Skip to content

Commit 44f87da

Browse files
gitstergitster
committed
Sync with 2.17.2
* maint-2.17: Git 2.17.2 fsck: detect submodule paths starting with dash fsck: detect submodule urls starting with dash Git 2.16.5 Git 2.15.3 Git 2.14.5 submodule-config: ban submodule paths that start with a dash submodule-config: ban submodule urls that start with dash submodule--helper: use "--" to signal end of clone options
2 parents 53f9a3e + 6e9e91e commit 44f87da

File tree

9 files changed

+142
-0
lines changed

9 files changed

+142
-0
lines changed

‎Documentation/RelNotes/2.14.5.txt

Lines changed: 16 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,16 @@
1+
Git v2.14.5 Release Notes
2+
=========================
3+
4+
This release is to address the recently reported CVE-2018-17456.
5+
6+
Fixes since v2.14.4
7+
-------------------
8+
9+
* Submodules' "URL"s come from the untrusted .gitmodules file, but
10+
we blindly gave it to "git clone" to clone submodules when "git
11+
clone --recurse-submodules" was used to clone a project that has
12+
such a submodule. The code has been hardened to reject such
13+
malformed URLs (e.g. one that begins with a dash).
14+
15+
Credit for finding and fixing this vulnerability goes to joernchen
16+
and Jeff King, respectively.

‎Documentation/RelNotes/2.15.3.txt

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,6 @@
1+
Git v2.15.3 Release Notes
2+
=========================
3+
4+
This release merges up the fixes that appear in v2.14.5 to address
5+
the recently reported CVE-2018-17456; see the release notes for that
6+
version for details.

‎Documentation/RelNotes/2.16.5.txt

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,6 @@
1+
Git v2.16.5 Release Notes
2+
=========================
3+
4+
This release merges up the fixes that appear in v2.14.5 to address
5+
the recently reported CVE-2018-17456; see the release notes for that
6+
version for details.

‎Documentation/RelNotes/2.17.2.txt

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,12 @@
1+
Git v2.17.2 Release Notes
2+
=========================
3+
4+
This release merges up the fixes that appear in v2.14.5 to address
5+
the recently reported CVE-2018-17456; see the release notes for that
6+
version for details.
7+
8+
In addition, this release also teaches "fsck" and the server side
9+
logic to reject pushes to repositories that attempt to create such a
10+
problematic ".gitmodules" file as tracked contents, to help hosting
11+
sites protect their customers by preventing malicious contents from
12+
spreading.

‎builtin/submodule--helper.c

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1090,6 +1090,7 @@ static int clone_submodule(const char *path, const char *gitdir, const char *url
10901090
if (gitdir && *gitdir)
10911091
argv_array_pushl(&cp.args, "--separate-git-dir", gitdir, NULL);
10921092

1093+
argv_array_push(&cp.args, "--");
10931094
argv_array_push(&cp.args, url);
10941095
argv_array_push(&cp.args, path);
10951096

‎fsck.c

Lines changed: 14 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -64,6 +64,8 @@ static struct oidset gitmodules_done = OIDSET_INIT;
6464
FUNC(GITMODULES_PARSE, ERROR) \
6565
FUNC(GITMODULES_NAME, ERROR) \
6666
FUNC(GITMODULES_SYMLINK, ERROR) \
67+
FUNC(GITMODULES_URL, ERROR) \
68+
FUNC(GITMODULES_PATH, ERROR) \
6769
/* warnings */ \
6870
FUNC(BAD_FILEMODE, WARN) \
6971
FUNC(EMPTY_NAME, WARN) \
@@ -949,6 +951,18 @@ static int fsck_gitmodules_fn(const char *var, const char *value, void *vdata)
949951
FSCK_MSG_GITMODULES_NAME,
950952
"disallowed submodule name: %s",
951953
name);
954+
if (!strcmp(key, "url") && value &&
955+
looks_like_command_line_option(value))
956+
data->ret |= report(data->options, data->obj,
957+
FSCK_MSG_GITMODULES_URL,
958+
"disallowed submodule url: %s",
959+
value);
960+
if (!strcmp(key, "path") && value &&
961+
looks_like_command_line_option(value))
962+
data->ret |= report(data->options, data->obj,
963+
FSCK_MSG_GITMODULES_PATH,
964+
"disallowed submodule path: %s",
965+
value);
952966
free(name);
953967

954968
return 0;

