Commit 57c181985845591d1fcd97be660feb8e256fd4be
2021-05-24T18:25:19
validate reference names in open_ref() This catches invalid reference names passed to 'got ref -l' and will also be needed to validate reference names passed to a future 'gotadmin pack' command. ok naddy@
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54
diff --git a/lib/reference.c b/lib/reference.c
index bd14fc8..fcfc4cb 100644
--- a/lib/reference.c
+++ b/lib/reference.c
@@ -409,6 +409,9 @@ open_ref(struct got_reference **ref, const char *path_refs, const char *subdir,
*ref = NULL;
+ if (!is_valid_ref_name(name))
+ return got_error_path(name, GOT_ERR_BAD_REF_NAME);
+
if (ref_is_absolute || ref_is_well_known) {
if (asprintf(&path, "%s/%s", path_refs, name) == -1)
return got_error_from_errno("asprintf");
diff --git a/regress/cmdline/ref.sh b/regress/cmdline/ref.sh
index f680079..0093198 100755
--- a/regress/cmdline/ref.sh
+++ b/regress/cmdline/ref.sh
@@ -389,10 +389,11 @@ test_ref_list() {
fi
done
- for r in refs//foo/bar refs//foo//bar refs////////foo//bar; do
- got ref -r $testroot/repo -l $r > $testroot/stdout
+ for r in /refs/abc refs//foo/bar refs//foo//bar refs////////foo//bar; do
+ got ref -r $testroot/repo -l $r > $testroot/stdout \
+ 2> $testroot/stderr
- echo "refs/foo/bar/baz: $commit_id" > $testroot/stdout.expected
+ echo -n > $testroot/stdout.expected
cmp -s $testroot/stdout $testroot/stdout.expected
ret="$?"
if [ "$ret" != "0" ]; then
@@ -400,10 +401,19 @@ test_ref_list() {
test_done "$testroot" "$ret"
return 1
fi
+
+ echo "got: $r: bad reference name" > $testroot/stderr.expected
+ cmp -s $testroot/stderr $testroot/stderr.expected
+ ret="$?"
+ if [ "$ret" != "0" ]; then
+ diff -u $testroot/stderr.expected $testroot/stderr
+ test_done "$testroot" "$ret"
+ return 1
+ fi
done
# attempt to list non-existing references
- for r in refs/fo bar baz moo riffs /refs/abc refs/foo/bar/baz/moo; do
+ for r in refs/fo bar baz moo riffs refs/abc refs/foo/bar/baz/moo; do
got ref -r $testroot/repo -l $r > $testroot/stdout
echo -n > $testroot/stdout.expected