From 4a2790a257b314ab59f6f2e25f3d7ca120219922 Mon Sep 17 00:00:00 2001 From: Elijah Newren Date: Mon, 25 Nov 2024 19:00:48 +0000 Subject: [PATCH 1/3] fast-import: disallow "." and ".." path components If a user specified e.g. M 100644 :1 ../some-file then fast-import previously would happily create a git history where there is a tree in the top-level directory named "..", and with a file inside that directory named "some-file". The top-level ".." directory causes problems. While git checkout will die with errors and fsck will report hasDotdot problems, the user is going to have problems trying to remove the problematic file. Simply avoid creating this bad history in the first place. Signed-off-by: Elijah Newren Signed-off-by: Junio C Hamano --- builtin/fast-import.c | 2 ++ t/t9300-fast-import.sh | 20 ++++++++++++++++++++ 2 files changed, 22 insertions(+) diff --git a/builtin/fast-import.c b/builtin/fast-import.c index 1e7ab67f6e..3e7ec1f119 100644 --- a/builtin/fast-import.c +++ b/builtin/fast-import.c @@ -1468,6 +1468,8 @@ static int tree_content_set( root->tree = t = grow_tree_content(t, t->entry_count); e = new_tree_entry(); e->name = to_atom(p, n); + if (is_dot_or_dotdot(e->name->str_dat)) + die("path %s contains invalid component", p); e->versions[0].mode = 0; oidclr(&e->versions[0].oid, the_repository->hash_algo); t->entries[t->entry_count++] = e; diff --git a/t/t9300-fast-import.sh b/t/t9300-fast-import.sh index 3b3c371740..5a5127fffa 100755 --- a/t/t9300-fast-import.sh +++ b/t/t9300-fast-import.sh @@ -522,6 +522,26 @@ test_expect_success 'B: fail on invalid committer (5)' ' test_must_fail git fast-import input <<-INPUT_END && + blob + mark :1 + data < $GIT_COMMITTER_DATE + data < Date: Sat, 30 Nov 2024 01:09:29 +0000 Subject: [PATCH 2/3] fast-import: disallow more path components Instead of just disallowing '.' and '..', make use of verify_path() to ensure that fast-import will disallow anything we wouldn't allow into the index, such as anything under .git/, .gitmodules as a symlink, or a dos drive prefix on Windows. Since a few fast-export and fast-import tests that tried to stress-test the correct handling of quoting relied on filenames that fail is_valid_win32_path(), such as spaces or periods at the end of filenames or backslashes within the filename, turn off core.protectNTFS for those tests to ensure they keep passing. Helped-by: Jeff King Signed-off-by: Elijah Newren Signed-off-by: Junio C Hamano --- builtin/fast-import.c | 8 +++- t/t9300-fast-import.sh | 88 ++++++++++++++++++++++++++++++++++++++++-- t/t9350-fast-export.sh | 2 +- 3 files changed, 91 insertions(+), 7 deletions(-) diff --git a/builtin/fast-import.c b/builtin/fast-import.c index 3e7ec1f119..265d1b7d52 100644 --- a/builtin/fast-import.c +++ b/builtin/fast-import.c @@ -13,6 +13,7 @@ #include "delta.h" #include "pack.h" #include "path.h" +#include "read-cache-ll.h" #include "refs.h" #include "csum-file.h" #include "quote.h" @@ -1468,8 +1469,6 @@ static int tree_content_set( root->tree = t = grow_tree_content(t, t->entry_count); e = new_tree_entry(); e->name = to_atom(p, n); - if (is_dot_or_dotdot(e->name->str_dat)) - die("path %s contains invalid component", p); e->versions[0].mode = 0; oidclr(&e->versions[0].oid, the_repository->hash_algo); t->entries[t->entry_count++] = e; @@ -2416,6 +2415,9 @@ static void file_change_m(const char *p, struct branch *b) tree_content_replace(&b->branch_tree, &oid, mode, NULL); return; } + + if (!verify_path(path.buf, mode)) + die("invalid path '%s'", path.buf); tree_content_set(&b->branch_tree, path.buf, &oid, mode, NULL); } @@ -2453,6 +2455,8 @@ static void file_change_cr(const char *p, struct branch *b, int rename) leaf.tree); return; } + if (!verify_path(dest.buf, leaf.versions[1].mode)) + die("invalid path '%s'", dest.buf); tree_content_set(&b->branch_tree, dest.buf, &leaf.versions[1].oid, leaf.versions[1].mode, diff --git a/t/t9300-fast-import.sh b/t/t9300-fast-import.sh index 5a5127fffa..e2b1db6bc2 100755 --- a/t/t9300-fast-import.sh +++ b/t/t9300-fast-import.sh @@ -522,7 +522,7 @@ test_expect_success 'B: fail on invalid committer (5)' ' test_must_fail git fast-import input <<-INPUT_END && blob mark :1 @@ -542,6 +542,86 @@ test_expect_success 'B: fail on invalid file path' ' test_must_fail git fast-import input <<-INPUT_END && + blob + mark :1 + data < $GIT_COMMITTER_DATE + data <input <<-INPUT_END && + blob + mark :1 + data < $GIT_COMMITTER_DATE + data <input <<-INPUT_END && + blob + mark :1 + data < $GIT_COMMITTER_DATE + data <input <<-INPUT_END && + blob + mark :1 + data < $GIT_COMMITTER_DATE + data <output && cut -d" " -f1,2,5 output >actual && test_cmp expect actual @@ -3117,7 +3197,7 @@ test_path_eol_success () { test_expect_success "S: paths at EOL with $test must work" ' test_when_finished "git branch -D S-path-eol" && - git fast-import --export-marks=marks.out <<-EOF >out 2>err && + git -c core.protectNTFS=false fast-import --export-marks=marks.out <<-EOF >out 2>err && blob mark :401 data <err && + git -c core.protectNTFS=false fast-import --export-marks=marks.out <<-EOF 2>err && blob mark :401 data <expect && git init result && cd result && - git fast-import <../export.out && + git -c core.protectNTFS=false fast-import <../export.out && git rev-list HEAD >actual && test_cmp ../expect actual ) From 8cb4c6e62f28ac9d9a04daf794ff6dbddf55e416 Mon Sep 17 00:00:00 2001 From: Jeff King Date: Tue, 3 Dec 2024 16:06:52 -0500 Subject: [PATCH 3/3] t9300: test verification of renamed paths Commit da91a90c2f (fast-import: disallow more path components, 2024-11-30) added two separate verify_path() calls (one for added/modified files, and one for renames/copies). But our tests only exercise the first one. Let's protect ourselves against regressions by tweaking one of the tests to rename into the bad path. There are adjacent tests that will stay as additions, so now both calls are covered. Signed-off-by: Jeff King Signed-off-by: Junio C Hamano --- t/t9300-fast-import.sh | 11 +++++++++-- 1 file changed, 9 insertions(+), 2 deletions(-) diff --git a/t/t9300-fast-import.sh b/t/t9300-fast-import.sh index e2b1db6bc2..fd01a2353c 100755 --- a/t/t9300-fast-import.sh +++ b/t/t9300-fast-import.sh @@ -553,9 +553,16 @@ test_expect_success 'B: fail on invalid file path of .' ' commit refs/heads/badpath committer Name $GIT_COMMITTER_DATE data < $GIT_COMMITTER_DATE + data <