|
2e8c3b0b
|
2020-01-18T17:17:46
|
|
oid functions: return an int
Stop returning a void for functions, future-proofing them to allow them
to fail.
|
|
|
9893d376
|
2020-01-18T15:41:20
|
|
git_attr_cache_flush: return an int
Stop returning a void for functions, future-proofing them to allow them
to fail.
|
|
|
4460bf40
|
2020-01-24T11:08:44
|
|
Merge pull request #5286 from libgit2/ethomson/gssapi
HTTP: Support Apache-based servers with Negotiate
|
|
|
e9cef7c4
|
2020-01-11T23:53:45
|
|
http: introduce GIT_ERROR_HTTP
Disambiguate between general network problems and HTTP problems in error
codes.
|
|
|
76fd406a
|
2019-12-26T16:37:01
|
|
http: send probe packets
When we're authenticating with a connection-based authentication scheme
(NTLM, Negotiate), we need to make sure that we're still connected
between the initial GET where we did the authentication and the POST
that we're about to send. Our keep-alive session may have not kept
alive, but more likely, some servers do not authenticate the entire
keep-alive connection and may have "forgotten" that we were
authenticated, namely Apache and nginx.
Send a "probe" packet, that is an HTTP POST request to the upload-pack
or receive-pack endpoint, that consists of an empty git pkt ("0000").
If we're authenticated, we'll get a 200 back. If we're not, we'll get a
401 back, and then we'll resend that probe packet with the first step of
our authentication (asking to start authentication with the given
scheme). We expect _yet another_ 401 back, with the authentication
challenge.
Finally, we will send our authentication response with the actual POST
data. This will allow us to authenticate without draining the POST data
in the initial request that gets us a 401.
|
|
|
7fd9b3f5
|
2020-01-01T20:48:15
|
|
ci: add NTLM tests
Download poxygit, a debugging git server, and clone from it using NTLM,
both IIS-style (with connection affinity) and Apache-style ("broken",
requiring constant reauthentication).
|
|
|
29762e40
|
2020-01-01T16:14:37
|
|
httpclient: use defines for status codes
|
|
|
3e9ee04f
|
2019-12-29T18:46:44
|
|
trace: compare against an int value
When tracing is disabled, don't let `git_trace__level` return a void,
since that can't be compared against.
|
|
|
b9c5b15a
|
2019-12-22T14:12:24
|
|
http: use the new httpclient
Untangle the notion of the http transport from the actual http
implementation. The http transport now uses the httpclient.
|
|
|
0b8358c8
|
2019-12-14T11:04:58
|
|
net: introduce path formatting function
Introduce a function to format the path and query string for a URL,
suitable for creating an HTTP request.
|
|
|
1152f361
|
2019-12-13T18:37:19
|
|
httpclient: consume final chunk message
When sending a new request, ensure that we got the entirety of the
response body. Our caller may have decided that they were done reading.
If we were not at the end of the message, this means that we need to
tear down the connection and cannot do keep-alive.
However, if the caller read all of the message, but we still have a
final end-of-response chunk signifier (ie, "0\r\n\r\n") on the socket,
then we should consider that the response was successfully copmleted.
If we're asked to send a new request, try to read from the socket, just
to clear out that end-of-chunk message, marking ourselves as
disconnected on any errors.
|
|
|
dcd3b815
|
2019-12-13T15:28:57
|
|
tests: support CLAR_TRACE_LEVEL
The CLAR_TRACE_LEVEL environment variable was supported when building
with GIT_TRACE. Now we always build with GIT_TRACE, but that variable
is not provided to tests. Simply support clar tracing always.
|
|
|
84b99a95
|
2019-12-12T13:53:43
|
|
httpclient: add chunk support to POST
Teach httpclient how to support chunking when POSTing request bodies.
|
|
|
bf55facf
|
2019-10-25T12:24:34
|
|
tests: allow users to use expect/continue
|
|
|
eacecebd
|
2019-12-12T13:25:32
|
|
httpclient: introduce a simple http implementation
Introduce a new http client implementation that can GET and POST to
remote URLs.
