Merge branch 'main' of github.com:git/git
[alt-git.git] / t / t7450-bad-git-dotfiles.sh
blob2c24f120da3591305b073d247e21e3c07cff9386
1 #!/bin/sh
3 test_description='check broken or malicious patterns in .git* files
5 Such as:
7 - presence of .. in submodule names;
8 Exercise the name-checking function on a variety of names, and then give a
9 real-world setup that confirms we catch this in practice.
11 - nested submodule names
13 - symlinked .gitmodules, etc
15 . ./test-lib.sh
16 . "$TEST_DIRECTORY"/lib-pack.sh
18 test_expect_success 'check names' '
19 cat >expect <<-\EOF &&
20 valid
21 valid/with/paths
22 EOF
24 test-tool submodule check-name >actual <<-\EOF &&
25 valid
26 valid/with/paths
28 ../foo
29 /../foo
30 ..\foo
31 \..\foo
32 foo/..
33 foo/../
34 foo\..
35 foo\..\
36 foo/../bar
37 EOF
39 test_cmp expect actual
42 test_expect_success 'create innocent subrepo' '
43 git init innocent &&
44 git -C innocent commit --allow-empty -m foo
47 test_expect_success 'submodule add refuses invalid names' '
48 test_must_fail \
49 git submodule add --name ../../modules/evil "$PWD/innocent" evil
52 test_expect_success 'add evil submodule' '
53 git submodule add "$PWD/innocent" evil &&
55 mkdir modules &&
56 cp -r .git/modules/evil modules &&
57 write_script modules/evil/hooks/post-checkout <<-\EOF &&
58 echo >&2 "RUNNING POST CHECKOUT"
59 EOF
61 git config -f .gitmodules submodule.evil.update checkout &&
62 git config -f .gitmodules --rename-section \
63 submodule.evil submodule.../../modules/evil &&
64 git add modules &&
65 git commit -am evil
68 # This step seems like it shouldn't be necessary, since the payload is
69 # contained entirely in the evil submodule. But due to the vagaries of the
70 # submodule code, checking out the evil module will fail unless ".git/modules"
71 # exists. Adding another submodule (with a name that sorts before "evil") is an
72 # easy way to make sure this is the case in the victim clone.
73 test_expect_success 'add other submodule' '
74 git submodule add "$PWD/innocent" another-module &&
75 git add another-module &&
76 git commit -am another
79 test_expect_success 'clone evil superproject' '
80 git clone --recurse-submodules . victim >output 2>&1 &&
81 ! grep "RUNNING POST CHECKOUT" output
84 test_expect_success 'fsck detects evil superproject' '
85 test_must_fail git fsck
88 test_expect_success 'transfer.fsckObjects detects evil superproject (unpack)' '
89 rm -rf dst.git &&
90 git init --bare dst.git &&
91 git -C dst.git config transfer.fsckObjects true &&
92 test_must_fail git push dst.git HEAD
95 test_expect_success 'transfer.fsckObjects detects evil superproject (index)' '
96 rm -rf dst.git &&
97 git init --bare dst.git &&
98 git -C dst.git config transfer.fsckObjects true &&
99 git -C dst.git config transfer.unpackLimit 1 &&
100 test_must_fail git push dst.git HEAD
103 # Normally our packs contain commits followed by trees followed by blobs. This
104 # reverses the order, which requires backtracking to find the context of a
105 # blob. We'll start with a fresh gitmodules-only tree to make it simpler.
106 test_expect_success 'create oddly ordered pack' '
107 git checkout --orphan odd &&
108 git rm -rf --cached . &&
109 git add .gitmodules &&
110 git commit -m odd &&
112 pack_header 3 &&
113 pack_obj $(git rev-parse HEAD:.gitmodules) &&
114 pack_obj $(git rev-parse HEAD^{tree}) &&
115 pack_obj $(git rev-parse HEAD)
116 } >odd.pack &&
117 pack_trailer odd.pack
120 test_expect_success 'transfer.fsckObjects handles odd pack (unpack)' '
121 rm -rf dst.git &&
122 git init --bare dst.git &&
123 test_must_fail git -C dst.git unpack-objects --strict <odd.pack
126 test_expect_success 'transfer.fsckObjects handles odd pack (index)' '
127 rm -rf dst.git &&
128 git init --bare dst.git &&
129 test_must_fail git -C dst.git index-pack --strict --stdin <odd.pack
132 test_expect_success 'index-pack --strict works for non-repo pack' '
133 rm -rf dst.git &&
134 git init --bare dst.git &&
135 cp odd.pack dst.git &&
136 test_must_fail git -C dst.git index-pack --strict odd.pack 2>output &&
137 # Make sure we fail due to bad gitmodules content, not because we
138 # could not read the blob in the first place.
139 grep gitmodulesName output
142 check_dotx_symlink () {
143 fsck_must_fail=test_must_fail
144 fsck_prefix=error
145 refuse_index=t
146 case "$1" in
147 --warning)
148 fsck_must_fail=
149 fsck_prefix=warning
150 refuse_index=
151 shift
153 esac
155 name=$1
156 type=$2
157 path=$3
158 dir=symlink-$name-$type
160 test_expect_success "set up repo with symlinked $name ($type)" '
161 git init $dir &&
163 cd $dir &&
165 # Make the tree directly to avoid index restrictions.
