tests


Log

Author Commit Date CI Message
lhchavez 3a197ea7 2020-06-27T12:33:32 Make the tests pass cleanly with MemorySanitizer This change: * Initializes a few variables that were being read before being initialized. * Includes https://github.com/madler/zlib/pull/393. As such, it only works reliably with `-DUSE_BUNDLED_ZLIB=ON`.
Edward Thomson 74520b91 2020-06-13T19:38:11 Merge pull request #5552 from libgit2/pks/small-fixes Random code cleanups and fixes
Patrick Steinhardt c6184f0c 2020-06-08T21:07:36 tree-wide: do not compile deprecated functions with hard deprecation When compiling libgit2 with -DDEPRECATE_HARD, we add a preprocessor definition `GIT_DEPRECATE_HARD` which causes the "git2/deprecated.h" header to be empty. As a result, no function declarations are made available to callers, but the implementations are still available to link against. This has the problem that function declarations also aren't visible to the implementations, meaning that the symbol's visibility will not be set up correctly. As a result, the resulting library may not expose those deprecated symbols at all on some platforms and thus cause linking errors. Fix the issue by conditionally compiling deprecated functions, only. While it becomes impossible to link against such a library in case one uses deprecated functions, distributors of libgit2 aren't expected to pass -DDEPRECATE_HARD anyway. Instead, users of libgit2 should manually define GIT_DEPRECATE_HARD to hide deprecated functions. Using "real" hard deprecation still makes sense in the context of CI to test we don't use deprecated symbols ourselves and in case a dependant uses libgit2 in a vendored way and knows it won't ever use any of the deprecated symbols anyway.
Patrick Steinhardt 9e4e25b1 2020-06-08T12:57:48 tests: refs: modernize coding style of testcase The coding style of the testcase refs::create::propagate_eexists is not really up-to-date. Convert it to use a more modern coding style.
Edward Thomson c708e5e5 2020-06-05T14:11:34 Merge pull request #5541 from libgit2/ethomson/clar_tap clar: add tap output option
Edward Thomson cad7a1ba 2020-06-05T08:42:38 clar: include the function name
Edward Thomson 06d69dfc 2020-05-01T12:39:48 diff::parse: don't include `diff.h` We don't call any internal functions in the test; we don't need to include `../src/diff.h`.
Edward Thomson f7250cc3 2020-06-04T07:23:15 clar: add tap output
Edward Thomson 691315e6 2020-06-03T15:47:42 clar: add an output abstraction layer Add an output abstraction layer, with a single output format, "clap", the clar protocol, which is the current output format for clar.
Edward Thomson 0187f36a 2020-06-03T15:22:44 clar: parse arguments before printing the header We want to parse arguments before we start printing any output; the arguments themselves may impact the way we display that output.
Patrick Steinhardt 86b85492 2020-06-03T15:40:37 Merge pull request #5537 from libgit2/ethomson/clar_exactmatch tests: offer exact name matching with a `$` suffix
Edward Thomson 107bf1f4 2020-06-03T11:47:13 clar: print indirection
Patrick Steinhardt 53a8f463 2020-06-03T07:40:59 Merge pull request #5536 from libgit2/ethomson/http httpclient: support googlesource
Edward Thomson 6de8aa7f 2020-06-02T12:21:22 Merge pull request #5532 from joshtriplett/pack-default-path git_packbuilder_write: Allow setting path to NULL to use the default path
Edward Thomson 0d3ce2ac 2020-06-02T10:23:41 offer exact name matching with a `$` suffix When using `-s` to specify a particular test, it will do a prefix match. Thus, `-sapply::both::rename_a_to_b_to_c` will match both a test named `test_apply_both__rename_a_to_b_to_c` and a test that begins with that name, like `test_apply_both__rename_a_to_b_to_c_exact`. Permit a trailing `$` to `-s` syntax. This allows a user to specify `-sapply::both::rename_a_to_b_to_c$` to match _only_ the `test_apply_both__rename_a_to_b_to_c` function. We already filter to ensure that the given prefix matches the current test name. Also ensure that the length of the test name matches the length of the filter, sans trailing `$`.