Consumers can use `git_http_client_init` to create a new client,
`git_http_client_send_request` to send a request to the remote server
and `git_http_client_read_response` to read the response.
The http client implementation will perform the I/O with the remote
server (http or https) but does not understand the git smart transfer
protocol. This allows us to split the concerns of the http subtransport
from the actual http implementation.
|
|
|
a591f362
|
2019-12-09T19:48:10
|
|
net: introduce url formatting function
|
|
|
7372573b
|
2019-10-25T12:22:10
|
|
httpclient: support expect/continue
Allow users to opt-in to expect/continue handling when sending a POST
and we're authenticated with a "connection-based" authentication
mechanism like NTLM or Negotiate.
If the response is a 100, return to the caller (to allow them to post
their body). If the response is *not* a 100, buffer the response for
the caller.
HTTP expect/continue is generally safe, but some legacy servers
have not implemented it correctly. Require it to be opt-in.
|
|
|
6c21c989
|
2019-12-14T21:32:07
|
|
httpclient: support CONNECT proxies
Fully support HTTP proxies, in particular CONNECT proxies, that allow us
to speak TLS through a proxy.
|
|
|
6b208836
|
2019-12-18T21:55:28
|
|
httpclient: handle chunked responses
Detect responses that are sent with Transfer-Encoding: chunked, and
record that information so that we can consume the entire message body.
|
|
|
6a095679
|
2019-12-14T10:34:36
|
|
httpclient: support authentication
Store the last-seen credential challenges (eg, all the
'WWW-Authenticate' headers in a response message). Given some
credentials, find the best (first) challenge whose mechanism supports
these credentials. (eg, 'Basic' supports username/password credentials,
'Negotiate' supports default credentials).
Set up an authentication context for this mechanism and these
credentials. Continue exchanging challenge/responses until we're
authenticated.
|
|
|
0e39a8fa
|
2019-12-29T10:05:14
|
|
net: free the url's query component
|
|
|
2d6a61bd
|
2019-10-22T09:52:31
|
|
gssapi: validate that we were requested Negotiate
|
|
|
e761df5c
|
2019-10-22T09:35:48
|
|
gssapi: dispose after completion for retry
Disposal pattern; dispose on completion, allowing us to retry
authentication, which may happen on web servers that close
connection-based authenticated sessions (NTLM/SPNEGO) unexpectedly.
|
|
|
d68f2b1a
|
2019-12-06T18:22:58
|
|
buf: add consume_bytes
Allow users to consume a buffer by the number of bytes, not just to an
ending pointer.
|
|
|
e995f74e
|
2019-12-06T15:39:08
|
|
net: introduce git_net_url_joinpath
Provide a mechanism to add a path and query string to an existing url
so that we can easily append `/info/refs?...` type url segments to a url
given to us by a user.
|
|
|
471daeea
|
2019-12-01T14:00:49
|
|
net: refactor gitno redirect handling
Move the redirect handling into `git_net_url` for consistency.
|
|
|
297c61e4
|
2019-12-01T10:06:11
|
|
net: add an isvalid function
(Also, mark all the declarations as extern.)
|
|
|
a194e17f
|
2019-11-27T18:43:36
|
|
winhttp: refactor request sending
Clarify what it means to not send a length; this allows us to refactor
requests further.
|
|
|
da9bc8ac
|
2019-11-27T23:42:16
|
|
ci: enable GSSAPI for Ubuntu builds
|
|
|
9b96adf3
|
2019-11-22T18:03:50
|
|
docker build: add krb5 libraries and command-line tools
|
|
|
031e3e4c
|
2019-11-27T14:20:44
|
|
ci: don't do negotiate tests on windows
We can't get a kerberos TGT easily on Windows; skip the negotiate tests.
