summaryrefslogtreecommitdiff
path: root/Documentation/RelNotes/2.5.4.txt
diff options
context:
space:
mode:
authorLibravatar Jeff King <peff@peff.net>2018-09-24 04:36:30 -0400
committerLibravatar Junio C Hamano <gitster@pobox.com>2018-09-27 09:34:58 -0700
commitf6adec4e329ef0e25e14c63b735a5956dc67b8bc (patch)
treefdfcf396ff266608a7c4ca000d0528270ee9bf10 /Documentation/RelNotes/2.5.4.txt
parentsubmodule--helper: use "--" to signal end of clone options (diff)
downloadtgif-f6adec4e329ef0e25e14c63b735a5956dc67b8bc.tar.xz
submodule-config: ban submodule urls that start with dash
The previous commit taught the submodule code to invoke our "git clone $url $path" with a "--" separator so that we aren't confused by urls or paths that start with dashes. However, that's just one code path. It's not clear if there are others, and it would be an easy mistake to add one in the future. Moreover, even with the fix in the previous commit, it's quite hard to actually do anything useful with such an entry. Any url starting with a dash must fall into one of three categories: - it's meant as a file url, like "-path". But then any clone is not going to have the matching path, since it's by definition relative inside the newly created clone. If you spell it as "./-path", the submodule code sees the "/" and translates this to an absolute path, so it at least works (assuming the receiver has the same filesystem layout as you). But that trick does not apply for a bare "-path". - it's meant as an ssh url, like "-host:path". But this already doesn't work, as we explicitly disallow ssh hostnames that begin with a dash (to avoid option injection against ssh). - it's a remote-helper scheme, like "-scheme::data". This _could_ work if the receiver bends over backwards and creates a funny-named helper like "git-remote--scheme". But normally there would not be any helper that matches. Since such a url does not work today and is not likely to do anything useful in the future, let's simply disallow them entirely. That protects the existing "git clone" path (in a belt-and-suspenders way), along with any others that might exist. Our tests cover two cases: 1. A file url with "./" continues to work, showing that there's an escape hatch for people with truly silly repo names. 2. A url starting with "-" is rejected. Note that we expect case (2) to fail, but it would have done so even without this commit, for the reasons given above. So instead of just expecting failure, let's also check for the magic word "ignoring" on stderr. That lets us know that we failed for the right reason. Signed-off-by: Jeff King <peff@peff.net> Signed-off-by: Junio C Hamano <gitster@pobox.com>
Diffstat (limited to 'Documentation/RelNotes/2.5.4.txt')
0 files changed, 0 insertions, 0 deletions