Skip to content

Commit 67809f7

Browse files
dschodscho
committed
Sync with 2.45.3
* maint-2.45: Git 2.45.3 Git 2.44.3 Git 2.43.6 Git 2.42.4 Git 2.41.3 Git 2.40.4 credential: disallow Carriage Returns in the protocol by default credential: sanitize the user prompt credential_format(): also encode <host>[:<port>] t7300: work around platform-specific behaviour with long paths on MinGW compat/regex: fix argument order to calloc(3) mingw: drop bogus (and unneeded) declaration of `_pgmptr` ci: remove 'Upload failed tests' directories' step from linux32 jobs
2 parents 4f71522 + fc16eb3 commit 67809f7

16 files changed

+157
-41
lines changed

‎Documentation/RelNotes/2.40.4.txt

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,5 @@
1+
Git v2.40.4 Release Notes
2+
=========================
3+
4+
This release lets Git refuse to accept URLs that contain control
5+
sequences. This addresses CVE-2024-50349 and CVE-2024-52006.

‎Documentation/RelNotes/2.41.3.txt

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,6 @@
1+
Git v2.41.3 Release Notes
2+
=========================
3+
4+
This release merges up the fix that appears in v2.40.4 to address
5+
the security issues CVE-2024-50349 and CVE-2024-52006; see the
6+
release notes for that version for details.

‎Documentation/RelNotes/2.42.4.txt

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,6 @@
1+
Git v2.42.4 Release Notes
2+
=========================
3+
4+
This release merges up the fix that appears in v2.40.4 and v2.41.3
5+
to address the security issues CVE-2024-50349 and CVE-2024-52006;
6+
see the release notes for these versions for details.

‎Documentation/RelNotes/2.43.6.txt

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,7 @@
1+
Git v2.43.6 Release Notes
2+
=========================
3+
4+
This release merges up the fix that appears in v2.40.4, v2.41.3
5+
and v2.42.4 to address the security issues CVE-2024-50349 and
6+
CVE-2024-52006; see the release notes for these versions for
7+
details.

‎Documentation/RelNotes/2.44.3.txt

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,7 @@
1+
Git v2.44.3 Release Notes
2+
=========================
3+
4+
This release merges up the fix that appears in v2.40.4, v2.41.3,
5+
v2.42.4 and v2.43.6 to address the security issues CVE-2024-50349
6+
and CVE-2024-52006; see the release notes for these versions
7+
for details.

‎Documentation/RelNotes/2.45.3.txt

Lines changed: 6 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,12 @@
11
Git v2.45.3 Release Notes
22
=========================
33

4-
This primarily is to backport various small fixes accumulated on the
4+
This release merges up the fix that appears in v2.40.4, v2.41.3,
5+
v2.42.4, v2.43.6 and v2.44.3 to address the security issues
6+
CVE-2024-50349 and CVE-2024-52006; see the release notes for
7+
these versions for details.
8+
9+
This version also backports various small fixes accumulated on the
510
'master' front during the development towards Git 2.46, the next
611
feature release.
712

‎Documentation/config/credential.txt

Lines changed: 11 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -14,6 +14,17 @@ credential.useHttpPath::
1414
or https URL to be important. Defaults to false. See
1515
linkgit:gitcredentials[7] for more information.
1616

17+
credential.sanitizePrompt::
18+
By default, user names and hosts that are shown as part of the
19+
password prompt are not allowed to contain control characters (they
20+
will be URL-encoded by default). Configure this setting to `false` to
21+
override that behavior.
22+
23+
credential.protectProtocol::
24+
By default, Carriage Return characters are not allowed in the protocol
25+
that is used when Git talks to a credential helper. This setting allows
26+
users to override this default.
27+
1728
credential.username::
1829
If no username is set for a network authentication, use this username
1930
by default. See credential.<context>.* below, and

‎credential.c

Lines changed: 32 additions & 19 deletions
Original file line numberDiff line numberDiff line change
@@ -10,7 +10,7 @@
1010
#include "sigchain.h"
1111
#include "strbuf.h"
1212
#include "urlmatch.h"
13-
#include "git-compat-util.h"
13+
#include "environment.h"
1414

1515
void credential_init(struct credential *c)
1616
{
@@ -125,6 +125,10 @@ static int credential_config_callback(const char *var, const char *value,
125125
}
126126
else if (!strcmp(key, "usehttppath"))
127127
c->use_http_path = git_config_bool(var, value);
128+
else if (!strcmp(key, "sanitizeprompt"))
129+
c->sanitize_prompt = git_config_bool(var, value);
130+
else if (!strcmp(key, "protectprotocol"))
131+
c->protect_protocol = git_config_bool(var, value);
128132