|
|
|
fe4efe2e
|
2019-12-03T10:17:30
|
|
tests: test that clone returns 4321
This conditional was backwards. We should instead test that clone
returns 4321, not that 4321 returns clone.
|
|
|
7e0f5a6a
|
2019-10-22T22:37:14
|
|
smart protocol: correct case in error messages
|
|
|
89d1fc2a
|
2019-10-22T09:30:50
|
|
gssapi: show information about disabled GSSAPI
When USE_GSSAPI=OFF, still show information about what SPNEGO is, even
though it's disabled. This is for parity with other disabled features
like SSH and debugpool that still show details about what is disabled.
|
|
5625892b
|
2019-09-20T12:06:11
|
|
gssapi: delete half-built security context so auth can continue
|
|
|
2174aa0a
|
2019-10-21T11:47:23
|
|
gssapi: correct incorrect case in error message
|
|
|
3f6fe054
|
2019-10-20T17:23:01
|
|
gssapi: protect GSS_ERROR macro
The GSS_ERROR(x) macro may expand to `(x & value)` on some
implementations, instead of `((x) & value)`. This is the case on macOS,
which means that if we attempt to wrap an expression in that macro, like
`a = b`, then that would expand to `(a = b & value)`.
Since `&` has a higher precedence, this is not at all what we want, and
will set our result code to an incorrect value. Evaluate the expression
then test it with `GSS_ERROR` independently to avoid this.
|
|
|
73fe690d
|
2019-10-20T17:22:27
|
|
gssapi: protect against empty messages
|
|
|
e5fb5fe5
|
2019-10-20T17:19:01
|
|
ci: perform SPNEGO tests
Attempt to obtain a Kerberos ticket from LIBGIT2.ORG and then clone the
Negotiate-protected site at test.libgit2.org with that ticket.
|
|
9bcf10e9
|
2020-01-24T09:56:59
|
|
Merge pull request #5364 from libgit2/ethomson/typet
internal types: change enums from `type_t` to `_t`
|
|
|
917ba762
|
2020-01-18T14:14:00
|
|
auth: update enum type name for consistency
libgit2 does not use `type_t` suffixes as it's redundant; thus, rename
`git_http_authtype_t` to `git_http_auth_t` for consistency.
|
|
|
b59c71d8
|
2020-01-18T14:11:01
|
|
iterator: update enum type name for consistency
libgit2 does not use `type_t` suffixes as it's redundant; thus, rename
`git_iterator_type_t` to `git_iterator_t` for consistency.
|
|
|
df3063ea
|
2020-01-18T14:04:44
|
|
rebase: update enum type name for consistency
libgit2 does not use `type_t` suffixes as it's redundant; thus, rename
`git_rebase_type_t` to `git_rebase_t` for consistency.
|
|
|
94beb3a3
|
2020-01-18T14:03:23
|
|
merge: update enum type name for consistency
libgit2 does not use `type_t` suffixes as it's redundant; thus, rename
`git_merge_diff_type_t` to `git_merge_diff_t` for consistency.
|
|
|
a76348ee
|
2020-01-17T08:38:00
|
|
Merge pull request #5358 from lrm29/git_merge_driver_source_repo_non_const
merge: Return non-const git_repository from accessor method
|
|
|
1908884d
|
2020-01-17T08:34:30
|
|
Merge pull request #5361 from csware/no-return-freed_object
Do not return free'd git_repository object on error
|
|
|
47ac1187
|
2020-01-17T08:32:37
|
|
Merge pull request #5360 from josharian/fix-5357
refs: refuse to delete HEAD
|
|
|
a129941a
|
2020-01-16T17:44:55
|
|
Merge pull request #5351 from pks-t/pks/index-map-macros
index: replace map macros with inline functions
|
|
470a05d0
|
2020-01-16T17:53:50
|
|
Do not return free'd git_repository object on error
Regression introduced in commit dde6d9c706bf1ecab545da55ab874a016587af1f.
