3 test_description
='check broken or malicious patterns in .git* files
7 - presence of .. in submodule names;
8 Exercise the name-checking function on a variety of names, and then give a
9 real-world setup that confirms we catch this in practice.
11 - nested submodule names
13 - symlinked .gitmodules, etc
16 .
"$TEST_DIRECTORY"/lib-pack.sh
18 test_expect_success
'check names' '
19 cat >expect <<-\EOF &&
24 test-tool submodule check-name >actual <<-\EOF &&
39 test_cmp expect actual
42 test_expect_success
'create innocent subrepo' '
44 git -C innocent commit --allow-empty -m foo
47 test_expect_success
'submodule add refuses invalid names' '
49 git submodule add --name ../../modules/evil "$PWD/innocent" evil
52 test_expect_success
'add evil submodule' '
53 git submodule add "$PWD/innocent" evil &&
56 cp -r .git/modules/evil modules &&
57 write_script modules/evil/hooks/post-checkout <<-\EOF &&
58 echo >&2 "RUNNING POST CHECKOUT"
61 git config -f .gitmodules submodule.evil.update checkout &&
62 git config -f .gitmodules --rename-section \
63 submodule.evil submodule.../../modules/evil &&
68 # This step seems like it shouldn't be necessary, since the payload is
69 # contained entirely in the evil submodule. But due to the vagaries of the
70 # submodule code, checking out the evil module will fail unless ".git/modules"
71 # exists. Adding another submodule (with a name that sorts before "evil") is an
72 # easy way to make sure this is the case in the victim clone.
73 test_expect_success
'add other submodule' '
74 git submodule add "$PWD/innocent" another-module &&
75 git add another-module &&
76 git commit -am another
79 test_expect_success
'clone evil superproject' '
80 git clone --recurse-submodules . victim >output 2>&1 &&
81 ! grep "RUNNING POST CHECKOUT" output
84 test_expect_success
'fsck detects evil superproject' '
85 test_must_fail git fsck
88 test_expect_success
'transfer.fsckObjects detects evil superproject (unpack)' '
90 git init --bare dst.git &&
91 git -C dst.git config transfer.fsckObjects true &&
92 test_must_fail git push dst.git HEAD
95 test_expect_success
'transfer.fsckObjects detects evil superproject (index)' '
97 git init --bare dst.git &&
98 git -C dst.git config transfer.fsckObjects true &&
99 git -C dst.git config transfer.unpackLimit 1 &&
100 test_must_fail git push dst.git HEAD
103 # Normally our packs contain commits followed by trees followed by blobs. This
104 # reverses the order, which requires backtracking to find the context of a
105 # blob. We'll start with a fresh gitmodules-only tree to make it simpler.
106 test_expect_success
'create oddly ordered pack' '
107 git checkout --orphan odd &&
108 git rm -rf --cached . &&
109 git add .gitmodules &&
113 pack_obj $(git rev-parse HEAD:.gitmodules) &&
114 pack_obj $(git rev-parse HEAD^{tree}) &&
115 pack_obj $(git rev-parse HEAD)
117 pack_trailer odd.pack
120 test_expect_success
'transfer.fsckObjects handles odd pack (unpack)' '
122 git init --bare dst.git &&
123 test_must_fail git -C dst.git unpack-objects --strict <odd.pack
126 test_expect_success
'transfer.fsckObjects handles odd pack (index)' '
128 git init --bare dst.git &&
129 test_must_fail git -C dst.git index-pack --strict --stdin <odd.pack
132 test_expect_success
'index-pack --strict works for non-repo pack' '
134 git init --bare dst.git &&
135 cp odd.pack dst.git &&
136 test_must_fail git -C dst.git index-pack --strict odd.pack 2>output &&
137 # Make sure we fail due to bad gitmodules content, not because we
138 # could not read the blob in the first place.
139 grep gitmodulesName output
142 check_dotx_symlink
() {
143 fsck_must_fail
=test_must_fail
158 dir
=symlink-
$name-$type
160 test_expect_success
"set up repo with symlinked $name ($type)" '
165 # Make the tree directly to avoid index restrictions.
167 # Because symlinks store the target as a blob, choose
168 # a pathname that could be parsed as a .gitmodules file
169 # to trick naive non-symlink-aware checking.
