as we'll use it in more
places. And while it's simple now, it's not clear if some
systems might need more complex logic to handle all cases.

Signed-off-by: Jeff King <peff@peff.net>
Reviewed-by: Jonathan Nieder <jrnieder@gmail.com>
Signed-off-by: Junio C Hamano <gitster@pobox.com>
2017-07-28 15:51:56 -07:00
Jeff King
2d90add5ad t5813: add test for hostname starting with dash
Per the explanation in the previous patch, this should be
(and is) rejected.

Signed-off-by: Jeff King <peff@peff.net>
Reviewed-by: Jonathan Nieder <jrnieder@gmail.com>
Signed-off-by: Junio C Hamano <gitster@pobox.com>
2017-07-28 15:51:29 -07:00
Junio C Hamano
820d7650cc connect: reject ssh hostname that begins with a dash
When commands like "git fetch" talk with ssh://$rest_of_URL/, the
code splits $rest_of_URL into components like host, port, etc., and
then spawns the underlying "ssh" program by formulating argv[] array
that has:

 - the path to ssh command taken from GIT_SSH_COMMAND, etc.

 - dashed options like '-batch' (for Tortoise), '-p <port>' as
   needed.

 - ssh_host, which is supposed to be the hostname parsed out of
   $rest_of_URL.

 - then the command to be run on the other side, e.g. git
   upload-pack.

If the ssh_host ends up getting '-<anything>', the argv[] that is
used to spawn the command becomes something like:

    { "ssh", "-p", "22", "-<anything>", "command", "to", "run", NULL }

which obviously is bogus, but depending on the actual value of
"<anything>", will make "ssh" parse and use it as an option.

Prevent this by forbidding ssh_host that begins with a "-".

Noticed-by: Joern Schneeweisz of Recurity Labs
Reported-by: Brian at GitLab
Signed-off-by: Junio C Hamano <gitster@pobox.com>
Reviewed-by: Jeff King <peff@peff.net>
Signed-off-by: Junio C Hamano <gitster@pobox.com>
2017-07-28 15:51:14 -07:00
Jeff King
30c586ff15 t/lib-proto-disable: restore protocol.allow after config tests
The tests for protocol.allow actually set that variable in
the on-disk config, run a series of tests, and then never
clean up after themselves. This means that whatever tests we
run after have protocol.allow=never, which may influence
their results.

In most cases we either exit after running these tests, or
do another round of test_proto(). In the latter case, this happens to
work because:

  1. Tests of the GIT_ALLOW_PROTOCOL environment variable
     override the config.

  2. Tests of the specific config "protocol.foo.allow"
     override the protocol.allow config.

  3. The next round of protocol.allow tests start off by
     setting the config to a known value.

However, it's a land-mine waiting to trap somebody adding
new tests to one of the t581x test scripts. Let's make sure
we clean up after ourselves.

Signed-off-by: Jeff King <peff@peff.net>
Signed-off-by: Junio C Hamano <gitster@pobox.com>
2017-07-28 15:48:39 -07:00
Junio C Hamano
2187e112d7 fixes from 'master' for 2.13.4
Signed-off-by: Junio C Hamano <gitster@pobox.com>
2017-07-21 15:06:09 -07:00
Junio C Hamano
38351249be Merge branch 'ew/fd-cloexec-fix' into maint
Portability/fallback fix.

* ew/fd-cloexec-fix:
  set FD_CLOEXEC properly when O_CLOEXEC is not supported
2017-07-21 15:03:40 -07:00
Junio C Hamano
bae7e3f153 Merge branch 'ks/fix-rebase-doc-picture' into maint
Doc update.

* ks/fix-rebase-doc-picture:
  doc: correct a mistake in an illustration
2017-07-21 15:03:39 -07:00