2 #include "object-store.h"
3 #include "repository.h"
17 #include "submodule-config.h"
19 #include "credential.h"
23 #define MSG_ID(id, msg_type) { STR(id), NULL, NULL, FSCK_##msg_type },
25 const char *id_string
;
26 const char *downcased
;
27 const char *camelcased
;
28 enum fsck_msg_type msg_type
;
29 } msg_id_info
[FSCK_MSG_MAX
+ 1] = {
30 FOREACH_FSCK_MSG_ID(MSG_ID
)
31 { NULL
, NULL
, NULL
, -1 }
36 static void prepare_msg_ids(void)
40 if (msg_id_info
[0].downcased
)
43 /* convert id_string to lower case, without underscores. */
44 for (i
= 0; i
< FSCK_MSG_MAX
; i
++) {
45 const char *p
= msg_id_info
[i
].id_string
;
47 char *q
= xmalloc(len
);
49 msg_id_info
[i
].downcased
= q
;
54 *(q
)++ = tolower(*(p
)++);
57 p
= msg_id_info
[i
].id_string
;
59 msg_id_info
[i
].camelcased
= q
;
73 static int parse_msg_id(const char *text
)
79 for (i
= 0; i
< FSCK_MSG_MAX
; i
++)
80 if (!strcmp(text
, msg_id_info
[i
].downcased
))
86 void list_config_fsck_msg_ids(struct string_list
*list
, const char *prefix
)
92 for (i
= 0; i
< FSCK_MSG_MAX
; i
++)
93 list_config_item(list
, prefix
, msg_id_info
[i
].camelcased
);
96 static enum fsck_msg_type
fsck_msg_type(enum fsck_msg_id msg_id
,
97 struct fsck_options
*options
)
99 assert(msg_id
>= 0 && msg_id
< FSCK_MSG_MAX
);
101 if (!options
->msg_type
) {
102 enum fsck_msg_type msg_type
= msg_id_info
[msg_id
].msg_type
;
104 if (options
->strict
&& msg_type
== FSCK_WARN
)
105 msg_type
= FSCK_ERROR
;
109 return options
->msg_type
[msg_id
];
112 static enum fsck_msg_type
parse_msg_type(const char *str
)
114 if (!strcmp(str
, "error"))
116 else if (!strcmp(str
, "warn"))
118 else if (!strcmp(str
, "ignore"))
121 die("Unknown fsck message type: '%s'", str
);
124 int is_valid_msg_type(const char *msg_id
, const char *msg_type
)
126 if (parse_msg_id(msg_id
) < 0)
128 parse_msg_type(msg_type
);
132 void fsck_set_msg_type_from_ids(struct fsck_options
*options
,
133 enum fsck_msg_id msg_id
,
134 enum fsck_msg_type msg_type
)
136 if (!options
->msg_type
) {
138 enum fsck_msg_type
*severity
;
139 ALLOC_ARRAY(severity
, FSCK_MSG_MAX
);
140 for (i
= 0; i
< FSCK_MSG_MAX
; i
++)
141 severity
[i
] = fsck_msg_type(i
, options
);
142 options
->msg_type
= severity
;
145 options
->msg_type
[msg_id
] = msg_type
;
148 void fsck_set_msg_type(struct fsck_options
*options
,
149 const char *msg_id_str
, const char *msg_type_str
)
151 int msg_id
= parse_msg_id(msg_id_str
);
152 enum fsck_msg_type msg_type
= parse_msg_type(msg_type_str
);
155 die("Unhandled message id: %s", msg_id_str
);
157 if (msg_type
!= FSCK_ERROR
&& msg_id_info
[msg_id
].msg_type
== FSCK_FATAL
)
158 die("Cannot demote %s to %s", msg_id_str
, msg_type_str
);
160 fsck_set_msg_type_from_ids(options
, msg_id
, msg_type
);
163 void fsck_set_msg_types(struct fsck_options
*options
, const char *values
)
165 char *buf
= xstrdup(values
), *to_free
= buf
;
169 int len
= strcspn(buf
, " ,|"), equal
;
179 equal
< len
&& buf
[equal
] != '=' && buf
[equal
] != ':';
181 buf
[equal
] = tolower(buf
[equal
]);
184 if (!strcmp(buf
, "skiplist")) {
186 die("skiplist requires a path");
187 oidset_parse_file(&options
->skiplist
, buf
+ equal
+ 1);
193 die("Missing '=': '%s'", buf
);
195 fsck_set_msg_type(options
, buf
, buf
+ equal
+ 1);
201 static int object_on_skiplist(struct fsck_options
*opts
,
202 const struct object_id
*oid
)
204 return opts
&& oid
&& oidset_contains(&opts
->skiplist
, oid
);
207 __attribute__((format (printf
, 5, 6)))
208 static int report(struct fsck_options
*options
,
209 const struct object_id
*oid
, enum object_type object_type
,
210 enum fsck_msg_id msg_id
, const char *fmt
, ...)