‎submodule-config.c

Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -383,6 +383,12 @@ static void warn_multiple_config(const struct object_id *treeish_name,
383383
commit_string, name, option);
384384
}
385385

386+
static void warn_command_line_option(const char *var, const char *value)
387+
{
388+
warning(_("ignoring '%s' which may be interpreted as"
389+
" a command-line option: %s"), var, value);
390+
}
391+
386392
struct parse_config_parameter {
387393
struct submodule_cache *cache;
388394
const struct object_id *treeish_name;
@@ -408,6 +414,8 @@ static int parse_config(const char *var, const char *value, void *data)
408414
if (!strcmp(item.buf, "path")) {
409415
if (!value)
410416
ret = config_error_nonbool(var);
417+
else if (looks_like_command_line_option(value))
418+
warn_command_line_option(var, value);
411419
else if (!me->overwrite && submodule->path)
412420
warn_multiple_config(me->treeish_name, submodule->name,
413421
"path");
@@ -448,6 +456,8 @@ static int parse_config(const char *var, const char *value, void *data)
448456
} else if (!strcmp(item.buf, "url")) {
449457
if (!value) {
450458
ret = config_error_nonbool(var);
459+
} else if (looks_like_command_line_option(value)) {
460+
warn_command_line_option(var, value);
451461
} else if (!me->overwrite && submodule->url) {
452462
warn_multiple_config(me->treeish_name, submodule->name,
453463
"url");

‎t/t7416-submodule-dash-url.sh

Lines changed: 49 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,49 @@
1+
#!/bin/sh
2+
3+
test_description='check handling of .gitmodule url with dash'
4+
. ./test-lib.sh
5+
6+
test_expect_success 'create submodule with protected dash in url' '
7+
git init upstream &&
8+
git -C upstream commit --allow-empty -m base &&
9+
mv upstream ./-upstream &&
10+
git submodule add ./-upstream sub &&
11+
git add sub .gitmodules &&
12+
git commit -m submodule
13+
'
14+
15+
test_expect_success 'clone can recurse submodule' '
16+
test_when_finished "rm -rf dst" &&
17+
git clone --recurse-submodules . dst &&
18+
echo base >expect &&
19+
git -C dst/sub log -1 --format=%s >actual &&
20+
test_cmp expect actual
21+
'
22+
23+
test_expect_success 'fsck accepts protected dash' '
24+
test_when_finished "rm -rf dst" &&
25+
git init --bare dst &&
26+
git -C dst config transfer.fsckObjects true &&
27+
git push dst HEAD
28+
'
29+
30+
test_expect_success 'remove ./ protection from .gitmodules url' '
31+
perl -i -pe "s{\./}{}" .gitmodules &&
32+
git commit -am "drop protection"
33+
'
34+
35+
test_expect_success 'clone rejects unprotected dash' '
36+
test_when_finished "rm -rf dst" &&
37+
test_must_fail git clone --recurse-submodules . dst 2>err &&
38+
test_i18ngrep ignoring err
39+
'
40+
41+
test_expect_success 'fsck rejects unprotected dash' '
42+
test_when_finished "rm -rf dst" &&
43+
git init --bare dst &&
44+
git -C dst config transfer.fsckObjects true &&
45+
test_must_fail git push dst HEAD 2>err &&
46+
grep gitmodulesUrl err
47+
'
48+
49+
test_done

‎t/t7417-submodule-path-url.sh

Lines changed: 28 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,28 @@
1+
#!/bin/sh
2+
3+
test_description='check handling of .gitmodule path with dash'
4+
. ./test-lib.sh
5+
6+
test_expect_success 'create submodule with dash in path' '
7+
git init upstream &&
8+
git -C upstream commit --allow-empty -m base &&
9+
git submodule add ./upstream sub &&
10+
git mv sub ./-sub &&
11+
git commit -m submodule
12+
'
13+
14+
test_expect_success 'clone rejects unprotected dash' '
15+
test_when_finished "rm -rf dst" &&
16+
git clone --recurse-submodules . dst 2>err &&
17+
test_i18ngrep ignoring err
18+
'
19+
20+
test_expect_success 'fsck rejects unprotected dash' '
21+
test_when_finished "rm -rf dst" &&
22+
git init --bare dst &&
23+
git -C dst config transfer.fsckObjects true &&
24+
test_must_fail git push dst HEAD 2>err &&
25+
grep gitmodulesPath err
26+
'
27+
28+
test_done

0 commit comments

Comments
 (0)