submodule: allow only certain protocols for submodule fetches

diff --git a/git-submodule.sh b/git-submodule.sh
index 9245abfd4263881bdd6d0f21f648b46201b52a2d..78c2740fdb2beb48fd98c656f8ab13955cfdad56 100755 (executable)
--- a/git-submodule.sh
+++ b/git-submodule.sh
@@ -22,6 +22,15 @@ require_work_tree
 wt_prefix=$(git rev-parse --show-prefix)
 cd_to_toplevel
 
+# Restrict ourselves to a vanilla subset of protocols; the URLs
+# we get are under control of a remote repository, and we do not
+# want them kicking off arbitrary git-remote-* programs.
+#
+# If the user has already specified a set of allowed protocols,
+# we assume they know what they're doing and use that instead.
+: ${GIT_ALLOW_PROTOCOL=file:git:http:https:ssh}
+export GIT_ALLOW_PROTOCOL
+
 command=
 branch=
 force=
@@ -423,7 +432,7 @@ cmd_add()
                sed -e '
                        s|//*|/|g
                        s|^\(\./\)*||
-                       s|/\./|/|g
+                       s|/\(\./\)*|/|g
                        :start
                        s|\([^/]*\)/\.\./||
                        tstart