Skip to content

Commit f84b9b0

Browse files
gitstergitster
committed
Sync with 2.19.1
* maint: Git 2.19.1 Git 2.18.1 Git 2.17.2 fsck: detect submodule paths starting with dash fsck: detect submodule urls starting with dash Git 2.16.5 Git 2.15.3 Git 2.14.5 submodule-config: ban submodule paths that start with a dash submodule-config: ban submodule urls that start with dash submodule--helper: use "--" to signal end of clone options
2 parents fe8321e + cae598d commit f84b9b0

File tree

11 files changed

+154
-0
lines changed

11 files changed

+154
-0
lines changed

‎Documentation/RelNotes/2.14.5.txt

Lines changed: 16 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,16 @@
1+
Git v2.14.5 Release Notes
2+
=========================
3+
4+
This release is to address the recently reported CVE-2018-17456.
5+
6+
Fixes since v2.14.4
7+
-------------------
8+
9+
* Submodules' "URL"s come from the untrusted .gitmodules file, but
10+
we blindly gave it to "git clone" to clone submodules when "git
11+
clone --recurse-submodules" was used to clone a project that has
12+
such a submodule. The code has been hardened to reject such
13+
malformed URLs (e.g. one that begins with a dash).
14+
15+
Credit for finding and fixing this vulnerability goes to joernchen
16+
and Jeff King, respectively.

‎Documentation/RelNotes/2.15.3.txt

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,6 @@
1+
Git v2.15.3 Release Notes
2+
=========================
3+
4+
This release merges up the fixes that appear in v2.14.5 to address
5+
the recently reported CVE-2018-17456; see the release notes for that
6+
version for details.

‎Documentation/RelNotes/2.16.5.txt

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,6 @@
1+
Git v2.16.5 Release Notes
2+
=========================
3+
4+
This release merges up the fixes that appear in v2.14.5 to address
5+
the recently reported CVE-2018-17456; see the release notes for that
6+
version for details.

‎Documentation/RelNotes/2.17.2.txt

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,12 @@
1+
Git v2.17.2 Release Notes
2+
=========================
3+
4+
This release merges up the fixes that appear in v2.14.5 to address
5+
the recently reported CVE-2018-17456; see the release notes for that
6+
version for details.
7+
8+
In addition, this release also teaches "fsck" and the server side
9+
logic to reject pushes to repositories that attempt to create such a
10+
problematic ".gitmodules" file as tracked contents, to help hosting
11+
sites protect their customers by preventing malicious contents from
12+
spreading.

‎Documentation/RelNotes/2.18.1.txt

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,6 @@
1+
Git v2.18.1 Release Notes
2+
=========================
3+
4+
This release merges up the fixes that appear in v2.14.5 and in
5+
v2.17.2 to address the recently reported CVE-2018-17456; see the
6+
release notes for those versions for details.

‎Documentation/RelNotes/2.19.1.txt

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,6 @@
1+
Git v2.19.1 Release Notes
2+
=========================
3+
4+
This release merges up the fixes that appear in v2.14.5 and in
5+
v2.17.2 to address the recently reported CVE-2018-17456; see the
6+
release notes for those versions for details.

‎builtin/submodule--helper.c

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1233,6 +1233,7 @@ static int clone_submodule(const char *path, const char *gitdir, const char *url
12331233
if (gitdir && *gitdir)
12341234
argv_array_pushl(&cp.args, "--separate-git-dir", gitdir, NULL);
12351235

1236+
argv_array_push(&cp.args, "--");
12361237
argv_array_push(&cp.args, url);
12371238
argv_array_push(&cp.args, path);
12381239

‎fsck.c

Lines changed: 14 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -67,6 +67,8 @@ static struct oidset gitmodules_done = OIDSET_INIT;
6767
FUNC(GITMODULES_LARGE, ERROR) \
6868
FUNC(GITMODULES_NAME, ERROR) \
6969
FUNC(GITMODULES_SYMLINK, ERROR) \
70+
FUNC(GITMODULES_URL, ERROR) \
71+
FUNC(GITMODULES_PATH, ERROR) \
7072
/* warnings */ \
7173
FUNC(BAD_FILEMODE, WARN) \
7274
FUNC(EMPTY_NAME, WARN) \
@@ -992,6 +994,18 @@ static int fsck_gitmodules_fn(const char *var, const char *value, void *vdata)
992994
FSCK_MSG_GITMODULES_NAME,
993995
"disallowed submodule name: %s",
994996
name);
997+
if (!strcmp(key, "url") && value &&
998+
looks_like_command_line_option(value))
999+
data->ret |= report(data->options, data->obj,
1000+
FSCK_MSG_GITMODULES_URL,
1001+
"disallowed submodule url: %s",
1002+
value);
1003+
if (!strcmp(key, "path") && value &&
1004+
looks_like_command_line_option(value))
1005+
data->ret |= report(data->options, data->obj,
1006+
FSCK_MSG_GITMODULES_PATH,
1007+
"disallowed submodule path: %s",
1008+
value);
9951009
free(name);
9961010

