Commit Graph

44493 Commits

Author SHA1 Message Date
Junio C Hamano
27dea4683b Git 2.10.5
Signed-off-by: Junio C Hamano <gitster@pobox.com>
2017-09-22 14:42:22 +09:00
Junio C Hamano
dca89d4e56 Merge branch 'jk/safe-pipe-capture' into maint-2.10 2017-09-22 14:34:34 +09:00
Junio C Hamano
6d6e2f812d Merge branch 'jk/cvsimport-quoting' into maint-2.10 2017-09-22 14:34:34 +09:00
Junio C Hamano
31add46823 Merge branch 'jc/cvsserver' into maint-2.10 2017-09-22 14:34:34 +09:00
Junio C Hamano
985f59c042 Merge branch 'jk/git-shell-drop-cvsserver' into maint-2.10 2017-09-22 14:34:34 +09:00
Jeff King
5b4efea666 cvsimport: shell-quote variable used in backticks
We run `git rev-parse` though the shell, and quote its
argument only with single-quotes. This prevents most
metacharacters from being a problem, but misses the obvious
case when $name itself has single-quotes in it. We can fix
this by applying the usual shell-quoting formula.

Signed-off-by: Jeff King <peff@peff.net>
Signed-off-by: Junio C Hamano <gitster@pobox.com>
2017-09-12 11:10:22 +09:00
Jeff King
8d0fad0a7a archimport: use safe_pipe_capture for user input
Refnames can contain shell metacharacters which need to be
passed verbatim to sub-processes. Using safe_pipe_capture
skips the shell entirely.

Signed-off-by: Jeff King <peff@peff.net>
Signed-off-by: Junio C Hamano <gitster@pobox.com>
2017-09-12 11:08:15 +09:00
Jeff King
9a42c03cb7 shell: drop git-cvsserver support by default
The git-cvsserver script is old and largely unmaintained
these days. But git-shell allows untrusted users to run it
out of the box, significantly increasing its attack surface.

Let's drop it from git-shell's list of internal handlers so
that it cannot be run by default.  This is not backwards
compatible. But given the age and development activity on
CVS-related parts of Git, this is likely to impact very few
users, while helping many more (i.e., anybody who runs
git-shell and had no intention of supporting CVS).

There's no configuration mechanism in git-shell for us to
add a boolean and flip it to "off". But there is a mechanism
for adding custom commands, and adding CVS support here is
fairly trivial. Let's document it to give guidance to
anybody who really is still running cvsserver.

Signed-off-by: Jeff King <peff@peff.net>
Signed-off-by: Junio C Hamano <gitster@pobox.com>
2017-09-12 11:05:58 +09:00
Junio C Hamano
46203ac24d cvsserver: use safe_pipe_capture for constant commands as well
This is not strictly necessary, but it is a good code hygiene.

Signed-off-by: Junio C Hamano <gitster@pobox.com>
2017-09-11 14:52:29 +09:00
joernchen
27dd73871f cvsserver: use safe_pipe_capture instead of backticks
This makes the script pass arguments that are derived from end-user
input in safer way when invoking subcommands.

Reported-by: joernchen <joernchen@phenoelit.de>
Signed-off-by: joernchen <joernchen@phenoelit.de>
Signed-off-by: Junio C Hamano <gitster@pobox.com>
2017-09-11 14:52:29 +09:00
Junio C Hamano
fce13af5d2 cvsserver: move safe_pipe_capture() to the main package
As a preparation for replacing `command` with a call to this
function from outside GITCVS::updater package, move it to the main
package.

Signed-off-by: Junio C Hamano <gitster@pobox.com>
2017-09-11 14:52:29 +09:00
Junio C Hamano
0bfff8146f Git 2.10.4
Signed-off-by: Junio C Hamano <gitster@pobox.com>
2017-07-30 15:00:04 -07:00
Junio C Hamano
d78f06a1b7 Git 2.9.5
-----BEGIN PGP SIGNATURE-----
 Version: GnuPG v1
 
