3611f7467f
Fix a logic error in4950b2a2b5(for-each-repo: run subcommands on configured repos, 2020-09-11). Due to assuming that elements returned from the repo_config_get_value_multi() call wouldn't be "NULL" we'd conflate the <path> and <command> part of the argument list when running commands. As noted in the preceding commit the fix is to move to a safer "*_string_multi()" version of the *_multi() API. This change is separated from the rest because those all segfaulted. In this change we ended up with different behavior. When using the "--config=<config>" form we take each element of the list as a path to a repository. E.g. with a configuration like: [repo] list = /some/repo We would, with this command: git for-each-repo --config=repo.list status builtin Run a "git status" in /some/repo, as: git -C /some/repo status builtin I.e. ask "status" to report on the "builtin" directory. But since a configuration such as this would result in a "struct string_list *" with one element, whose "string" member is "NULL": [repo] list We would, when constructing our command-line in "builtin/for-each-repo.c"... strvec_pushl(&child.args, "-C", path, NULL); for (i = 0; i < argc; i++) strvec_push(&child.args, argv[i]); ...have that "path" be "NULL", and as strvec_pushl() stops when it sees NULL we'd end with the first "argv" element as the argument to the "-C" option, e.g.: git -C status builtin I.e. we'd run the command "builtin" in the "status" directory. In another context this might be an interesting security vulnerability, but I think that this amounts to a nothingburger on that front. A hypothetical attacker would need to be able to write config for the victim to run, if they're able to do that there's more interesting attack vectors. See the "safe.directory" facility added in8d1a744820(setup.c: create `safe.bareRepository`, 2022-07-14). An even more unlikely possibility would be an attacker able to generate the config used for "for-each-repo --config=<key>", but nothing else (e.g. an automated system producing that list). Even in that case the attack vector is limited to the user running commands whose name matches a directory that's interesting to the attacker (e.g. a "log" directory in a repository). The second argument (if any) of the command is likely to make git die without doing anything interesting (e.g. "-p" to "log", there being no "-p" built-in command to run). Signed-off-by: Ævar Arnfjörð Bjarmason <avarab@gmail.com> Signed-off-by: Junio C Hamano <gitster@pobox.com>
61 lines
1.5 KiB
C
61 lines
1.5 KiB
C
#include "cache.h"
|
|
#include "config.h"
|
|
#include "builtin.h"
|
|
#include "parse-options.h"
|
|
#include "run-command.h"
|
|
#include "string-list.h"
|
|
|
|
static const char * const for_each_repo_usage[] = {
|
|
N_("git for-each-repo --config=<config> [--] <arguments>"),
|
|
NULL
|
|
};
|
|
|
|
static int run_command_on_repo(const char *path, int argc, const char ** argv)
|
|
{
|
|
int i;
|
|
struct child_process child = CHILD_PROCESS_INIT;
|
|
char *abspath = interpolate_path(path, 0);
|
|
|
|
child.git_cmd = 1;
|
|
strvec_pushl(&child.args, "-C", abspath, NULL);
|
|
|
|
for (i = 0; i < argc; i++)
|
|
strvec_push(&child.args, argv[i]);
|
|
|
|
free(abspath);
|
|
|
|
return run_command(&child);
|
|
}
|
|
|
|
int cmd_for_each_repo(int argc, const char **argv, const char *prefix)
|
|
{
|
|
static const char *config_key = NULL;
|
|
int i, result = 0;
|
|
const struct string_list *values;
|
|
int err;
|
|
|
|
const struct option options[] = {
|
|
OPT_STRING(0, "config", &config_key, N_("config"),
|
|
N_("config key storing a list of repository paths")),
|
|
OPT_END()
|
|
};
|
|
|
|
argc = parse_options(argc, argv, prefix, options, for_each_repo_usage,
|
|
PARSE_OPT_STOP_AT_NON_OPTION);
|
|
|
|
if (!config_key)
|
|
die(_("missing --config=<config>"));
|
|
|
|
err = repo_config_get_string_multi(the_repository, config_key, &values);
|
|
if (err < 0)
|
|
usage_msg_optf(_("got bad config --config=%s"),
|
|
for_each_repo_usage, options, config_key);
|
|
else if (err)
|
|
return 0;
|
|
|
|
for (i = 0; !result && i < values->nr; i++)
|
|
result = run_command_on_repo(values->items[i].string, argc, argv);
|
|
|
|
return result;
|
|
}
|