167 # Because symlinks store the target as a blob, choose
168 # a pathname that could be parsed as a .gitmodules file
169 # to trick naive non-symlink-aware checking.
170 tricky="[foo]bar=true" &&
171 content=$(git hash-object -w ../.gitmodules) &&
172 target=$(printf "$tricky" | git hash-object -w --stdin) &&
174 printf "100644 blob $content\t$tricky\n" &&
175 printf "120000 blob $target\t$path\n"
176 } >bad-tree
177 ) &&
178 tree=$(git -C $dir mktree <$dir/bad-tree)
181 test_expect_success "fsck detects symlinked $name ($type)" '
183 cd $dir &&
185 # Check not only that we fail, but that it is due to the
186 # symlink detector
187 $fsck_must_fail git fsck 2>output &&
188 grep "$fsck_prefix.*tree $tree: ${name}Symlink" output
192 test -n "$refuse_index" &&
193 test_expect_success "refuse to load symlinked $name into index ($type)" '
194 test_must_fail \
195 git -C $dir \
196 -c core.protectntfs \
197 -c core.protecthfs \
198 read-tree $tree 2>err &&
199 grep "invalid path.*$name" err &&
200 git -C $dir ls-files -s >out &&
201 test_must_be_empty out
205 check_dotx_symlink gitmodules vanilla .gitmodules
206 check_dotx_symlink gitmodules ntfs ".gitmodules ."
207 check_dotx_symlink gitmodules hfs ".${u200c}gitmodules"
209 check_dotx_symlink --warning gitattributes vanilla .gitattributes
210 check_dotx_symlink --warning gitattributes ntfs ".gitattributes ."
211 check_dotx_symlink --warning gitattributes hfs ".${u200c}gitattributes"
213 check_dotx_symlink --warning gitignore vanilla .gitignore
214 check_dotx_symlink --warning gitignore ntfs ".gitignore ."
215 check_dotx_symlink --warning gitignore hfs ".${u200c}gitignore"
217 check_dotx_symlink --warning mailmap vanilla .mailmap
218 check_dotx_symlink --warning mailmap ntfs ".mailmap ."
219 check_dotx_symlink --warning mailmap hfs ".${u200c}mailmap"
221 test_expect_success 'fsck detects non-blob .gitmodules' '
222 git init non-blob &&
224 cd non-blob &&
226 # As above, make the funny tree directly to avoid index
227 # restrictions.
228 mkdir subdir &&
229 cp ../.gitmodules subdir/file &&
230 git add subdir/file &&
231 git commit -m ok &&
232 git ls-tree HEAD | sed s/subdir/.gitmodules/ | git mktree &&
234 test_must_fail git fsck 2>output &&
235 test_i18ngrep gitmodulesBlob output
239 test_expect_success 'fsck detects corrupt .gitmodules' '
240 git init corrupt &&
242 cd corrupt &&
244 echo "[broken" >.gitmodules &&
245 git add .gitmodules &&
246 git commit -m "broken gitmodules" &&
248 git fsck 2>output &&
249 test_i18ngrep gitmodulesParse output &&
250 test_i18ngrep ! "bad config" output
254 test_expect_success WINDOWS 'prevent git~1 squatting on Windows' '
255 git init squatting &&
257 cd squatting &&
258 mkdir a &&
259 touch a/..git &&
260 git add a/..git &&
261 test_tick &&
262 git commit -m initial &&
264 modules="$(test_write_lines \
265 "[submodule \"b.\"]" "url = ." "path = c" \
266 "[submodule \"b\"]" "url = ." "path = d\\\\a" |
267 git hash-object -w --stdin)" &&
268 rev="$(git rev-parse --verify HEAD)" &&
269 hash="$(echo x | git hash-object -w --stdin)" &&
270 test_must_fail git update-index --add \
271 --cacheinfo 160000,$rev,d\\a 2>err &&
272 test_i18ngrep "Invalid path" err &&
273 git -c core.protectNTFS=false update-index --add \
274 --cacheinfo 100644,$modules,.gitmodules \
275 --cacheinfo 160000,$rev,c \
276 --cacheinfo 160000,$rev,d\\a \
277 --cacheinfo 100644,$hash,d./a/x \
278 --cacheinfo 100644,$hash,d./a/..git &&
279 test_tick &&
280 git -c core.protectNTFS=false commit -m "module"
281 ) &&
282 if test_have_prereq MINGW
283 then
284 test_must_fail git -c core.protectNTFS=false \
285 clone --recurse-submodules squatting squatting-clone 2>err &&
286 test_i18ngrep -e "directory not empty" -e "not an empty directory" err &&
287 ! grep gitdir squatting-clone/d/a/git~2
291 test_expect_success 'git dirs of sibling submodules must not be nested' '
292 git init nested &&
293 test_commit -C nested nested &&
295 cd nested &&
296 cat >.gitmodules <<-EOF &&
297 [submodule "hippo"]
298 url = .
299 path = thing1
300 [submodule "hippo/hooks"]
301 url = .
302 path = thing2
304 git clone . thing1 &&
305 git clone . thing2 &&
306 git add .gitmodules thing1 thing2 &&
307 test_tick &&
308 git commit -m nested
309 ) &&
310 test_must_fail git clone --recurse-submodules nested clone 2>err &&
311 test_i18ngrep "is inside git dir" err
314 test_done