Edward Thomson 2a2c5b40 2020-05-23T15:57:48 clar: remove unused shell_out function
Edward Thomson ee9e9163 2020-05-23T15:56:29 clar: remove files internally instead of /bin/rm Similar to how clar has used `/bin/cp` to copy files, it's used `/bin/rm` to remove them. This has similar deficiencies; meaning that leaks is noisy and it's slow. Move it to an internal function.
Edward Thomson d03fd331 2020-05-23T15:42:51 clar: copy files with sendfile on linux
Edward Thomson 8df4f519 2020-05-23T15:04:54 clar: copy files internally instead of /bin/cp clar has historically shelled out to `/bin/cp` to copy test fixtures into a sandbox. This has two deficiencies: 1. It's slower than simply opening the source and destination and copying them in a read/write loop. On my Mac, the `/bin/cp` based approach takes ~2:40 for a full test pass. Using a read/write loop to copy the files ourselves takes ~1:50. 2. It's noisy. Since the leak detector follows fork/exec, we'll end up running the leak detector on `/bin/cp`. This would be fine, except that the leak detector spams the console on startup and shutdown, so it adds a _lot_ of additional information to the test runs that is useless. By not forking and using this internal system, we see much less output.
Edward Thomson 51eff5a5 2020-05-29T13:13:19 strarray: we should `dispose` instead of `free` We _dispose_ the contents of objects; we _free_ objects (and their contents). Update `git_strarray_free` to be `git_strarray_dispose`. `git_strarray_free` remains as a deprecated proxy function.
Edward Thomson b7bdb071 2020-05-30T15:21:48 online::clone: test a googlesource URL Google Git (googlesource.com) behaves differently than git proper. Test that we can communicate with it.
Patrick Steinhardt 172a2886 2020-06-01T14:04:15 Merge pull request #5529 from libgit2/ethomson/difftest diff::workdir: actually test the buffers
Patrick Steinhardt 1bbdf15d 2020-06-01T13:57:12 Merge pull request #5527 from libgit2/ethomson/config_unreadable Handle unreadable configuration files
Edward Thomson 9df69223 2020-05-23T11:42:19 config: test that unreadable files are treated as notfound
Patrick Wang 1a899008 2020-05-26T20:36:13 tests: index::version: write v4 index: re-open repo to read written v4 index The `git_index_free()` merely decrement the reference counter from 2 to 1, and does not "free" the index. Thus, the following `git_repository_index()` merely increase the counter to 2, instead of read index from disk. The written index is not read and parsed, which makes this test case effectively becomes a no-op.
Josh Triplett 5278a006 2020-05-23T16:07:54 git_packbuilder_write: Allow setting path to NULL to use the default path If given a NULL path, write to the object path of the repository. Add tests for the new behavior.
Edward Thomson 3414d470 2020-05-23T16:27:56 diff::workdir: actually test the buffers The static test data is erroneously initialized with a length of 0 for three of the strings. This means the tests are not actually examining those strings. Provide the length.
Edward Thomson f88e12db 2020-05-23T09:35:53 checkout::index: free the index
Patrick Steinhardt 915f8860 2020-05-16T14:00:11 tests: checkout: fix stylistic issues and static variable The test case checkout::index::can_disable_pathspec_match has some shortcomings when it comes to coding style, which didn't fit our own coding style. Furthermore, it had an unnecessary static local variable. The test has been refactored to address these issues.
Patrick Steinhardt 0cf9b666 2020-05-12T11:41:44 tests: merge: fix printf formatter on 32 bit arches We currently use `PRIuMAX` to print an integer of type `size_t` in merge::trees::rename::cache_recomputation. While this works just fine on 64 bit arches, it doesn't on 32 bit ones. As a result, our nightly builds on x86 and arm32 fail. Fix the issue by using `PRIuZ` instead.
Edward Thomson cbae1c21 2020-04-01T22:12:07 assert: allow non-int returning functions to assert Include GIT_ASSERT_WITH_RETVAL and GIT_ASSERT_ARG_WITH_RETVAL so that functions that do not return int (or more precisely, where `-1` would not be an error code) can assert. This allows functions that return, eg, NULL on an error code to do that by passing the return value (in this example, `NULL`) as a second parameter to the GIT_ASSERT_WITH_RETVAL functions.