This issue causes lots of crashes in TortoiseGit.
Signed-off-by: Sven Strickroth <email@cs-ware.de>
|
|
852c83ee
|
2020-01-15T13:31:21
|
|
refs: refuse to delete HEAD
This requires adding a new symbolic ref to the testrepo fixture.
Some of the existing tests attempt to delete HEAD, expecting a different failure. Introduce and use a non-HEAD symbolic ref instead.
Adjust a few other tests as needed.
Fixes #5357
|
|
|
dea5ce3d
|
2020-01-15T17:30:59
|
|
Merge pull request #5359 from tniessen/make-type-mismatch-errors-consistent
Make type mismatch errors consistent
|
|
5e1b6eaf
|
2020-01-15T12:58:59
|
|
Make type mismatch errors consistent
|
|
1bddbd02
|
2020-01-15T10:30:00
|
|
merge: Return non-const git_repository from git_merge_driver_source_repo accessor.
|
|
|
7fc97eb3
|
2020-01-09T14:21:41
|
|
index: fix resizing index map twice on case-insensitive systems
Depending on whether the index map is case-sensitive or insensitive, we
need to call either `git_idxmap_icase_resize` or `git_idxmap_resize`.
There are multiple locations where we thus use the following pattern:
if (index->ignore_case &&
git_idxmap_icase_resize(map, length) < 0)
return -1;
else if (git_idxmap_resize(map, length) < 0)
return -1;
The funny thing is: on case-insensitive systems, we will try to resize
the map twice in case where `git_idxmap_icase_resize()` doesn't error.
While this will still use the correct hashing function as both map types
use the same, this bug will at least cause us to resize the map twice in
a row.
Fix the issue by introducing a new function `index_map_resize` that
handles case-sensitivity, similar to how `index_map_set` and
`index_map_delete`. Convert all call sites where we were previously
resizing the map to use that new function.
|
|
|
ab45887f
|
2020-01-09T14:15:02
|
|
index: replace map macros with inline functions
Traditionally, our maps were mostly implemented via macros that had
weird call semantics. This shows in our index code, where we have macros
that insert into an index map case-sensitively or insensitively, as they
still return error codes via an error parameter. This is unwieldy and,
most importantly, not necessary anymore, due to the introduction of our
high-level map API and removal of macros.
Replace them with inlined functions to make code easier to read.
|
|
|
cc4f4cbe
|
2020-01-12T10:12:57
|
|
Merge pull request #5355 from pks-t/pks/win32-relative-symlink-across-dirs
win32: fix relative symlinks pointing into dirs
|
|
|
d5482339
|
2020-01-10T11:13:25
|
|
Merge pull request #5354 from josharian/issue-5353
ntlm: prevent (spurious) compiler warnings
|
|
|
dbb6429c
|
2020-01-10T14:30:18
|
|
Merge pull request #5305 from kas-luthor/bugfix/multiple-auth
Adds support for multiple SSH auth mechanisms being used sequentially
|
|
|
7d55bee6
|
2020-01-10T12:44:51
|
|
win32: fix relative symlinks pointing into dirs
On Windows platforms, we need some logic to emulate symlink(3P) defined
by POSIX. As unprivileged symlinks on Windows are a rather new feature,
our current implementation is comparatively new and still has some
rough edges in special cases.
One such case is relative symlinks. While relative symlinks to files in
the same directory work as expected, libgit2 currently fails to create
reltaive symlinks pointing into other directories. This is due to the
fact that we forgot to translate the Unix-style target path to
Windows-style. Most importantly, we are currently not converting
directory separators from "/" to "\".
Fix the issue by calling `git_win32_path_canonicalize` on the target.