129133
return 0;
130134
}
@@ -222,7 +226,8 @@ static void credential_format(struct credential *c, struct strbuf *out)
222226
strbuf_addch(out, '@');
223227
}
224228
if (c->host)
225-
strbuf_addstr(out, c->host);
229+
strbuf_add_percentencode(out, c->host,
230+
STRBUF_ENCODE_HOST_AND_PORT);
226231
if (c->path) {
227232
strbuf_addch(out, '/');
228233
strbuf_add_percentencode(out, c->path, 0);
@@ -236,7 +241,10 @@ static char *credential_ask_one(const char *what, struct credential *c,
236241
struct strbuf prompt = STRBUF_INIT;
237242
char *r;
238243

239-
credential_describe(c, &desc);
244+
if (c->sanitize_prompt)
245+
credential_format(c, &desc);
246+
else
247+
credential_describe(c, &desc);
240248
if (desc.len)
241249
strbuf_addf(&prompt, "%s for '%s': ", what, desc.buf);
242250
else
@@ -355,7 +363,8 @@ int credential_read(struct credential *c, FILE *fp,
355363
return 0;
356364
}
357365

358-
static void credential_write_item(FILE *fp, const char *key, const char *value,
366+
static void credential_write_item(const struct credential *c,
367+
FILE *fp, const char *key, const char *value,
359368
int required)
360369
{
361370
if (!value && required)
@@ -364,41 +373,45 @@ static void credential_write_item(FILE *fp, const char *key, const char *value,
364373
return;
365374
if (strchr(value, '\n'))
366375
die("credential value for %s contains newline", key);
376+
if (c->protect_protocol && strchr(value, '\r'))
377+
die("credential value for %s contains carriage return\n"
378+
"If this is intended, set `credential.protectProtocol=false`",
379+
key);
367380
fprintf(fp, "%s=%s\n", key, value);
368381
}
369382

370383
void credential_write(const struct credential *c, FILE *fp,
371384
enum credential_op_type op_type)
372385
{
373386
if (credential_has_capability(&c->capa_authtype, op_type))
374-
credential_write_item(fp, "capability[]", "authtype", 0);
387+
credential_write_item(c, fp, "capability[]", "authtype", 0);
375388
if (credential_has_capability(&c->capa_state, op_type))
376-
credential_write_item(fp, "capability[]", "state", 0);
389+
credential_write_item(c, fp, "capability[]", "state", 0);
377390

378391
if (credential_has_capability(&c->capa_authtype, op_type)) {
379-
credential_write_item(fp, "authtype", c->authtype, 0);
380-
credential_write_item(fp, "credential", c->credential, 0);
392+
credential_write_item(c, fp, "authtype", c->authtype, 0);
393+
credential_write_item(c, fp, "credential", c->credential, 0);
381394
if (c->ephemeral)
382-
credential_write_item(fp, "ephemeral", "1", 0);
395+
credential_write_item(c, fp, "ephemeral", "1", 0);
383396
}
384-
credential_write_item(fp, "protocol", c->protocol, 1);
385-
credential_write_item(fp, "host", c->host, 1);
386-
credential_write_item(fp, "path", c->path, 0);
387-
credential_write_item(fp, "username", c->username, 0);
388-
credential_write_item(fp, "password", c->password, 0);
389-
credential_write_item(fp, "oauth_refresh_token", c->oauth_refresh_token, 0);
397+
credential_write_item(c, fp, "protocol", c->protocol, 1);
398+
credential_write_item(c, fp, "host", c->host, 1);
399+
credential_write_item(c, fp, "path", c->path, 0);
400+
credential_write_item(c, fp, "username", c->username, 0);
401+
credential_write_item(c, fp, "password", c->password, 0);
402+
credential_write_item(c, fp, "oauth_refresh_token", c->oauth_refresh_token, 0);
390403
if (c->password_expiry_utc != TIME_MAX) {
391404
char *s = xstrfmt("%"PRItime, c->password_expiry_utc);
392-
credential_write_item(fp, "password_expiry_utc", s, 0);
405+
credential_write_item(c, fp, "password_expiry_utc", s, 0);
393406
free(s);
394407
}
395408
for (size_t i = 0; i < c->wwwauth_headers.nr; i++)
396-
credential_write_item(fp, "wwwauth[]", c->wwwauth_headers.v[i], 0);
409+
credential_write_item(c, fp, "wwwauth[]", c->wwwauth_headers.v[i], 0);
397410
if (credential_has_capability(&c->capa_state, op_type)) {
398411
if (c->multistage)
399-
credential_write_item(fp, "continue", "1", 0);
412+
credential_write_item(c, fp, "continue", "1", 0);
400413
for (size_t i = 0; i < c->state_headers_to_send.nr; i++)
401-
credential_write_item(fp, "state[]", c->state_headers_to_send.v[i], 0);
414+
credential_write_item(c, fp, "state[]", c->state_headers_to_send.v[i], 0);
402415
}
403416
}
404417