 iQIcBAABCAAGBQJZflVaAAoJELC16IaWr+bL/5QP/1NoUGqrwB+zwJ8+oDqd+Djl
 PX8qyafoMXJr/w/fACk8r/tCSGKgK8Gx9FqZ9GIBCAZVNXkQnheRElOjiuRg4rbl
 +USiN2XM4ue/X7GqEBc7YVAmd+ifFFQ+ckm1g72A53B4Qh4/Ca4MnPYLOi7eKfC1
 85f+/zMj/5pYsmboFZzFiUPq+Khyb2e85Mm9ok+l/8zAXt4ER5cf4mhY3KSEtnfA
 6qGVUJ3fS9FzE4ud+/cx2qidsTrzZI/Hpv+3TVVXzSv5j32D3srnumLs+XnVIarV
 nJFoVUZV/XSC80YUkwbcdY6Rs2gVfhHJK6zVcs8MfHC28o+ZJDM+ceGVnUKcdpDW
 Gejsc7l0Blt0IodLoHAemBOsF3eeQBh5M5vodHdEFTiCdGRcCX3lvPxikCILW1Fv
 4FPmrjfOlWEz0ktV4eKacX+DVAa2p9P09v0B6pKFt/l5MiHKla8qdYXLjEnEHHaN
 ywIJPK0Lbgr+rjf3XcEQ96sjP+2XOcmtwTxychEcQ7Z2IwqyJA/GtdyCh1/jinap
 0M9odRHtYHRk1qUcZBLosM3C3Y0rgc2k1RZJRgdAY1kiBezctoU6FkH5Pb7LFRtH
 hr3/llk9X1ivh6fruLZ6Lu2EZ/vJVOwtUNLFqPO8fLP4cABkhDdxX13o5PS+qYMJ
 THXReDUV4vgtmzKrgJ+7
 =w1+M
 -----END PGP SIGNATURE-----

Merge tag 'v2.9.5' into maint-2.10

Git 2.9.5
2017-07-30 14:57:33 -07:00
Junio C Hamano
4d4165b80d Git 2.9.5
Signed-off-by: Junio C Hamano <gitster@pobox.com>
2017-07-30 14:53:25 -07:00
Junio C Hamano
af0178aec7 Git 2.8.6
-----BEGIN PGP SIGNATURE-----
 Version: GnuPG v1
 
 iQIcBAABCAAGBQJZflRcAAoJELC16IaWr+bLOnAQAIEtjMActDfpYb+tXftBIzzm
 Od/tBG3WZMRPyq/fWExV9nPO5xYOf6O9PlU6H7rNMDh+2n5/ypxqEXDvjzNHRMyh
 TIk1oAjG0zDiSe/fHO4v3fcCeIne0C0ZDwzYjS9+mSnybmPRLMQ1j8ykV7oBIUlB
 A081Tcb86bxG9kdxO4Sih+0zIglZ1lNA9fH7PqY5v/DqBY9TkaZIuoEjCIo7wUYu
 k+kSrNjXWz8HdYovpO/snhgtU7TFS7OtWmYEvXBg4+p6R1nGCuSWejHeWrbqx3fI
 QPXdLXIua/NqZKdd6ad4K+K91XW1OaqnK49IY58sSzHXYiDRnfnmBDzduyuagEE1
 C3BQhALMvkGZBmkNI1unZBqxsz4E7hviyxeOt1W3Z/I8mt6IGGnLWg+oVEy4b3yj
 TAx4rQJs1xmGU5maR25yBnQI/ElZWHNg+vrtGhdt5XvklASwn8egukjAjUWJodie
 hs/BiMKf+Rk7dVPY6RnK94pHWtNpkTlD9VCaLXhmFN863Zc3DwYBcbUF2D78d5G8
 zLG1pQRtWizAjF9XJ/q01JAutHUyyoYGWwa8lKJvplxQaXwe0bntzPILZN81G1Cy
 mC955bsbyIGv+88elRAeYpu7SxQJ1uGmpMYcamdLr7irDF2bUZp7n55Ogia4IKvK
 LgvwELkejo1WgDBYvqET
 =iOsd
 -----END PGP SIGNATURE-----

Merge tag 'v2.8.6' into maint-2.9

Git 2.8.6
2017-07-30 14:52:14 -07:00
Junio C Hamano
8d7f72f176 Git 2.8.6
Signed-off-by: Junio C Hamano <gitster@pobox.com>
2017-07-30 14:49:08 -07:00
Junio C Hamano
7720c33f63 Git 2.7.6
-----BEGIN PGP SIGNATURE-----
 Version: GnuPG v1
 