Add a test that verifies our ability to create such relative links
across directories.
|
|
|
9181e4b5
|
2020-01-10T12:02:10
|
|
Merge pull request #5339 from josharian/issue-5321
netops: handle intact query parameters in service_suffix removal
|
|
|
93def7ad
|
2020-01-09T13:37:18
|
|
ntlm: prevent (spurious) compiler warnings
Pull in commit
https://github.com/ethomson/ntlmclient/commit/e7b2583e1bc28c33c43854e7c318e859b4e83bef
to fix #5353.
|
|
|
7142964f
|
2019-12-13T10:56:19
|
|
netops: handle intact query parameters in service_suffix removal
Some servers leave the query parameters intact in the
Location header when responding with a redirect.
The service_suffix removal check as written assumed
that the server removed them.
Handle both cases.
Along with PR #5325, this fixes #5321.
There are two new tests. The first already passed;
the second previously failed.
|
|
|
258188dd
|
2020-01-09T10:09:35
|
|
Merge pull request #5340 from pks-t/pks/pack-zstream
Refactor packfile code to use zstream abstraction
|
|
|
2dc7b5ef
|
2019-12-14T12:53:04
|
|
tests: pack: add missing asserts around `git_packbuilder_write`
|
|
|
0edc26c8
|
2019-12-13T18:54:13
|
|
pack: refactor streams to use `git_zstream`
While we do have a `git_zstream` abstraction that encapsulates all the
calls to zlib as well as its error handling, we do not use it in our
pack file code. Refactor it to make the code a lot easier to understand.
|
|
|
d8f6fee3
|
2019-12-13T14:57:53
|
|
pack: refactor unpacking of raw objects to use `git_zstream`
While we do have a zstream abstraction that encapsulates all the calls
to zlib as well as its error handling, we do not use it in our pack file
code. Refactor it to make the code a lot easier to understand.
|
|
|
ba64f50c
|
2020-01-08T09:51:12
|
|
Merge pull request #5322 from kdj0c/fix_sub_sync
Fix git_submodule_sync with relative url
|
|
|
11e8ee1f
|
2020-01-06T15:41:18
|
|
tests: submodule: verify setup of relative URLs
When setting up relative URLs for a submodule, then we resolve it to
the actual location and write that into ".git/config" instead of
writing the relative value. We do not yet have a test to nail down this
behaviour, which is now being added by this commit.
|
|
|
ff355778
|
2020-01-06T15:16:24
|
|
submodule: refactor code to match current coding style
The submodule code has grown out-of-date regarding its coding style.
Update `git_submodule_reload` and `git_submodule_sync` to more closely
resemble what the rest of our code base uses.
|
|
fbcc8bd1
|
2019-12-18T13:42:44
|
|
submodule sync, fix edge case with submodule sync on empty repo
|
|
|
42e0bed2
|
2019-12-05T10:43:17
|
|
Fix git_submodule_sync with relative url
git_submodule_sync should resolve submodule before writing to .git/config
to have the same behavior as git_submodule_init, which does the right thing.
|
|
|
33f93bf3
|
2020-01-06T11:53:53
|
|
Merge pull request #5325 from josharian/no-double-slash
http: avoid generating double slashes in url
|
|
|
f5173597
|
2020-01-06T11:45:47
|
|
Merge pull request #5348 from rcjsuen/patch-2
Correct typo in name of referenced parameter
|
|
5930cf25
|
2020-01-02T14:57:55
|
|
Correct typo in name of referenced parameter
Signed-off-by: Remy Suen <remy.suen@gmail.com>
|
|
|
05c1fb8a
|
2019-12-06T11:04:40
|
|
http: avoid generating double slashes in url
Prior to this change, given a remote url with a trailing slash,
such as http://localhost/a/, service requests would contain a
double slash: http://localhost/a//info/refs?service=git-receive-pack.
Detect and prevent that.