Edward Thomson a95096ba 2020-01-12T10:31:07 assert: optionally fall-back to assert(3) Fall back to the system assert(3) in debug builds, which may aide in debugging. "Safe" assertions can be enabled in debug builds by setting GIT_ASSERT_HARD=0. Similarly, hard assertions can be enabled in release builds by setting GIT_ASSERT_HARD to nonzero.
Edward Thomson abe2efe1 2019-12-09T12:37:34 Introduce GIT_ASSERT macros Provide macros to replace usages of `assert`. A true `assert` is punishing as a library. Instead we should do our best to not crash. GIT_ASSERT_ARG(x) will now assert that the given argument complies to some format and sets an error message and returns `-1` if it does not. GIT_ASSERT(x) is for internal usage, and available as an internal consistency check. It will set an error message and return `-1` in the event of failure.
Segev Finer d62e44cb 2019-06-03T18:35:08 checkout: Fix removing untracked files by path in subdirectories The checkout code didn't iterate into a subdir if it didn't match the pathspec, but since the pathspec might match files in the subdir we should recurse into it (In contrast to gitignore handling). Fixes #5089
Edward Thomson 8731e1f4 2020-02-02T19:01:15 tests::checkout: only examine test10 and test11.txt The checkout::index::can_disable_pathspec_match test attempts to set a path filter of `test11.txt` and `test12.txt`, but then validates that `test10.txt` and `test11.txt` were left unmodified. Update the test's path filter to match the expectation.
Felix Lapalme 24bd12c4 2020-02-02T01:00:15 Create test case demonstrating checkout bug w/ pathspec match disabled
Carl Schwan 9830ab3d 2020-01-29T02:00:04 blame: add option to ignore whitespace changes
Patrick Steinhardt 5a1ec7ab 2020-04-04T13:37:13 Merge pull request #5480 from libgit2/ethomson/coverity repo::open: ensure we can open the repository
Patrick Steinhardt 966db47d 2020-04-04T13:21:02 Merge pull request #5477 from pks-t/pks/rename-detection-negative-caches merge: cache negative cache results for similarity metrics
Edward Thomson cb0cfc5a 2020-04-03T09:17:52 repo::open: ensure we can open the repository Update the test cases to check the `git_repository_open` return code.
Patrick Steinhardt dfd7fcc4 2020-04-02T13:26:13 Merge pull request #5388 from bk2204/repo-format-v1 Handle repository format v1
Patrick Steinhardt 4dfcc50f 2020-04-01T15:16:18 merge: cache negative cache results for similarity metrics When computing renames, we cache the hash signatures for each of the potentially conflicting entries so that we do not need to repeatedly read the file and can at least halfway efficiently determine whether two files are similar enough to be deemed a rename. In order to make the hash signatures meaningful, we require at least four lines of data to be present, resulting in at least four different hashes that can be compared. Files that are deemed too small are not cached at all and will thus be repeatedly re-hashed, which is usually not a huge issue. The issue with above heuristic is in case a file does _not_ have at least four lines, where a line is anything separated by a consecutive run of "\n" or "\0" characters. For example "a\nb" is two lines, but "a\0\0b" is also just two lines. Taken to the extreme, a file that has megabytes of consecutive space- or NUL-only may also be deemed as too small and thus not get cached. As a result, we will repeatedly load its blob, calculate its hash signature just to finally throw it away as we notice it's not of any value. When you've got a comparitively big file that you compare against a big set of potentially renamed files, then the cost simply expodes. The issue can be trivially fixed by introducing negative cache entries. Whenever we determine that a given blob does not have a meaningful representation via a hash signature, we store this negative cache marker and will from then on not hash it again, but also ignore it as a potential rename target. This should help the "normal" case already where you have a lot of small files as rename candidates, but in the above scenario it's savings are extraordinarily high. To verify we do not hit the issue anymore with described solution, this commit adds a test that uses the exact same setup described above with one 50 megabyte blob of '\0' characters and 1000 other files that get renamed. Without the negative cache: $ time ./libgit2_clar -smerge::trees::renames::cache_recomputation >/dev/null real 11m48.377s user 11m11.576s sys 0m35.187s And with the negative cache: $ time ./libgit2_clar -smerge::trees::renames::cache_recomputation >/dev/null real 0m1.972s user 0m1.851s sys 0m0.118s So this represents a ~350-fold performance improvement, but it obviously depends on how many files you have and how big the blob is. The test number were chosen in a way that one will immediately notice as soon as the bug resurfaces.
