Merge branch 'jk/ssh-funny-url' into maint-2.7

diff --git a/cache.h b/cache.h
index 1a2cec0b888228d4ac58aa23e68f531db45b515e..b9fc3a8e33f657db8869ca512da177f6fc6859c9 100644 (file)
--- a/cache.h
+++ b/cache.h
@@ -991,6 +991,14 @@ char *strip_path_suffix(const char *path, const char *suffix);
 int daemon_avoid_alias(const char *path);
 extern int is_ntfs_dotgit(const char *name);
 
+/*
+ * Returns true iff "str" could be confused as a command-line option when
+ * passed to a sub-program like "ssh". Note that this has nothing to do with
+ * shell-quoting, which should be handled separately; we're assuming here that
+ * the string makes it verbatim to the sub-program.
+ */
+int looks_like_command_line_option(const char *str);
+
 /**
  * Return a newly allocated string with the evaluation of
  * "$XDG_CONFIG_HOME/git/$filename" if $XDG_CONFIG_HOME is non-empty, otherwise

diff --git a/connect.c b/connect.c
index fd7ffe1840e64417cf94d208840cf97c91e962b7..d77d39771b6c5101abe14df1e078af2a02ce8ace 100644 (file)
--- a/connect.c
+++ b/connect.c
@@ -553,6 +553,11 @@ static struct child_process *git_proxy_connect(int fd[2], char *host)
 
        get_host_and_port(&host, &port);
 
+       if (looks_like_command_line_option(host))
+               die("strange hostname '%s' blocked", host);
+       if (looks_like_command_line_option(port))
+               die("strange port '%s' blocked", port);
+
        proxy = xmalloc(sizeof(*proxy));
        child_process_init(proxy);
        argv_array_push(&proxy->args, git_proxy_command);
@@ -722,6 +727,9 @@ struct child_process *git_connect(int fd[2], const char *url,
                conn = xmalloc(sizeof(*conn));
                child_process_init(conn);
 
+               if (looks_like_command_line_option(path))
+                       die("strange pathname '%s' blocked", path);
+
                strbuf_addstr(&cmd, prog);
                strbuf_addch(&cmd, ' ');
                sq_quote_buf(&cmd, path);
@@ -754,6 +762,9 @@ struct child_process *git_connect(int fd[2], const char *url,
                                return NULL;
                        }
 
+                       if (looks_like_command_line_option(ssh_host))
+                               die("strange hostname '%s' blocked", ssh_host);
+
                        ssh = getenv("GIT_SSH_COMMAND");
                        if (!ssh) {
                                const char *base;

diff --git a/path.c b/path.c
index 8b7e16812927645367c4912e88d2a5f3065efb85..b214ac3fe63d4aa7cd134f4e819f48c54936977a 100644 (file)
--- a/path.c
+++ b/path.c
@@ -1178,6 +1178,11 @@ int is_ntfs_dotgit(const char *name)
                }
 }
 
+int looks_like_command_line_option(const char *str)
+{
+       return str && str[0] == '-';
+}
+
 char *xdg_config_home(const char *filename)
 {
        const char *home, *config_home;

diff --git a/t/t5532-fetch-proxy.sh b/t/t5532-fetch-proxy.sh
index 5531bd1af42dac808d64d75a6fc3e848ef968a34..d3b2651b6114e6db50464d25d2b6dc6fa700c903 100755 (executable)
--- a/t/t5532-fetch-proxy.sh
+++ b/t/t5532-fetch-proxy.sh
@@ -40,4 +40,9 @@ test_expect_success 'fetch through proxy works' '
        test_cmp expect actual
 '
 
+test_expect_success 'funny hostnames are rejected before running proxy' '
+       test_must_fail git fetch git://-remote/repo.git 2>stderr &&
+       ! grep "proxying for" stderr
+'
+
 test_done

diff --git a/t/t5810-proto-disable-local.sh b/t/t5810-proto-disable-local.sh
index 563592d8a8a5f6fec7da160f292b2f8b8824327e..c1ef99b85c293e8a8bfc0872e3511fe8b7029213 100755 (executable)
--- a/t/t5810-proto-disable-local.sh
+++ b/t/t5810-proto-disable-local.sh
@@ -11,4 +11,27 @@ test_expect_success 'setup repository to clone' '
 test_proto "file://" file "file://$PWD"
 test_proto "path" file .
 
+test_expect_success 'setup repo with dash' '
+       git init --bare repo.git &&
+       git push repo.git HEAD &&
+       mv repo.git "$PWD/-repo.git"
+'
+
+# This will fail even without our rejection because upload-pack will
+# complain about the bogus option. So let's make sure that GIT_TRACE
+# doesn't show us even running upload-pack.
+#
+# We must also be sure to use "fetch" and not "clone" here, as the latter
+# actually canonicalizes our input into an absolute path (which is fine
+# to allow).
+test_expect_success 'repo names starting with dash are rejected' '
+       rm -f trace.out &&
+       test_must_fail env GIT_TRACE="$PWD/trace.out" git fetch -- -repo.git &&
+       ! grep upload-pack trace.out
+'
+
+test_expect_success 'full paths still work' '
+       git fetch "$PWD/-repo.git"
+'
+
 test_done

diff --git a/t/t5813-proto-disable-ssh.sh b/t/t5813-proto-disable-ssh.sh
index a954ead8af882002d3e8bbb6dad8c52190f794c7..3f084ee306517b2bc991365f6f15b76627e1d125 100755 (executable)
--- a/t/t5813-proto-disable-ssh.sh
+++ b/t/t5813-proto-disable-ssh.sh
@@ -17,4 +17,27 @@ test_proto "host:path" ssh "remote:repo.git"
 test_proto "ssh://" ssh "ssh://remote$PWD/remote/repo.git"
 test_proto "git+ssh://" ssh "git+ssh://remote$PWD/remote/repo.git"
 
+# Don't even bother setting up a "-remote" directory, as ssh would generally
+# complain about the bogus option rather than completing our request. Our
+# fake wrapper actually _can_ handle this case, but it's more robust to
+# simply confirm from its output that it did not run at all.
+test_expect_success 'hostnames starting with dash are rejected' '
+       test_must_fail git clone ssh://-remote/repo.git dash-host 2>stderr &&
+       ! grep ^ssh: stderr
+'
+
+test_expect_success 'setup repo with dash' '
+       git init --bare remote/-repo.git &&
+       git push remote/-repo.git HEAD
+'
+
+test_expect_success 'repo names starting with dash are rejected' '
+       test_must_fail git clone remote:-repo.git dash-path 2>stderr &&
+       ! grep ^ssh: stderr
+'
+
+test_expect_success 'full paths still work' '
+       git clone "remote:$PWD/remote/-repo.git" dash-path
+'
+
 test_done