Updates #5321
|
|
|
cb17630b
|
2019-12-14T06:59:19
|
|
Merge pull request #5338 from pks-t/pks/patch-null-arithmetic
patch_parse: fix undefined behaviour due to arithmetic on NULL pointers
|
|
|
e1d7747f
|
2019-12-14T06:58:52
|
|
Merge pull request #5337 from pks-t/pks/smart-pkt-ok-overflow
smart_pkt: fix overflow resulting in OOB read/write of one byte
|
|
cb7fd1ed
|
2019-12-13T15:11:38
|
|
Fixes code styling
|
|
|
2f6f10bb
|
2019-12-13T13:35:40
|
|
Merge pull request #5300 from tiennou/fix/branch-documentation
branch: clarify documentation around branches
|
|
|
c6f9ad73
|
2019-12-13T13:18:54
|
|
patch_parse: fix undefined behaviour due to arithmetic on NULL pointers
Doing arithmetic with NULL pointers is undefined behaviour in the C
standard. We do so regardless when parsing patches, as we happily add a
potential prefix length to prefixed paths. While this works out just
fine as the prefix length is always equal to zero in these cases, thus
resulting in another NULL pointer, it still is undefined behaviour and
was pointed out to us by OSSfuzz.
Fix the issue by checking whether paths are NULL, avoiding the
arithmetic if they are.
|
|
|
86852613
|
2019-12-13T12:13:05
|
|
smart_pkt: fix overflow resulting in OOB read/write of one byte
When parsing OK packets, we copy any information after the initial "ok "
prefix into the resulting packet. As newlines act as packet boundaries,
we also strip the trailing newline if there is any. We do not check
whether there is any data left after the initial "ok " prefix though,
which leads to a pointer overflow in that case as `len == 0`:
if (line[len - 1] == '\n')
--len;
This out-of-bounds read is a rather useless gadget, as we can only
deduce whether at some offset there is a newline character. In case
there accidentally is one, we overflow `len` to `SIZE_MAX` and then
write a NUL byte into an array indexed by it:
pkt->ref[len] = '\0';
Again, this doesn't seem like something that's possible to be exploited
in any meaningful way, but it may surely lead to inconsistencies or DoS.
Fix the issue by checking whether there is any trailing data after the
packet prefix.
|
|
97b8491b
|
2019-12-08T15:25:52
|
|
refs: rename git_reference__set_name to git_reference__realloc
As git_reference__name will reallocate storage to account for longer
names (it's actually allocator-dependent), it will cause all existing
pointers to the old object to become dangling, as they now point to
freed memory.
Fix the issue by renaming to a more descriptive name, and pass a pointer
to the actual reference that can safely be invalidated if the realloc
succeeds.
|
|
|
d2d01f71
|
2019-12-13T11:49:37
|
|
Merge pull request #5283 from pks-t/pks/example-checkout-remote-branch
examples: checkout: implement guess heuristic for remote branches
|
|
|
3e6a9045
|
2019-12-13T08:53:51
|
|
Merge pull request #5320 from josharian/minor-docs
Minor doc improvements
|
|
|
b3178587
|
2019-12-13T08:35:25
|
|
Merge pull request #5333 from lrm29/attr_binary_macro
attr: Update definition of binary macro
|
|
|
cf286d5e
|
2019-12-12T10:58:56
|
|
attr: Update definition of binary macro
|
|
|
6777db8e
|
2019-12-10T20:40:17
|
|
Merge pull request #5331 from pks-t/security-fixes
Security fixes for master
|
|
|
b8b8eee3
|
2019-12-10T13:44:27
|
|
changelog: document security fixes
|
|
|
14ff3516
|
2019-12-03T23:15:47
|
|
path: support non-ascii drive letters on dos
Windows/DOS only supports drive letters that are alpha characters A-Z.