Patrick Steinhardt 5f47cb48 2020-03-26T14:16:41 patch: correctly handle mode changes for renames When generating a patch for a renamed file whose mode bits have changed in addition to the rename, then we currently fail to parse the generated patch. Furthermore, when generating a diff we output mode bits after the similarity metric, which is different to how upstream git handles it. Fix both issues by adding another state transition that allows similarity indices after mode changes and by printing mode changes before the similarity index.
lhchavez 62d59467 2020-03-08T02:13:11 Fix segfault when calling git_blame_buffer() This change makes sure that the hunk is not null before trying to dereference it. This avoids segfaults, especially when blaming against a modified buffer (i.e. the index). Fixes: #5443
Patrick Steinhardt 163db8f2 2020-02-28T18:53:22 win32: test relative symlinks Ensure that we don't canonicalize symlink targets.
Edward Thomson f2b114ba 2020-03-08T18:11:45 win32: introduce relative path handling function Add a function that takes a (possibly) relative UTF-8 path and emits a UTF-16 path with forward slashes translated to backslashes. If the given path is, in fact, absolute, it will be translated to absolute path handling rules.
Edward Thomson fb7da154 2020-03-08T16:34:23 win32: clarify usage of path canonicalization funcs The path canonicalization functions on win32 are intended to canonicalize absolute paths; those with prefixes. In other words, things start with drive letters (`C:\`), share names (`\\server\share`), or other prefixes (`\\?\`). This function removes leading `..` that occur after the prefix but before the directory/file portion (eg, turning `C:\..\..\..\foo` into `C:\foo`). This translation is not appropriate for local paths.
Patrick Steinhardt 81370261 2020-02-19T15:57:39 Merge pull request #5374 from pks-t/pks/diff-with-empty-subtree tests: diff: verify that we are able to diff with empty subtrees
Patrick Steinhardt 8aa04a37 2020-02-19T12:14:16 Merge pull request #5391 from pks-t/pks/coverity-fixes Coverity fixes
Patrick Steinhardt eaa70c6c 2020-02-18T18:09:11 tests: object: decrease number of concurrent cache accesses In our test case object::cache::fast_thread_rush, we're creating 100 concurrent threads opening a repository and reading objects from it. This test actually fails on ARM32 with an out-of-memory error, which isn't entirely unexpected. Work around the issue by halving the number of threads.
brian m. carlson 06f02300 2020-02-07T00:33:52 repository: handle format v1 Git has supported repository format version 1 for some time. This format is just like version 0, but it supports extensions. Implementations must reject extensions that they don't support. Add support for this format version and reject any extensions but extensions.noop, which is the only extension we currently support. While we're at it, also clean up an error message.
Patrick Steinhardt 17670ef2 2020-02-04T10:58:51 tests: diff: add test to verify behaviour with empty dir ordering It was reported that, given a file "abc.txt", a diff will be shown if an empty directory "abb/" is created, but not if "abd/" is created. Add a test to verify that we do the right thing here and do not depend on any ordering.
Patrick Steinhardt b0691db3 2020-01-31T09:39:12 tests: diff: verify that we are able to diff with empty subtrees While it is not allowed for a tree to have an empty tree as child (e.g. an empty directory), libgit2's tree builder makes it easy to create such trees. As a result, some applications may inadvertently end up with such an invalid tree, and we should try our best and handle them. One such case is when diffing two trees, where one of both trees has such an empty subtree. It was reported that this will cause our diff code to fail. While I wasn't able to reproduce this error, let's still add a test that verifies we continue to handle them correctly.
Patrick Steinhardt 26b71d60 2020-02-07T14:36:10 tests: iterator: fix iterator expecting too few items The testcase iterator::workdir::filesystem_gunk sets up quite a lot of directories, which is why it only runs in case GITTEST_INVASIVE_SPEED is set in the environment. Because we do not run our default CI with this variable, we didn't notice commit 852c83ee4 (refs: refuse to delete HEAD, 2020-01-15) breaking the test as it introduced a new reference to the "testrepo" repository. Fix the oversight by increasing the number of expected iterator items.
