summaryrefslogtreecommitdiff
path: root/t
diff options
context:
space:
mode:
authorLibravatar Jeff King <peff@peff.net>2017-07-28 15:28:55 -0400
committerLibravatar Junio C Hamano <gitster@pobox.com>2017-07-28 15:54:55 -0700
commitaeeb2d496859419ac1ba1da1162d6f3610f7f1f3 (patch)
tree844124df0896caa172359b472bf436c8d13be969 /t
parentconnect: reject dashed arguments for proxy commands (diff)
downloadtgif-aeeb2d496859419ac1ba1da1162d6f3610f7f1f3.tar.xz
connect: reject paths that look like command line options
If we get a repo path like "-repo.git", we may try to invoke "git-upload-pack -repo.git". This is going to fail, since upload-pack will interpret it as a set of bogus options. But let's reject this before we even run the sub-program, since we would not want to allow any mischief with repo names that actually are real command-line options. You can still ask for such a path via git-daemon, but there's no security problem there, because git-daemon enters the repo itself and then passes "." on the command line. Signed-off-by: Jeff King <peff@peff.net> Reviewed-by: Jonathan Nieder <jrnieder@gmail.com> Signed-off-by: Junio C Hamano <gitster@pobox.com>
Diffstat (limited to 't')
-rwxr-xr-xt/t5810-proto-disable-local.sh23
-rwxr-xr-xt/t5813-proto-disable-ssh.sh14
2 files changed, 37 insertions, 0 deletions
diff --git a/t/t5810-proto-disable-local.sh b/t/t5810-proto-disable-local.sh
index 563592d8a8..c1ef99b85c 100755
--- a/t/t5810-proto-disable-local.sh
+++ b/t/t5810-proto-disable-local.sh
@@ -11,4 +11,27 @@ test_expect_success 'setup repository to clone' '
test_proto "file://" file "file://$PWD"
test_proto "path" file .
+test_expect_success 'setup repo with dash' '
+ git init --bare repo.git &&
+ git push repo.git HEAD &&
+ mv repo.git "$PWD/-repo.git"
+'
+
+# This will fail even without our rejection because upload-pack will
+# complain about the bogus option. So let's make sure that GIT_TRACE
+# doesn't show us even running upload-pack.
+#
+# We must also be sure to use "fetch" and not "clone" here, as the latter
+# actually canonicalizes our input into an absolute path (which is fine
+# to allow).
+test_expect_success 'repo names starting with dash are rejected' '
+ rm -f trace.out &&
+ test_must_fail env GIT_TRACE="$PWD/trace.out" git fetch -- -repo.git &&
+ ! grep upload-pack trace.out
+'
+
+test_expect_success 'full paths still work' '
+ git fetch "$PWD/-repo.git"
+'
+
test_done
diff --git a/t/t5813-proto-disable-ssh.sh b/t/t5813-proto-disable-ssh.sh
index 0ecdceecd6..3f084ee306 100755
--- a/t/t5813-proto-disable-ssh.sh
+++ b/t/t5813-proto-disable-ssh.sh
@@ -26,4 +26,18 @@ test_expect_success 'hostnames starting with dash are rejected' '
! grep ^ssh: stderr
'
+test_expect_success 'setup repo with dash' '
+ git init --bare remote/-repo.git &&
+ git push remote/-repo.git HEAD
+'
+
+test_expect_success 'repo names starting with dash are rejected' '
+ test_must_fail git clone remote:-repo.git dash-path 2>stderr &&
+ ! grep ^ssh: stderr
+'
+
+test_expect_success 'full paths still work' '
+ git clone "remote:$PWD/remote/-repo.git" dash-path
+'
+
test_done