‎credential.h

Lines changed: 5 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -168,7 +168,9 @@ struct credential {
168168
multistage: 1,
169169
quit:1,
170170
use_http_path:1,
171-
username_from_proto:1;
171+
username_from_proto:1,
172+
sanitize_prompt:1,
173+
protect_protocol:1;
172174

173175
struct credential_capability capa_authtype;
174176
struct credential_capability capa_state;
@@ -195,6 +197,8 @@ struct credential {
195197
.wwwauth_headers = STRVEC_INIT, \
196198
.state_headers = STRVEC_INIT, \
197199
.state_headers_to_send = STRVEC_INIT, \
200+
.sanitize_prompt = 1, \
201+
.protect_protocol = 1, \
198202
}
199203

200204
/* Initialize a credential structure, setting all fields to empty. */

‎strbuf.c

Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -495,7 +495,9 @@ void strbuf_add_percentencode(struct strbuf *dst, const char *src, int flags)
495495
unsigned char ch = src[i];
496496
if (ch <= 0x1F || ch >= 0x7F ||
497497
(ch == '/' && (flags & STRBUF_ENCODE_SLASH)) ||
498-
strchr(URL_UNSAFE_CHARS, ch))
498+
((flags & STRBUF_ENCODE_HOST_AND_PORT) ?
499+
!isalnum(ch) && !strchr("-.:[]", ch) :
500+
!!strchr(URL_UNSAFE_CHARS, ch)))
499501
strbuf_addf(dst, "%%%02X", (unsigned char)ch);
500502
else
501503
strbuf_addch(dst, ch);

‎strbuf.h

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -356,6 +356,7 @@ void strbuf_expand_bad_format(const char *format, const char *command);
356356
void strbuf_addbuf_percentquote(struct strbuf *dst, const struct strbuf *src);
357357

358358
#define STRBUF_ENCODE_SLASH 1
359+
#define STRBUF_ENCODE_HOST_AND_PORT 2
359360

360361
/**
361362
* Append the contents of a string to a strbuf, percent-encoding any characters

‎t/t0300-credentials.sh

Lines changed: 49 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -77,6 +77,10 @@ test_expect_success 'setup helper scripts' '
7777
test -z "$pexpiry" || echo password_expiry_utc=$pexpiry
7878
EOF
7979
80+
write_script git-credential-cntrl-in-username <<-\EOF &&
81+
printf "username=\\007latrix Lestrange\\n"
82+
EOF
83+
8084
PATH="$PWD:$PATH"
8185
'
8286

@@ -697,6 +701,19 @@ test_expect_success 'match percent-encoded values in username' '
697701
EOF
698702
'
699703

704+
test_expect_success 'match percent-encoded values in hostname' '
705+
test_config "credential.https://a%20b%20c/.helper" "$HELPER" &&
706+
check fill <<-\EOF
707+
url=https://a b c/
708+
--
709+
protocol=https
710+
host=a b c
711+
username=foo
712+
password=bar
713+
--
714+
EOF
715+
'
716+
700717
test_expect_success 'fetch with multiple path components' '
701718
test_unconfig credential.helper &&
702719
test_config credential.https://example.com/foo/repo.git.helper "verbatim foo bar" &&
@@ -886,6 +903,22 @@ test_expect_success 'url parser rejects embedded newlines' '
886903
test_cmp expect stderr
887904
'
888905

906+
test_expect_success 'url parser rejects embedded carriage returns' '
907+
test_config credential.helper "!true" &&
908+
test_must_fail git credential fill 2>stderr <<-\EOF &&
909+
url=https://example%0d.com/
910+
EOF
911+
cat >expect <<-\EOF &&
912+
fatal: credential value for host contains carriage return
913+
If this is intended, set `credential.protectProtocol=false`
914+
EOF
915+
test_cmp expect stderr &&
916+
GIT_ASKPASS=true \
917+
git -c credential.protectProtocol=false credential fill <<-\EOF
918+
url=https://example%0d.com/
919+
EOF
920+
'
921+
889922
test_expect_success 'host-less URLs are parsed as empty host' '
890923
check fill "verbatim foo bar" <<-\EOF
891924
url=cert:///path/to/cert.pem
@@ -995,4 +1028,20 @@ test_expect_success 'credential config with partial URLs' '
9951028
test_grep "skipping credential lookup for key" stderr
9961029
'
9971030