Patrick Steinhardt 2e6cbff8 2020-02-07T11:53:51 tests: add missing error checks We should always verify error codes returned by function calls in our test suite to not accidentally miss any weird results. Coverity reported missing checks in several locations, which this commit fixes.
Patrick Steinhardt 7d65d4cb 2020-02-07T11:39:24 tests: blame: fix conversion specifiers in format string While the blame helper function `hunk_message` accepts a printf-style format string, we didn't add a compiler attribute to let the compiler check for correct conversion specifiers. As a result, some users of the function used wrong specifiers. Add the GIT_FORMAT_PRINTF attribute to the function and fix resulting warnings by using the correct specifiers.
Patrick Steinhardt 46228d86 2020-02-06T11:10:27 transports: http: fix custom headers not being applied In commit b9c5b15a7 (http: use the new httpclient, 2019-12-22), the HTTP code got refactored to extract a generic HTTP client that operates independently of the Git protocol. Part of refactoring was the creation of a new `git_http_request` struct that encapsulates the generation of requests. Our Git-specific HTTP transport was converted to use that in `generate_request`, but during the process we forgot to set up custom headers for the `git_http_request` and as a result we do not send out these headers anymore. Fix the issue by correctly setting up the request's custom headers and add a test to verify we correctly send them.
Patrick Steinhardt 93a9044f 2020-01-31T08:49:34 fetchhead: strip credentials from remote URL If fetching from an anonymous remote via its URL, then the URL gets written into the FETCH_HEAD reference. This is mainly done to give valuable context to some commands, like for example git-merge(1), which will put the URL into the generated MERGE_MSG. As a result, what gets written into FETCH_HEAD may become public in some cases. This is especially important considering that URLs may contain credentials, e.g. when cloning 'https://foo:bar@example.com/repo' we persist the complete URL into FETCH_HEAD and put it without any kind of sanitization into the MERGE_MSG. This is obviously bad, as your login data has now just leaked as soon as you do git-push(1). When writing the URL into FETCH_HEAD, upstream git does strip credentials first. Let's do the same by trying to parse the remote URL as a "real" URL, removing any credentials and then re-formatting the URL. In case this fails, e.g. when it's a file path or not a valid URL, we just fall back to using the URL as-is without any sanitization. Add tests to verify our behaviour.
Edward Thomson 3f54ba8b 2020-01-18T13:51:40 credential: change git_cred to git_credential We avoid abbreviations where possible; rename git_cred to git_credential. In addition, we have standardized on a trailing `_t` for enum types, instead of using "type" in the name. So `git_credtype_t` has become `git_credential_t` and its members have become `GIT_CREDENTIAL` instead of `GIT_CREDTYPE`. Finally, the source and header files have been renamed to `credential` instead of `cred`. Keep previous name and values as deprecated, and include the new header files from the previous ones.
Edward Thomson 7fd9b3f5 2020-01-01T20:48:15 ci: add NTLM tests Download poxygit, a debugging git server, and clone from it using NTLM, both IIS-style (with connection affinity) and Apache-style ("broken", requiring constant reauthentication).
Edward Thomson bf55facf 2019-10-25T12:24:34 tests: allow users to use expect/continue
Edward Thomson dcd3b815 2019-12-13T15:28:57 tests: support CLAR_TRACE_LEVEL The CLAR_TRACE_LEVEL environment variable was supported when building with GIT_TRACE. Now we always build with GIT_TRACE, but that variable is not provided to tests. Simply support clar tracing always.
Edward Thomson e995f74e 2019-12-06T15:39:08 net: introduce git_net_url_joinpath Provide a mechanism to add a path and query string to an existing url so that we can easily append `/info/refs?...` type url segments to a url given to us by a user.
Edward Thomson 471daeea 2019-12-01T14:00:49 net: refactor gitno redirect handling Move the redirect handling into `git_net_url` for consistency.
Edward Thomson fe4efe2e 2019-12-03T10:17:30 tests: test that clone returns 4321 This conditional was backwards. We should instead test that clone returns 4321, not that 4321 returns clone.
