Merge tag 'v2.13.5' into maint

4 files changed, 57 insertions, 2 deletions

diff --git a/t/lib-proto-disable.sh b/t/lib-proto-disable.sh
index 02f49cb409..83babe57d9 100644
--- a/t/lib-proto-disable.sh
+++ b/t/lib-proto-disable.sh
@@ -147,29 +147,33 @@ test_config () {
 	# Test clone/fetch/push with protocol.allow user defined default
 	test_expect_success "clone $desc (enabled)" '
 		rm -rf tmp.git &&
-		git config --global protocol.allow always &&
+		test_config_global protocol.allow always &&
 		git clone --bare "$url" tmp.git
 	'
 
 	test_expect_success "fetch $desc (enabled)" '
+		test_config_global protocol.allow always &&
 		git -C tmp.git fetch
 	'
 
 	test_expect_success "push $desc (enabled)" '
+		test_config_global protocol.allow always &&
 		git -C tmp.git push origin HEAD:pushed
 	'
 
 	test_expect_success "push $desc (disabled)" '
-		git config --global protocol.allow never &&
+		test_config_global protocol.allow never &&
 		test_must_fail git -C tmp.git push origin HEAD:pushed
 	'
 
 	test_expect_success "fetch $desc (disabled)" '
+		test_config_global protocol.allow never &&
 		test_must_fail git -C tmp.git fetch
 	'
 
 	test_expect_success "clone $desc (disabled)" '
 		rm -rf tmp.git &&
+		test_config_global protocol.allow never &&
 		test_must_fail git clone --bare "$url" tmp.git
 	'
 }
diff --git a/t/t5532-fetch-proxy.sh b/t/t5532-fetch-proxy.sh
index 51c9669398..9c2798603b 100755
--- a/t/t5532-fetch-proxy.sh
+++ b/t/t5532-fetch-proxy.sh
@@ -43,4 +43,9 @@ test_expect_success 'fetch through proxy works' '
 	test_cmp expect actual
 '
 
+test_expect_success 'funny hostnames are rejected before running proxy' '
+	test_must_fail git fetch git://-remote/repo.git 2>stderr &&
+	! grep "proxying for" stderr
+'
+
 test_done
diff --git a/t/t5810-proto-disable-local.sh b/t/t5810-proto-disable-local.sh
index 563592d8a8..c1ef99b85c 100755
--- a/t/t5810-proto-disable-local.sh
+++ b/t/t5810-proto-disable-local.sh
@@ -11,4 +11,27 @@ test_expect_success 'setup repository to clone' '
 test_proto "file://" file "file://$PWD"
 test_proto "path" file .
 
+test_expect_success 'setup repo with dash' '
+	git init --bare repo.git &&
+	git push repo.git HEAD &&
+	mv repo.git "$PWD/-repo.git"
+'
+
+# This will fail even without our rejection because upload-pack will
+# complain about the bogus option. So let's make sure that GIT_TRACE
+# doesn't show us even running upload-pack.
+#
+# We must also be sure to use "fetch" and not "clone" here, as the latter
+# actually canonicalizes our input into an absolute path (which is fine
+# to allow).
+test_expect_success 'repo names starting with dash are rejected' '
+	rm -f trace.out &&
+	test_must_fail env GIT_TRACE="$PWD/trace.out" git fetch -- -repo.git &&
+	! grep upload-pack trace.out
+'
+
+test_expect_success 'full paths still work' '
+	git fetch "$PWD/-repo.git"
+'
+
 test_done
diff --git a/t/t5813-proto-disable-ssh.sh b/t/t5813-proto-disable-ssh.sh
index a954ead8af..3f084ee306 100755
--- a/t/t5813-proto-disable-ssh.sh
+++ b/t/t5813-proto-disable-ssh.sh
@@ -17,4 +17,27 @@ test_proto "host:path" ssh "remote:repo.git"
 test_proto "ssh://" ssh "ssh://remote$PWD/remote/repo.git"
 test_proto "git+ssh://" ssh "git+ssh://remote$PWD/remote/repo.git"
 
+# Don't even bother setting up a "-remote" directory, as ssh would generally
+# complain about the bogus option rather than completing our request. Our
+# fake wrapper actually _can_ handle this case, but it's more robust to
+# simply confirm from its output that it did not run at all.
+test_expect_success 'hostnames starting with dash are rejected' '
+	test_must_fail git clone ssh://-remote/repo.git dash-host 2>stderr &&
+	! grep ^ssh: stderr
+'
+
+test_expect_success 'setup repo with dash' '
+	git init --bare remote/-repo.git &&
+	git push remote/-repo.git HEAD
+'
+
+test_expect_success 'repo names starting with dash are rejected' '
+	test_must_fail git clone remote:-repo.git dash-path 2>stderr &&
+	! grep ^ssh: stderr
+'
+
+test_expect_success 'full paths still work' '
+	git clone "remote:$PWD/remote/-repo.git" dash-path
+'
+
 test_done