 iQIcBAABCAAGBQJZflNxAAoJELC16IaWr+bLpSsQAIT1s4c/uKAXJBw8CegM4SP1
 SeB5NMnjz7VVtBsdXKPy6fVXBHCjffON/MvNXcXwGqzx3lh6SiMAVNjYknBkQcKN
 b639dD9HEEBRFf62a+QAyRYbFeg0NONVydB25s7RfR57HUNxFibaJDT5SoymO0/5
 YCdmMENuvijvCYcwyb3MSjAKCkwDDErPzyI4NZ2YZpC7IG46Uoxq8BCdHpKhXa5I
 3TNEDruBAd/UJCIQiMW1HP3OMQXzXmCTL5i4QSr/uloO1kNzkWgCZDkkFrSGFPdx
 UeTRXOM0r5QdFXZC36zZNoL5ELflgzrYFSerj6VkCAbiG4FAWL+43CCxuUcq5OkZ
 JsTYObieBMFiaowTn9hKo3ix1xDSjR2+p0bfZbOPy5jMB85oegnjV3Rp/eBoXsDm
 h4qo+5kv0h8H2wKdxcBfVg6LkpBZGsvEOveAtWZIcFIVIOyULj9UAsnTwOotwQiL
 NHO4J2fJhcvSYUj6oGB3SpabKZfcbVXRE2fzZq+3+Mt4DdzSdSmx5CEJfUmxN7sQ
 YLb8UKSr2vv03YfKRghCGxqjOcmQL5vY79O8+QSN3cCDFFAwxzNYaGeHJ+/chvh2
 NySOkUf/uA7H1xQiZmJI1mfwQvi527MEzblCPDButm6n8ty6QyWOQ+kQYzcW5jjI
 kPWdqc5pCZQ+Q+q6lQc0
 =rNay
 -----END PGP SIGNATURE-----

Merge tag 'v2.7.6' into maint-2.8

Git 2.7.6
2017-07-30 14:46:43 -07:00
Junio C Hamano
5e0649dc65 Git 2.7.6
Signed-off-by: Junio C Hamano <gitster@pobox.com>
2017-07-30 14:45:13 -07:00
Junio C Hamano
a4f234bf9b Merge branch 'jk/ssh-funny-url' into maint-2.7 2017-07-28 16:11:54 -07:00
Jeff King
aeeb2d4968 connect: reject paths that look like command line options
If we get a repo path like "-repo.git", we may try to invoke
"git-upload-pack -repo.git". This is going to fail, since
upload-pack will interpret it as a set of bogus options. But
let's reject this before we even run the sub-program, since
we would not want to allow any mischief with repo names that
actually are real command-line options.

You can still ask for such a path via git-daemon, but there's no
security problem there, because git-daemon enters the repo itself
and then passes "."  on the command line.

Signed-off-by: Jeff King <peff@peff.net>
Reviewed-by: Jonathan Nieder <jrnieder@gmail.com>
Signed-off-by: Junio C Hamano <gitster@pobox.com>
2017-07-28 15:54:55 -07:00
Jeff King
3be4cf09cd connect: reject dashed arguments for proxy commands
If you have a GIT_PROXY_COMMAND configured, we will run it
with the host/port on the command-line. If a URL contains a
mischievous host like "--foo", we don't know how the proxy
command may handle it. It's likely to break, but it may also
do something dangerous and unwanted (technically it could
even do something useful, but that seems unlikely).

We should err on the side of caution and reject this before
we even run the command.

The hostname check matches the one we do in a similar
circumstance for ssh. The port check is not present for ssh,
but there it's not necessary because the syntax is "-p
<port>", and there's no ambiguity on the parsing side.

It's not clear whether you can actually get a negative port
to the proxy here or not. Doing:

  git fetch git://remote:-1234/repo.git

keeps the "-1234" as part of the hostname, with the default
port of 9418. But it's a good idea to keep this check close
to the point of running the command to make it clear that
there's no way to circumvent it (and at worst it serves as a
belt-and-suspenders check).

Signed-off-by: Jeff King <peff@peff.net>
Reviewed-by: Jonathan Nieder <jrnieder@gmail.com>
Signed-off-by: Junio C Hamano <gitster@pobox.com>
2017-07-28 15:52:18 -07:00
Jeff King
2491f77b90 connect: factor out "looks like command line option" check
We reject hostnames that start with a dash because they may
be confused for command-line options. Let's factor out that
notion into a helper function, as we'll use it in more
places. And while it's simple now, it's not clear if some
systems might need more complex logic to handle all cases.

Signed-off-by: Jeff King <peff@peff.net>
Reviewed-by: Jonathan Nieder <jrnieder@gmail.com>
Signed-off-by: Junio C Hamano <gitster@pobox.com>
2017-07-28 15:51:56 -07:00
Jeff King
2d90add5ad t5813: add test for hostname starting with dash
Per the explanation in the previous patch, this should be
(and is) rejected.