Edward Thomson e5fb5fe5 2019-10-20T17:19:01 ci: perform SPNEGO tests Attempt to obtain a Kerberos ticket from LIBGIT2.ORG and then clone the Negotiate-protected site at test.libgit2.org with that ticket.
Edward Thomson 94beb3a3 2020-01-18T14:03:23 merge: update enum type name for consistency libgit2 does not use `type_t` suffixes as it's redundant; thus, rename `git_merge_diff_type_t` to `git_merge_diff_t` for consistency.
Patrick Steinhardt 1908884d 2020-01-17T08:34:30 Merge pull request #5361 from csware/no-return-freed_object Do not return free'd git_repository object on error
Sven Strickroth 470a05d0 2020-01-16T17:53:50 Do not return free'd git_repository object on error Regression introduced in commit dde6d9c706bf1ecab545da55ab874a016587af1f. This issue causes lots of crashes in TortoiseGit. Signed-off-by: Sven Strickroth <email@cs-ware.de>
Josh Bleecher Snyder 852c83ee 2020-01-15T13:31:21 refs: refuse to delete HEAD This requires adding a new symbolic ref to the testrepo fixture. Some of the existing tests attempt to delete HEAD, expecting a different failure. Introduce and use a non-HEAD symbolic ref instead. Adjust a few other tests as needed. Fixes #5357
Patrick Steinhardt 7d55bee6 2020-01-10T12:44:51 win32: fix relative symlinks pointing into dirs On Windows platforms, we need some logic to emulate symlink(3P) defined by POSIX. As unprivileged symlinks on Windows are a rather new feature, our current implementation is comparatively new and still has some rough edges in special cases. One such case is relative symlinks. While relative symlinks to files in the same directory work as expected, libgit2 currently fails to create reltaive symlinks pointing into other directories. This is due to the fact that we forgot to translate the Unix-style target path to Windows-style. Most importantly, we are currently not converting directory separators from "/" to "\". Fix the issue by calling `git_win32_path_canonicalize` on the target. Add a test that verifies our ability to create such relative links across directories.
Josh Bleecher Snyder 7142964f 2019-12-13T10:56:19 netops: handle intact query parameters in service_suffix removal Some servers leave the query parameters intact in the Location header when responding with a redirect. The service_suffix removal check as written assumed that the server removed them. Handle both cases. Along with PR #5325, this fixes #5321. There are two new tests. The first already passed; the second previously failed.
Patrick Steinhardt 2dc7b5ef 2019-12-14T12:53:04 tests: pack: add missing asserts around `git_packbuilder_write`
Patrick Steinhardt 11e8ee1f 2020-01-06T15:41:18 tests: submodule: verify setup of relative URLs When setting up relative URLs for a submodule, then we resolve it to the actual location and write that into ".git/config" instead of writing the relative value. We do not yet have a test to nail down this behaviour, which is now being added by this commit.
Patrick Steinhardt 2f6f10bb 2019-12-13T13:35:40 Merge pull request #5300 from tiennou/fix/branch-documentation branch: clarify documentation around branches
Etienne Samson 97b8491b 2019-12-08T15:25:52 refs: rename git_reference__set_name to git_reference__realloc As git_reference__name will reallocate storage to account for longer names (it's actually allocator-dependent), it will cause all existing pointers to the old object to become dangling, as they now point to freed memory. Fix the issue by renaming to a more descriptive name, and pass a pointer to the actual reference that can safely be invalidated if the realloc succeeds.
Patrick Steinhardt b3178587 2019-12-13T08:35:25 Merge pull request #5333 from lrm29/attr_binary_macro attr: Update definition of binary macro
Laurence McGlashan cf286d5e 2019-12-12T10:58:56 attr: Update definition of binary macro
Edward Thomson 14ff3516 2019-12-03T23:15:47 path: support non-ascii drive letters on dos Windows/DOS only supports drive letters that are alpha characters A-Z. However, you can `subst` any one-character as a drive letter, including numbers or even emoji. Test that we can identify emoji as drive letters.