170 tricky="[foo]bar=true" &&
171 content=$(git hash-object -w ../.gitmodules) &&
172 target=$(printf "$tricky" | git hash-object -w --stdin) &&
174 printf "100644 blob $content\t$tricky\n" &&
175 printf "120000 blob $target\t$path\n"
178 tree=$(git -C $dir mktree <$dir/bad-tree)
181 test_expect_success
"fsck detects symlinked $name ($type)" '
185 # Check not only that we fail, but that it is due to the
187 $fsck_must_fail git fsck 2>output &&
188 grep "$fsck_prefix.*tree $tree: ${name}Symlink" output
192 test -n "$refuse_index" &&
193 test_expect_success
"refuse to load symlinked $name into index ($type)" '
196 -c core.protectntfs \
198 read-tree $tree 2>err &&
199 grep "invalid path.*$name" err &&
200 git -C $dir ls-files -s >out &&
201 test_must_be_empty out
205 check_dotx_symlink gitmodules vanilla .gitmodules
206 check_dotx_symlink gitmodules ntfs
".gitmodules ."
207 check_dotx_symlink gitmodules hfs
".${u200c}gitmodules"
209 check_dotx_symlink
--warning gitattributes vanilla .gitattributes
210 check_dotx_symlink
--warning gitattributes ntfs
".gitattributes ."
211 check_dotx_symlink
--warning gitattributes hfs
".${u200c}gitattributes"
213 check_dotx_symlink
--warning gitignore vanilla .gitignore
214 check_dotx_symlink
--warning gitignore ntfs
".gitignore ."
215 check_dotx_symlink
--warning gitignore hfs
".${u200c}gitignore"
217 check_dotx_symlink
--warning mailmap vanilla .mailmap
218 check_dotx_symlink
--warning mailmap ntfs
".mailmap ."
219 check_dotx_symlink
--warning mailmap hfs
".${u200c}mailmap"
221 test_expect_success
'fsck detects non-blob .gitmodules' '
226 # As above, make the funny tree directly to avoid index
229 cp ../.gitmodules subdir/file &&
230 git add subdir/file &&
232 git ls-tree HEAD | sed s/subdir/.gitmodules/ | git mktree &&
234 test_must_fail git fsck 2>output &&
235 test_i18ngrep gitmodulesBlob output
239 test_expect_success
'fsck detects corrupt .gitmodules' '
244 echo "[broken" >.gitmodules &&
245 git add .gitmodules &&
246 git commit -m "broken gitmodules" &&
249 test_i18ngrep gitmodulesParse output &&
250 test_i18ngrep ! "bad config" output
254 test_expect_success WINDOWS
'prevent git~1 squatting on Windows' '
255 git init squatting &&
262 git commit -m initial &&
264 modules="$(test_write_lines \
265 "[submodule \"b.\"]" "url = ." "path = c" \
266 "[submodule \"b\"]" "url = ." "path = d\\\\a" |
267 git hash-object -w --stdin)" &&
268 rev="$(git rev-parse --verify HEAD)" &&
269 hash="$(echo x | git hash-object -w --stdin)" &&
270 test_must_fail git update-index --add \
271 --cacheinfo 160000,$rev,d\\a 2>err &&
272 test_i18ngrep "Invalid path" err &&
273 git -c core.protectNTFS=false update-index --add \
274 --cacheinfo 100644,$modules,.gitmodules \
275 --cacheinfo 160000,$rev,c \
276 --cacheinfo 160000,$rev,d\\a \
277 --cacheinfo 100644,$hash,d./a/x \
278 --cacheinfo 100644,$hash,d./a/..git &&
280 git -c core.protectNTFS=false commit -m "module"
282 if test_have_prereq MINGW
284 test_must_fail git -c core.protectNTFS=false \
285 clone --recurse-submodules squatting squatting-clone 2>err &&
286 test_i18ngrep -e "directory not empty" -e "not an empty directory" err &&
287 ! grep gitdir squatting-clone/d/a/git~2
291 test_expect_success
'git dirs of sibling submodules must not be nested' '
293 test_commit -C nested nested &&
296 cat >.gitmodules <<-EOF &&
300 [submodule "hippo/hooks"]
304 git clone . thing1 &&
305 git clone . thing2 &&
306 git add .gitmodules thing1 thing2 &&
310 test_must_fail git clone --recurse-submodules nested clone 2>err &&
311 test_i18ngrep "is inside git dir" err