However, you can `subst` any one-character as a drive letter, including
numbers or even emoji. Test that we can identify emoji as drive
letters.
|
|
|
85d4ff77
|
2019-12-03T19:50:18
|
|
index: ensure that we respect core.protectNTFS=false
Users may want to turn off core.protectNTFS, perhaps to import (and then
repair) a broken tree. Ensure that core.protectNTFS=false is honored.
|
|
|
ba4c769b
|
2019-12-03T23:23:02
|
|
tree: ensure we protect NTFS paths everywhere
|
|
|
e4034dfa
|
2019-12-03T19:24:59
|
|
path: protect NTFS everywhere
Enable core.protectNTFS by default everywhere and in every codepath, not
just on checkout.
|
|
|
d9c0c9cf
|
2019-12-03T19:17:41
|
|
test: ensure we can't add a protected path
Test that when we enable core.protectNTFS that we cannot add
platform-specific invalid paths to the index.
|
|
|
72df1cd8
|
2019-12-03T19:01:00
|
|
test: improve badname verification test
The name of the `add_invalid_filename` function suggests that we
_want_ to add an invalid filename. Rename the function to show that
we expect to _fail_ to add the invalid filename.
|
|
|
f3b28604
|
2019-12-03T18:57:16
|
|
test: ensure treebuilder validate new protection rules
Ensure that the new protection around .git::$INDEX_ALLOCATION rules are
enabled for using the treebuilder when core.protectNTFS is set.
|
|
|
336991db
|
2019-12-03T18:56:31
|
|
test: ensure index adds validate new protection rules
Ensure that the new protection around .git::$INDEX_ALLOCATION rules are
enabled for adding to the index when core.protectNTFS is set.
|
|
|
a3cbd204
|
2019-12-03T18:49:23
|
|
test: improve badname verification test
The name of the `write_invalid_filename` function suggests that we
_want_ to write an invalid filename. Rename the function to show that
we expect to _fail_ to write the invalid filename.
|
|
|
b8464342
|
2019-12-03T17:47:31
|
|
path: rename function that detects end of filename
The function `only_spaces_and_dots` used to detect the end of the
filename on win32. Now we look at spaces and dots _before_ the end of
the string _or_ a `:` character, which would signify a win32 alternate
data stream.
Thus, rename the function `ntfs_end_of_filename` to indicate that it
detects the (virtual) end of a filename, that any further characters
would be elided to the given path.
|
|
e1832eb2
|
2019-09-18T16:33:18
|
|
path: also guard `.gitmodules` against NTFS Alternate Data Streams
We just safe-guarded `.git` against NTFS Alternate Data Stream-related
attack vectors, and now it is time to do the same for `.gitmodules`.
Note: In the added regression test, we refrain from verifying all kinds
of variations between short names and NTFS Alternate Data Streams: as
the new code disallows _all_ Alternate Data Streams of `.gitmodules`, it
is enough to test one in order to know that all of them are guarded
against.
Signed-off-by: Johannes Schindelin <johannes.schindelin@gmx.de>
|
|
|
3f7851ea
|
2019-09-18T14:32:05
|
|
Disallow NTFS Alternate Data Stream attacks, even on Linux/macOS
A little-known feature of NTFS is that it offers to store metadata in
so-called "Alternate Data Streams" (inspired by Apple's "resource
forks") that are copied together with the file they are associated with.
These Alternate Data Streams can be accessed via `<file name>:<stream
name>:<stream type>`.
Directories, too, have Alternate Data Streams, and they even have a
default stream type `$INDEX_ALLOCATION`. Which means that `abc/` and
`abc::$INDEX_ALLOCATION/` are actually equivalent.
This is of course another attack vector on the Git directory that we
definitely want to prevent.
On Windows, we already do this incidentally, by disallowing colons in
file/directory names.
While it looks as if files'/directories' Alternate Data Streams are not
accessible in the Windows Subsystem for Linux, and neither via
CIFS/SMB-mounted network shares in Linux, it _is_ possible to access
them on SMB-mounted network shares on macOS.
Therefore, let's go the extra mile and prevent this particular attack
_everywhere_. To keep things simple, let's just disallow *any* Alternate
Data Stream of `.git`.
This is libgit2's variant of CVE-2019-1352.
Signed-off-by: Johannes Schindelin <johannes.schindelin@gmx.de>
|