summaryrefslogtreecommitdiff
path: root/Documentation/git-verify-pack.txt
diff options
context:
space:
mode:
authorLibravatar Jonathan Nieder <jrnieder@gmail.com>2020-04-18 20:57:22 -0700
committerLibravatar Jonathan Nieder <jrnieder@gmail.com>2020-04-19 16:10:58 -0700
commit1a3609e402a062ef7b11f197fe96c28cabca132c (patch)
tree469c92e12e61fa6dba844a1b3943909c7dd7e3b7 /Documentation/git-verify-pack.txt
parentcredential: treat URL with empty scheme as invalid (diff)
downloadtgif-1a3609e402a062ef7b11f197fe96c28cabca132c.tar.xz
fsck: reject URL with empty host in .gitmodules
Git's URL parser interprets https:///example.com/repo.git to have no host and a path of "example.com/repo.git". Curl, on the other hand, internally redirects it to https://example.com/repo.git. As a result, until "credential: parse URL without host as empty host, not unset", tricking a user into fetching from such a URL would cause Git to send credentials for another host to example.com. Teach fsck to block and detect .gitmodules files using such a URL to prevent sharing them with Git versions that are not yet protected. A relative URL in a .gitmodules file could also be used to trigger this. The relative URL resolver used for .gitmodules does not normalize sequences of slashes and can follow ".." components out of the path part and to the host part of a URL, meaning that such a relative URL can be used to traverse from a https://foo.example.com/innocent superproject to a https:///attacker.example.com/exploit submodule. Fortunately, redundant extra slashes in .gitmodules are rare, so we can catch this by detecting one after a leading sequence of "./" and "../" components. Helped-by: Jeff King <peff@peff.net> Signed-off-by: Jonathan Nieder <jrnieder@gmail.com> Reviewed-by: Jeff King <peff@peff.net>
Diffstat (limited to 'Documentation/git-verify-pack.txt')
0 files changed, 0 insertions, 0 deletions