Signed-off-by: Jeff King <peff@peff.net>
Reviewed-by: Jonathan Nieder <jrnieder@gmail.com>
Signed-off-by: Junio C Hamano <gitster@pobox.com>
2017-07-28 15:51:29 -07:00
Junio C Hamano
820d7650cc connect: reject ssh hostname that begins with a dash
When commands like "git fetch" talk with ssh://$rest_of_URL/, the
code splits $rest_of_URL into components like host, port, etc., and
then spawns the underlying "ssh" program by formulating argv[] array
that has:

 - the path to ssh command taken from GIT_SSH_COMMAND, etc.

 - dashed options like '-batch' (for Tortoise), '-p <port>' as
   needed.

 - ssh_host, which is supposed to be the hostname parsed out of
   $rest_of_URL.

 - then the command to be run on the other side, e.g. git
   upload-pack.

If the ssh_host ends up getting '-<anything>', the argv[] that is
used to spawn the command becomes something like:

    { "ssh", "-p", "22", "-<anything>", "command", "to", "run", NULL }

which obviously is bogus, but depending on the actual value of
"<anything>", will make "ssh" parse and use it as an option.

Prevent this by forbidding ssh_host that begins with a "-".

Noticed-by: Joern Schneeweisz of Recurity Labs
Reported-by: Brian at GitLab
Signed-off-by: Junio C Hamano <gitster@pobox.com>
Reviewed-by: Jeff King <peff@peff.net>
Signed-off-by: Junio C Hamano <gitster@pobox.com>
2017-07-28 15:51:14 -07:00
Junio C Hamano
840ed14198 Git 2.10.3
Signed-off-by: Junio C Hamano <gitster@pobox.com>
2017-05-05 13:24:10 +09:00
Junio C Hamano
fc92b0878c Merge branch 'maint-2.9' into maint-2.10 2017-05-05 13:21:52 +09:00
Junio C Hamano
d61226c111 Git 2.9.4
Signed-off-by: Junio C Hamano <gitster@pobox.com>
2017-05-05 13:19:10 +09:00
Junio C Hamano
c93ab42b74 Merge branch 'maint-2.8' into maint-2.9 2017-05-05 13:13:48 +09:00
Junio C Hamano
cd08873275 Git 2.8.5
Signed-off-by: Junio C Hamano <gitster@pobox.com>
2017-05-05 13:08:54 +09:00
Junio C Hamano
a8d93d19a2 Merge branch 'maint-2.7' into maint-2.8 2017-05-05 13:05:03 +09:00
Junio C Hamano
c8dd1e3bb1 Git 2.7.5
Signed-off-by: Junio C Hamano <gitster@pobox.com>
2017-05-05 13:03:40 +09:00
Junio C Hamano
dc58c8554a Merge branch 'maint-2.6' into maint-2.7 2017-05-05 12:59:16 +09:00
Junio C Hamano
70fcaef90b Git 2.6.7
Signed-off-by: Junio C Hamano <gitster@pobox.com>
2017-05-05 12:56:19 +09:00
Junio C Hamano
ab37a18b60 Merge branch 'maint-2.5' into maint-2.6 2017-05-05 12:52:26 +09:00
Junio C Hamano
ac33201285 Git 2.5.6
Signed-off-by: Junio C Hamano <gitster@pobox.com>
2017-05-05 12:50:38 +09:00
Junio C Hamano
531788af95 Merge branch 'maint-2.4' into maint-2.5 2017-05-05 12:46:53 +09:00
Junio C Hamano
4000b40209 Git 2.4.12
Signed-off-by: Junio C Hamano <gitster@pobox.com>
2017-05-05 12:43:16 +09:00
Junio C Hamano
5a4ffdf587 Merge branch 'jk/shell-no-repository-that-begins-with-dash' into maint-2.4
* jk/shell-no-repository-that-begins-with-dash:
  shell: disallow repo names beginning with dash
2017-05-05 12:17:55 +09:00
Jeff King
3ec804490a shell: disallow repo names beginning with dash
When a remote server uses git-shell, the client side will
connect to it like:

  ssh server "git-upload-pack 'foo.git'"

and we literally exec ("git-upload-pack", "foo.git"). In
early versions of upload-pack and receive-pack, we took a
repository argument and nothing else. But over time they
learned to accept dashed options. If the user passes a
repository name that starts with a dash, the results are
confusing at best (we complain of a bogus option instead of
a non-existent repository) and malicious at worst (the user
can start an interactive pager via "--help").