Edward Thomson 85d4ff77 2019-12-03T19:50:18 index: ensure that we respect core.protectNTFS=false Users may want to turn off core.protectNTFS, perhaps to import (and then repair) a broken tree. Ensure that core.protectNTFS=false is honored.
Edward Thomson ba4c769b 2019-12-03T23:23:02 tree: ensure we protect NTFS paths everywhere
Edward Thomson e4034dfa 2019-12-03T19:24:59 path: protect NTFS everywhere Enable core.protectNTFS by default everywhere and in every codepath, not just on checkout.
Edward Thomson d9c0c9cf 2019-12-03T19:17:41 test: ensure we can't add a protected path Test that when we enable core.protectNTFS that we cannot add platform-specific invalid paths to the index.
Edward Thomson 72df1cd8 2019-12-03T19:01:00 test: improve badname verification test The name of the `add_invalid_filename` function suggests that we _want_ to add an invalid filename. Rename the function to show that we expect to _fail_ to add the invalid filename.
Edward Thomson f3b28604 2019-12-03T18:57:16 test: ensure treebuilder validate new protection rules Ensure that the new protection around .git::$INDEX_ALLOCATION rules are enabled for using the treebuilder when core.protectNTFS is set.
Edward Thomson 336991db 2019-12-03T18:56:31 test: ensure index adds validate new protection rules Ensure that the new protection around .git::$INDEX_ALLOCATION rules are enabled for adding to the index when core.protectNTFS is set.
Edward Thomson a3cbd204 2019-12-03T18:49:23 test: improve badname verification test The name of the `write_invalid_filename` function suggests that we _want_ to write an invalid filename. Rename the function to show that we expect to _fail_ to write the invalid filename.
Johannes Schindelin e1832eb2 2019-09-18T16:33:18 path: also guard `.gitmodules` against NTFS Alternate Data Streams We just safe-guarded `.git` against NTFS Alternate Data Stream-related attack vectors, and now it is time to do the same for `.gitmodules`. Note: In the added regression test, we refrain from verifying all kinds of variations between short names and NTFS Alternate Data Streams: as the new code disallows _all_ Alternate Data Streams of `.gitmodules`, it is enough to test one in order to know that all of them are guarded against. Signed-off-by: Johannes Schindelin <johannes.schindelin@gmx.de>
Johannes Schindelin 3f7851ea 2019-09-18T14:32:05 Disallow NTFS Alternate Data Stream attacks, even on Linux/macOS A little-known feature of NTFS is that it offers to store metadata in so-called "Alternate Data Streams" (inspired by Apple's "resource forks") that are copied together with the file they are associated with. These Alternate Data Streams can be accessed via `<file name>:<stream name>:<stream type>`. Directories, too, have Alternate Data Streams, and they even have a default stream type `$INDEX_ALLOCATION`. Which means that `abc/` and `abc::$INDEX_ALLOCATION/` are actually equivalent. This is of course another attack vector on the Git directory that we definitely want to prevent. On Windows, we already do this incidentally, by disallowing colons in file/directory names. While it looks as if files'/directories' Alternate Data Streams are not accessible in the Windows Subsystem for Linux, and neither via CIFS/SMB-mounted network shares in Linux, it _is_ possible to access them on SMB-mounted network shares on macOS. Therefore, let's go the extra mile and prevent this particular attack _everywhere_. To keep things simple, let's just disallow *any* Alternate Data Stream of `.git`. This is libgit2's variant of CVE-2019-1352. Signed-off-by: Johannes Schindelin <johannes.schindelin@gmx.de>
Johannes Schindelin 64c612cc 2019-09-18T15:25:02 Protect against 8.3 "short name" attacks also on Linux/macOS The Windows Subsystem for Linux (WSL) is getting increasingly popular, in particular because it makes it _so_ easy to run Linux software on Windows' files, via the auto-mounted Windows drives (`C:\` is mapped to `/mnt/c/`, no need to set that up manually). Unfortunately, files/directories on the Windows drives can be accessed via their _short names_, if that feature is enabled (which it is on the `C:` drive by default). Which means that we have to safeguard even our Linux users against the short name attacks. Further, while the default options of CIFS/SMB-mounts seem to disallow accessing files on network shares via their short names on Linux/macOS, it _is_ possible to do so with the right options. So let's just safe-guard against short name attacks _everywhere_. Signed-off-by: Johannes Schindelin <johannes.schindelin@gmx.de>