1031+
BEL="$(printf '\007')"
1032+
1033+
test_expect_success 'interactive prompt is sanitized' '
1034+
check fill cntrl-in-username <<-EOF
1035+
protocol=https
1036+
host=example.org
1037+
--
1038+
protocol=https
1039+
host=example.org
1040+
username=${BEL}latrix Lestrange
1041+
password=askpass-password
1042+
--
1043+
askpass: Password for ${SQ}https://%07latrix%[email protected]${SQ}:
1044+
EOF
1045+
'
1046+
9981047
test_done

‎t/t5541-http-push-smart.sh

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -343,7 +343,7 @@ test_expect_success 'push over smart http with auth' '
343343
git push "$HTTPD_URL"/auth/smart/test_repo.git &&
344344
git --git-dir="$HTTPD_DOCUMENT_ROOT_PATH/test_repo.git" \
345345
log -1 --format=%s >actual &&
346-
expect_askpass both user@host &&
346+
expect_askpass both user%40host &&
347347
test_cmp expect actual
348348
'
349349

@@ -355,7 +355,7 @@ test_expect_success 'push to auth-only-for-push repo' '
355355
git push "$HTTPD_URL"/auth-push/smart/test_repo.git &&
356356
git --git-dir="$HTTPD_DOCUMENT_ROOT_PATH/test_repo.git" \
357357
log -1 --format=%s >actual &&
358-
expect_askpass both user@host &&
358+
expect_askpass both user%40host &&
359359
test_cmp expect actual
360360
'
361361

@@ -385,7 +385,7 @@ test_expect_success 'push into half-auth-complete requires password' '
385385
git push "$HTTPD_URL/half-auth-complete/smart/half-auth.git" &&
386386
git --git-dir="$HTTPD_DOCUMENT_ROOT_PATH/half-auth.git" \
387387
log -1 --format=%s >actual &&
388-
expect_askpass both user@host &&
388+
expect_askpass both user%40host &&
389389
test_cmp expect actual
390390
'
391391

‎t/t5550-http-fetch-dumb.sh

Lines changed: 7 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -111,13 +111,13 @@ test_expect_success 'http auth can use user/pass in URL' '
111111
test_expect_success 'http auth can use just user in URL' '
112112
set_askpass wrong pass@host &&
113113
git clone "$HTTPD_URL_USER/auth/dumb/repo.git" clone-auth-pass &&
114-
expect_askpass pass user@host
114+
expect_askpass pass user%40host
115115
'
116116

117117
test_expect_success 'http auth can request both user and pass' '
118118
set_askpass user@host pass@host &&
119119
git clone "$HTTPD_URL/auth/dumb/repo.git" clone-auth-both &&
120-
expect_askpass both user@host
120+
expect_askpass both user%40host
121121
'
122122

123123
test_expect_success 'http auth respects credential helper config' '
@@ -135,14 +135,14 @@ test_expect_success 'http auth can get username from config' '
135135
test_config_global "credential.$HTTPD_URL.username" user@host &&
136136
set_askpass wrong pass@host &&
137137
git clone "$HTTPD_URL/auth/dumb/repo.git" clone-auth-user &&
138-
expect_askpass pass user@host
138+
expect_askpass pass user%40host
139139
'
140140

141141
test_expect_success 'configured username does not override URL' '
142142
test_config_global "credential.$HTTPD_URL.username" wrong &&
143143
set_askpass wrong pass@host &&
144144
git clone "$HTTPD_URL_USER/auth/dumb/repo.git" clone-auth-user2 &&
145-
expect_askpass pass user@host
145+
expect_askpass pass user%40host
146146
'
147147

148148
test_expect_success 'set up repo with http submodules' '
@@ -163,7 +163,7 @@ test_expect_success 'cmdline credential config passes to submodule via clone' '
163163
set_askpass wrong pass@host &&
164164
git -c "credential.$HTTPD_URL.username=user@host" \
165165
clone --recursive super super-clone &&
166-
expect_askpass pass user@host
166+
expect_askpass pass user%40host
167167
'
168168

169169
test_expect_success 'cmdline credential config passes submodule via fetch' '
@@ -174,7 +174,7 @@ test_expect_success 'cmdline credential config passes submodule via fetch' '
174174
git -C super-clone \
175175
-c "credential.$HTTPD_URL.username=user@host" \
176176
fetch --recurse-submodules &&
177-
expect_askpass pass user@host
177+
expect_askpass pass user%40host
178178
'
179179

180180
test_expect_success 'cmdline credential config passes submodule update' '
@@ -191,7 +191,7 @@ test_expect_success 'cmdline credential config passes submodule update' '
191191
git -C super-clone \
192192
-c "credential.$HTTPD_URL.username=user@host" \
193193
submodule update &&
194-
expect_askpass pass user@host
194+
expect_askpass pass user%40host
195195
'
196196

197197
test_expect_success 'fetch changes via http' '

0 commit comments

Comments
 (0)