We could pass "--" to the sub-process to make sure the
user's argument is interpreted as a branch name. I.e.:

  git-upload-pack -- -foo.git

But adding "--" automatically would make us inconsistent
with a normal shell (i.e., when git-shell is not in use),
where "-foo.git" would still be an error. For that case, the
client would have to specify the "--", but they can't do so
reliably, as existing versions of git-shell do not allow
more than a single argument.

The simplest thing is to simply disallow "-" at the start of
the repo name argument. This hasn't worked either with or
without git-shell since version 1.0.0, and nobody has
complained.

Note that this patch just applies to do_generic_cmd(), which
runs upload-pack, receive-pack, and upload-archive. There
are two other types of commands that git-shell runs:

  - do_cvs_cmd(), but this already restricts the argument to
    be the literal string "server"

  - admin-provided commands in the git-shell-commands
    directory. We'll pass along arbitrary arguments there,
    so these commands could have similar problems. But these
    commands might actually understand dashed arguments, so
    we cannot just block them here. It's up to the writer of
    the commands to make sure they are safe. With great
    power comes great responsibility.

Reported-by: Timo Schmid <tschmid@ernw.de>
Signed-off-by: Jeff King <peff@peff.net>
Signed-off-by: Junio C Hamano <gitster@pobox.com>
2017-05-05 12:07:27 +09:00
Junio C Hamano
c3808ca698 preparing for 2.10.3
Signed-off-by: Junio C Hamano <gitster@pobox.com>
2016-12-05 11:25:02 -08:00
Junio C Hamano
cd1c2e7301 Merge branch 'jk/common-main' into maint-2.10
* jk/common-main:
  common-main: stop munging argv[0] path
  git-compat-util: move content inside ifdef/endif guards
2016-12-05 11:24:28 -08:00
Junio C Hamano
0a79ccaac7 Merge branch 'tk/diffcore-delta-remove-unused' into maint
Code cleanup.

* tk/diffcore-delta-remove-unused:
  diffcore-delta: remove unused parameter to diffcore_count_changes()
2016-11-29 13:28:03 -08:00
Junio C Hamano
af8d6a9821 Merge branch 'jk/create-branch-remove-unused-param' into maint
Code clean-up.

* jk/create-branch-remove-unused-param:
  create_branch: drop unused "head" parameter
2016-11-29 13:28:02 -08:00
Junio C Hamano
797d1a4672 Merge branch 'nd/worktree-lock' into maint
Typofix.

* nd/worktree-lock:
  git-worktree.txt: fix typo "to"/"two", and add comma
2016-11-29 13:28:02 -08:00
Junio C Hamano
d92466ee25 Merge branch 'ps/common-info-doc' into maint
Doc fix.

* ps/common-info-doc:
  doc: fix location of 'info/' with $GIT_COMMON_DIR
2016-11-29 13:28:01 -08:00
Junio C Hamano
e3c4323e23 Merge branch 'rs/cocci' into maint
Improve the rule to convert "unsigned char [20]" into "struct
object_id *" in contrib/coccinelle/

* rs/cocci:
  cocci: avoid self-references in object_id transformations
2016-11-29 13:28:00 -08:00
Junio C Hamano
91207f3784 Merge branch 'nd/test-helpers' into maint
Update to the test framework made in 2.9 timeframe broke running
the tests under valgrind, which has been fixed.

* nd/test-helpers:
  valgrind: support test helpers
2016-11-29 13:28:00 -08:00
Junio C Hamano
6afadbd5ee Merge branch 'sc/fmt-merge-msg-doc-markup-fix' into maint
Documentation fix.

* sc/fmt-merge-msg-doc-markup-fix:
  Documentation/fmt-merge-msg: fix markup in example
2016-11-29 13:28:00 -08:00
Junio C Hamano
c8a3ec37ab Merge branch 'rs/commit-pptr-simplify' into maint
Code simplification.

* rs/commit-pptr-simplify:
  commit: simplify building parents list
2016-11-29 13:27:59 -08:00
Junio C Hamano
50b8276ab9 Merge branch 'jk/rebase-config-insn-fmt-docfix' into maint
Documentation fix.

* jk/rebase-config-insn-fmt-docfix:
  doc: fix missing "::" in config list
2016-11-29 13:27:58 -08:00