9971011
return 0;

‎submodule-config.c

Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -384,6 +384,12 @@ static void warn_multiple_config(const struct object_id *treeish_name,
384384
commit_string, name, option);
385385
}
386386

387+
static void warn_command_line_option(const char *var, const char *value)
388+
{
389+
warning(_("ignoring '%s' which may be interpreted as"
390+
" a command-line option: %s"), var, value);
391+
}
392+
387393
struct parse_config_parameter {
388394
struct submodule_cache *cache;
389395
const struct object_id *treeish_name;
@@ -409,6 +415,8 @@ static int parse_config(const char *var, const char *value, void *data)
409415
if (!strcmp(item.buf, "path")) {
410416
if (!value)
411417
ret = config_error_nonbool(var);
418+
else if (looks_like_command_line_option(value))
419+
warn_command_line_option(var, value);
412420
else if (!me->overwrite && submodule->path)
413421
warn_multiple_config(me->treeish_name, submodule->name,
414422
"path");
@@ -449,6 +457,8 @@ static int parse_config(const char *var, const char *value, void *data)
449457
} else if (!strcmp(item.buf, "url")) {
450458
if (!value) {
451459
ret = config_error_nonbool(var);
460+
} else if (looks_like_command_line_option(value)) {
461+
warn_command_line_option(var, value);
452462
} else if (!me->overwrite && submodule->url) {
453463
warn_multiple_config(me->treeish_name, submodule->name,
454464
"url");

‎t/t7416-submodule-dash-url.sh

Lines changed: 49 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,49 @@
1+
#!/bin/sh
2+
3+
test_description='check handling of .gitmodule url with dash'
4+
. ./test-lib.sh
5+
6+
test_expect_success 'create submodule with protected dash in url' '
7+
git init upstream &&
8+
git -C upstream commit --allow-empty -m base &&
9+
mv upstream ./-upstream &&
10+
git submodule add ./-upstream sub &&
11+
git add sub .gitmodules &&
12+
git commit -m submodule
13+
'
14+
15+
test_expect_success 'clone can recurse submodule' '
16+
test_when_finished "rm -rf dst" &&
17+
git clone --recurse-submodules . dst &&
18+
echo base >expect &&
19+
git -C dst/sub log -1 --format=%s >actual &&
20+
test_cmp expect actual
21+
'
22+
23+
test_expect_success 'fsck accepts protected dash' '
24+
test_when_finished "rm -rf dst" &&
25+
git init --bare dst &&
26+
git -C dst config transfer.fsckObjects true &&
27+
git push dst HEAD
28+
'
29+
30+
test_expect_success 'remove ./ protection from .gitmodules url' '
31+
perl -i -pe "s{\./}{}" .gitmodules &&
32+
git commit -am "drop protection"
33+
'
34+
35+
test_expect_success 'clone rejects unprotected dash' '
36+
test_when_finished "rm -rf dst" &&
37+
test_must_fail git clone --recurse-submodules . dst 2>err &&
38+
test_i18ngrep ignoring err
39+
'
40+
41+
test_expect_success 'fsck rejects unprotected dash' '
42+
test_when_finished "rm -rf dst" &&
43+
git init --bare dst &&
44+
git -C dst config transfer.fsckObjects true &&
45+
test_must_fail git push dst HEAD 2>err &&
46+
grep gitmodulesUrl err
47+
'
48+
49+
test_done

‎t/t7417-submodule-path-url.sh

Lines changed: 28 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,28 @@
1+
#!/bin/sh
2+
3+
test_description='check handling of .gitmodule path with dash'
4+
. ./test-lib.sh
5+
6+
test_expect_success 'create submodule with dash in path' '
7+
git init upstream &&
8+
git -C upstream commit --allow-empty -m base &&
9+
git submodule add ./upstream sub &&
10+
git mv sub ./-sub &&
11+
git commit -m submodule
12+
'
13+
14+
test_expect_success 'clone rejects unprotected dash' '
15+
test_when_finished "rm -rf dst" &&
16+
git clone --recurse-submodules . dst 2>err &&
17+
test_i18ngrep ignoring err
18+
'
19+
20+
test_expect_success 'fsck rejects unprotected dash' '
21+
test_when_finished "rm -rf dst" &&
22+
git init --bare dst &&
23+
git -C dst config transfer.fsckObjects true &&
24+
test_must_fail git push dst HEAD 2>err &&
25+
grep gitmodulesPath err
26+
'
27+
28+
test_done

0 commit comments

Comments
 (0)