Johannes Schindelin d29d4de2 2019-09-18T15:08:56 cl_git_fail: do not report bogus error message When we expect a checkout operation to fail, but it succeeds, we actually do not want to see the error messages that were generated in the meantime for errors that were handled gracefully by the code (e.g. when an object could not be found in a pack: in this case, the next backend would have been given a chance to look up the object, and probably would have found it because the checkout succeeded, after all). Which means that in the specific case of `cl_git_fail()`, we actually want to clear the global error state _after_ evaluating the command: we know that any still-available error would be bogus, seeing as the command succeeded (unexpectedly). Signed-off-by: Johannes Schindelin <johannes.schindelin@gmx.de>
Edward Thomson 7f6fdb82 2019-12-01T14:11:22 Merge pull request #5312 from pks-t/pks/patch-base85-overflow patch_parse: fix out-of-bounds reads caused by integer underflow
Edward Thomson 7f20778b 2019-11-29T09:14:04 Merge pull request #5311 from pks-t/pks/clar-trace-warning tests: fix compiler warning if tracing is disabled
Patrick Steinhardt 361ebbcb 2019-11-28T15:36:40 tests: config: only test parsing huge file with GITTEST_INVASIVE_SPEED The test in config::stress::huge_section_with_many_values takes quite a long time to execute. Hide it behind the GITTEST_INVASIVE_SPEED environment varibale to not needlessly blow up execution time of tests. As this environment variable is being set by the continuous integration, we will execute it regularly anyway.
Patrick Steinhardt 33e6c402 2019-11-28T15:26:36 patch_parse: fix out-of-bounds reads caused by integer underflow The patch format for binary files is a simple Base85 encoding with a length byte as prefix that encodes the current line's length. For each line, we thus check whether the line's actual length matches its expected length in order to not faultily apply a truncated patch. This also acts as a check to verify that we're not reading outside of the line's string: if (encoded_len > ctx->parse_ctx.line_len - 1) { error = git_parse_err(...); goto done; } There is the possibility for an integer underflow, though. Given a line with a single prefix byte, only, `line_len` will be zero when reaching this check. As a result, subtracting one from that will result in an integer underflow, causing us to assume that there's a wealth of bytes available later on. Naturally, this may result in an out-of-bounds read. Fix the issue by checking both `encoded_len` and `line_len` for a non-zero value. The binary format doesn't make use of zero-length lines anyway, so we need to know that there are both encoded bytes and remaining characters available at all. This patch also adds a test that works based on the last error message. Checking error messages is usually too tightly coupled, but in fact parsing the patch failed even before the change. Thus the only possibility is to use e.g. Valgrind, but that'd result in us not catching issues when run without Valgrind. As a result, using the error message is considered a viable tradeoff as we know that we didn't start decoding Base85 in the first place.
Patrick Steinhardt 1d470a71 2019-11-28T14:45:15 tests: fix compiler warning if tracing is disabled If building libgit2's test suite with tracing disabled, then the compiler will emit a warning due to the unused `message_prefix` function. Fix the issue by wrapping the whole file into ifdef's for `GIT_TRACE` and providing separate empty function implementations for both `cl_global_trace_register` and `cl_global_trace_disable`.
Patrick Steinhardt fb439c97 2019-11-28T14:41:58 Merge pull request #5306 from herrerog/patchid diff: complete support for git patchid
Patrick Steinhardt 61176a9b 2019-11-28T14:31:16 Merge pull request #5243 from pks-t/pks/config-optimize-mem Memory optimizations for config entries
Gregory Herrero ece5bb5e 2019-11-07T14:10:00 diff: make patchid computation work with all types of commits. Current implementation of patchid is not computing a correct patchid when given a patch where, for example, a new file is added or removed. Some more corner cases need to be handled to have same behavior as git patch-id command. Add some more tests to cover those corner cases. Signed-off-by: Gregory Herrero <gregory.herrero@oracle.com>
Patrick Steinhardt b63ad958 2019-11-28T13:19:50 Merge pull request #5309 from libgit2/ethomson/trace Improve trace support in tests