Commit 4e0bdaa877336efc9d42fe7c2a57d4cfe60e66a2
2018-10-05T11:42:00
submodule: add failing test for option-injection protection in url and path
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86
diff --git a/tests/submodule/inject_option.c b/tests/submodule/inject_option.c
new file mode 100644
index 0000000..182f088
--- /dev/null
+++ b/tests/submodule/inject_option.c
@@ -0,0 +1,80 @@
+#include "clar_libgit2.h"
+#include "posix.h"
+#include "path.h"
+#include "submodule_helpers.h"
+#include "fileops.h"
+#include "repository.h"
+
+static git_repository *g_repo = NULL;
+
+void test_submodule_inject_option__initialize(void)
+{
+ g_repo = setup_fixture_submodule_simple();
+}
+
+void test_submodule_inject_option__cleanup(void)
+{
+ cl_git_sandbox_cleanup();
+}
+
+static int find_naughty(git_submodule *sm, const char *name, void *payload)
+{
+ int *foundit = (int *) payload;
+
+ GIT_UNUSED(sm);
+
+ if (!git__strcmp("naughty", name))
+ *foundit = true;
+
+ return 0;
+}
+
+void test_submodule_inject_option__url(void)
+{
+ int foundit;
+ git_submodule *sm;
+ git_buf buf = GIT_BUF_INIT;
+
+ cl_git_pass(git_buf_joinpath(&buf, git_repository_workdir(g_repo), ".gitmodules"));
+ cl_git_rewritefile(buf.ptr,
+ "[submodule \"naughty\"]\n"
+ " path = testrepo\n"
+ " url = -u./payload\n");
+ git_buf_dispose(&buf);
+
+ /* We do want to find it, but with the appropriate field empty */
+ foundit = 0;
+ cl_git_pass(git_submodule_foreach(g_repo, find_naughty, &foundit));
+ cl_assert_equal_i(1, foundit);
+
+ cl_git_pass(git_submodule_lookup(&sm, g_repo, "naughty"));
+ cl_assert_equal_s("testrepo", git_submodule_path(sm));
+ cl_assert_equal_p(NULL, git_submodule_url(sm));
+
+ git_submodule_free(sm);
+}
+
+void test_submodule_inject_option__path(void)
+{
+ int foundit;
+ git_submodule *sm;
+ git_buf buf = GIT_BUF_INIT;
+
+ cl_git_pass(git_buf_joinpath(&buf, git_repository_workdir(g_repo), ".gitmodules"));
+ cl_git_rewritefile(buf.ptr,
+ "[submodule \"naughty\"]\n"
+ " path = --something\n"
+ " url = blah.git\n");
+ git_buf_dispose(&buf);
+
+ /* We do want to find it, but with the appropriate field empty */
+ foundit = 0;
+ cl_git_pass(git_submodule_foreach(g_repo, find_naughty, &foundit));
+ cl_assert_equal_i(1, foundit);
+
+ cl_git_pass(git_submodule_lookup(&sm, g_repo, "naughty"));
+ cl_assert_equal_s("naughty", git_submodule_path(sm));
+ cl_assert_equal_s("blah.git", git_submodule_url(sm));
+
+ git_submodule_free(sm);
+}