thodg/libgit2/tests

Diff

  • Show log

    Commit

  • Hash : 93a9044f
    Author : Patrick Steinhardt
    Date : 2020-01-31T08:49:34 

    fetchhead: strip credentials from remote URL

If fetching from an anonymous remote via its URL, then the URL gets
written into the FETCH_HEAD reference. This is mainly done to give
valuable context to some commands, like for example git-merge(1), which
will put the URL into the generated MERGE_MSG. As a result, what gets
written into FETCH_HEAD may become public in some cases. This is
especially important considering that URLs may contain credentials, e.g.
when cloning 'https://foo:bar@example.com/repo' we persist the complete
URL into FETCH_HEAD and put it without any kind of sanitization into the
MERGE_MSG. This is obviously bad, as your login data has now just leaked
as soon as you do git-push(1).

When writing the URL into FETCH_HEAD, upstream git does strip
credentials first. Let's do the same by trying to parse the remote URL
as a "real" URL, removing any credentials and then re-formatting the
URL. In case this fails, e.g. when it's a file path or not a valid URL,
we just fall back to using the URL as-is without any sanitization. Add
tests to verify our behaviour.

  • README.md

  • Writing Clar tests for libgit2

    For information on the Clar testing framework and a detailed introduction please visit:

    https://github.com/vmg/clar

    • Write your modules and tests. Use good, meaningful names.

    • Make sure you actually build the tests by setting: 

        cmake -DBUILD_CLAR=ON build/

    • Test: 

        ./build/libgit2_clar

    • Make sure everything is fine.

    • Send your pull request. That’s it.

    Memory leak checks

    These are automatically run as part of CI, but if you want to check locally:

    Linux

    Uses valgrind:

    $ cmake -DBUILD_CLAR=ON -DVALGRIND=ON ..
$ cmake --build .
$ valgrind --leak-check=full --show-reachable=yes --num-callers=50 --suppressions=../libgit2_clar.supp \
  ./libgit2_clar

    macOS

    Uses leaks, which requires XCode installed:

    $ MallocStackLogging=1 MallocScribble=1 MallocLogFile=/dev/null CLAR_AT_EXIT="leaks -quiet \$PPID" \
  ./libgit2_clar

kmx.io     mail     discord kmxgit v0.4.0