git-commit-vandalism/compat
Johannes Schindelin d2c84dad1c mingw: refuse to access paths with trailing spaces or periods
When creating a directory on Windows whose path ends in a space or a
period (or chains thereof), the Win32 API "helpfully" trims those. For
example, `mkdir("abc ");` will return success, but actually create a
directory called `abc` instead.

This stems back to the DOS days, when all file names had exactly 8
characters plus exactly 3 characters for the file extension, and the
only way to have shorter names was by padding with spaces.

Sadly, this "helpful" behavior is a bit inconsistent: after a successful
`mkdir("abc ");`, a `mkdir("abc /def")` will actually _fail_ (because
the directory `abc ` does not actually exist).

Even if it would work, we now have a serious problem because a Git
repository could contain directories `abc` and `abc `, and on Windows,
they would be "merged" unintentionally.

As these paths are illegal on Windows, anyway, let's disallow any
accesses to such paths on that Operating System.

For practical reasons, this behavior is still guarded by the
config setting `core.protectNTFS`: it is possible (and at least two
regression tests make use of it) to create commits without involving the
worktree. In such a scenario, it is of course possible -- even on
Windows -- to create such file names.

Among other consequences, this patch disallows submodules' paths to end
in spaces on Windows (which would formerly have confused Git enough to
try to write into incorrect paths, anyway).

While this patch does not fix a vulnerability on its own, it prevents an
attack vector that was exploited in demonstrations of a number of
recently-fixed security bugs.

The regression test added to `t/t7417-submodule-path-url.sh` reflects
that attack vector.

Note that we have to adjust the test case "prevent git~1 squatting on
Windows" in `t/t7415-submodule-names.sh` because of a very subtle issue.
It tries to clone two submodules whose names differ only in a trailing
period character, and as a consequence their git directories differ in
the same way. Previously, when Git tried to clone the second submodule,
it thought that the git directory already existed (because on Windows,
when you create a directory with the name `b.` it actually creates `b`),
but with this patch, the first submodule's clone will fail because of
the illegal name of the git directory. Therefore, when cloning the
second submodule, Git will take a different code path: a fresh clone
(without an existing git directory). Both code paths fail to clone the
second submodule, both because the the corresponding worktree directory
exists and is not empty, but the error messages are worded differently.

Signed-off-by: Johannes Schindelin <johannes.schindelin@gmx.de>
2019-12-05 15:37:06 +01:00
..
nedmalloc compat: move strdup(3) replacement to its own file 2016-09-07 10:41:45 -07:00
poll poll.c: always set revents, even if to zero 2017-09-29 18:33:22 +09:00
regex Spelling fixes 2017-06-27 10:35:49 -07:00
vcbuild MSVC: use shipped headers instead of fallback definitions 2016-03-30 11:16:20 -07:00
win32 win32: plug memory leak on realloc() failure in syslog() 2017-08-10 13:57:52 -07:00
apple-common-crypto.h imap-send: use HMAC() function provided by OpenSSL 2016-04-08 11:45:47 -07:00
basename.c compat/basename.c: provide a dirname() compatibility function 2016-01-12 10:40:54 -08:00
bswap.h bswap: convert get_be16, get_be32 and put_be32 to inline functions 2017-07-17 14:54:15 -07:00
cygwin.c cygwin: allow pushing to UNC paths 2017-07-05 14:01:03 -07:00
cygwin.h cygwin: allow pushing to UNC paths 2017-07-05 14:01:03 -07:00
fopen.c git_fopen: fix a sparse 'not declared' warning 2017-05-26 12:33:55 +09:00
gmtime.c date: recognize bogus FreeBSD gmtime output 2014-04-01 14:39:04 -07:00
hstrerror.c compat/hstrerror: convert sprintf to snprintf 2015-09-25 10:18:18 -07:00
inet_ntop.c compat/inet_ntop: fix off-by-one in inet_ntop4 2015-09-25 10:18:18 -07:00
inet_pton.c Drop system includes from inet_pton/inet_ntop compatibility wrappers 2012-02-05 16:32:33 -08:00
memmem.c
mingw.c mingw: refuse to access paths with trailing spaces or periods 2019-12-05 15:37:06 +01:00
mingw.h mingw: refuse to access paths with trailing spaces or periods 2019-12-05 15:37:06 +01:00
mkdir.c compat: some mkdir() do not like a slash at the end 2012-08-24 09:48:51 -07:00
mkdtemp.c
mmap.c wrapper.c: add xpread() similar to xread() 2014-04-10 12:18:55 -07:00
msvc.c win32: use our own dirent.h 2010-11-23 16:06:50 -08:00
msvc.h MSVC: fix stat definition hell 2013-09-11 11:08:52 -07:00
obstack.c obstack.c: Fix some sparse warnings 2011-09-11 14:43:33 -07:00
obstack.h obstack: fix spelling of similar 2013-04-12 12:23:20 -07:00
pread.c
precompose_utf8.c config: don't include config.h by default 2017-06-15 12:56:22 -07:00
precompose_utf8.h probe_utf8_pathname_composition: use internal strbuf 2015-10-05 11:06:49 -07:00
qsort_s.c compat: add qsort_s() 2017-01-23 11:02:34 -08:00
qsort.c use st_add and st_mult for allocation size computation 2016-02-22 14:51:09 -08:00
setenv.c use st_add and st_mult for allocation size computation 2016-02-22 14:51:09 -08:00
sha1-chunked.c sha1: allow limiting the size of the data passed to SHA1_Update() 2015-11-05 10:35:11 -08:00
sha1-chunked.h sha1: allow limiting the size of the data passed to SHA1_Update() 2015-11-05 10:35:11 -08:00
snprintf.c MSVC: vsnprintf in Visual Studio 2015 doesn't need SNPRINTF_SIZE_CORR any more 2016-03-30 11:13:01 -07:00
stat.c compat: convert modes to use portable file type values 2014-12-04 11:58:36 -08:00
strcasestr.c
strdup.c compat: move strdup(3) replacement to its own file 2016-09-07 10:41:45 -07:00
strlcpy.c
strtoimax.c Add strtoimax() compatibility function. 2011-11-02 13:06:30 -07:00
strtoumax.c
terminal.c strbuf: introduce strbuf_getline_{lf,nul}() 2016-01-15 10:12:51 -08:00
terminal.h add generic terminal prompt function 2011-12-12 16:09:38 -08:00
unsetenv.c Revert "compat/unsetenv.c: Fix a sparse warning" 2013-07-21 15:09:56 -07:00
win32.h mingw: rename WIN32 cpp macro to GIT_WINDOWS_NATIVE 2013-05-08 12:14:35 -07:00
win32mmap.c mmap(win32): avoid expensive fstat() call 2016-04-22 15:01:16 -07:00
winansi.c winansi: avoid buffer overrun 2017-05-08 12:18:19 +09:00