213 struct strbuf sb
= STRBUF_INIT
;
214 enum fsck_msg_type msg_type
= fsck_msg_type(msg_id
, options
);
217 if (msg_type
== FSCK_IGNORE
)
220 if (object_on_skiplist(options
, oid
))
223 if (msg_type
== FSCK_FATAL
)
224 msg_type
= FSCK_ERROR
;
225 else if (msg_type
== FSCK_INFO
)
226 msg_type
= FSCK_WARN
;
229 strbuf_addf(&sb
, "%s: ", msg_id_info
[msg_id
].camelcased
);
232 strbuf_vaddf(&sb
, fmt
, ap
);
233 result
= options
->error_func(options
, oid
, object_type
,
234 msg_type
, msg_id
, sb
.buf
);
241 void fsck_enable_object_names(struct fsck_options
*options
)
243 if (!options
->object_names
)
244 options
->object_names
= kh_init_oid_map();
247 const char *fsck_get_object_name(struct fsck_options
*options
,
248 const struct object_id
*oid
)
251 if (!options
->object_names
)
253 pos
= kh_get_oid_map(options
->object_names
, *oid
);
254 if (pos
>= kh_end(options
->object_names
))
256 return kh_value(options
->object_names
, pos
);
259 void fsck_put_object_name(struct fsck_options
*options
,
260 const struct object_id
*oid
,
261 const char *fmt
, ...)
264 struct strbuf buf
= STRBUF_INIT
;
268 if (!options
->object_names
)
271 pos
= kh_put_oid_map(options
->object_names
, *oid
, &hashret
);
275 strbuf_vaddf(&buf
, fmt
, ap
);
276 kh_value(options
->object_names
, pos
) = strbuf_detach(&buf
, NULL
);
280 const char *fsck_describe_object(struct fsck_options
*options
,
281 const struct object_id
*oid
)
283 static struct strbuf bufs
[] = {
284 STRBUF_INIT
, STRBUF_INIT
, STRBUF_INIT
, STRBUF_INIT
288 const char *name
= fsck_get_object_name(options
, oid
);
291 b
= (b
+ 1) % ARRAY_SIZE(bufs
);
293 strbuf_addstr(buf
, oid_to_hex(oid
));
295 strbuf_addf(buf
, " (%s)", name
);
300 static int fsck_walk_tree(struct tree
*tree
, void *data
, struct fsck_options
*options
)
302 struct tree_desc desc
;
303 struct name_entry entry
;
307 if (parse_tree(tree
))
310 name
= fsck_get_object_name(options
, &tree
->object
.oid
);
311 if (init_tree_desc_gently(&desc
, tree
->buffer
, tree
->size
))
313 while (tree_entry_gently(&desc
, &entry
)) {
317 if (S_ISGITLINK(entry
.mode
))
320 if (S_ISDIR(entry
.mode
)) {
321 obj
= (struct object
*)lookup_tree(the_repository
, &entry
.oid
);
323 fsck_put_object_name(options
, &entry
.oid
, "%s%s/",
325 result
= options
->walk(obj
, OBJ_TREE
, data
, options
);
327 else if (S_ISREG(entry
.mode
) || S_ISLNK(entry
.mode
)) {
328 obj
= (struct object
*)lookup_blob(the_repository
, &entry
.oid
);
330 fsck_put_object_name(options
, &entry
.oid
, "%s%s",
332 result
= options
->walk(obj
, OBJ_BLOB
, data
, options
);
335 result
= error("in tree %s: entry %s has bad mode %.6o",
336 fsck_describe_object(options
, &tree
->object
.oid
),
337 entry
.path
, entry
.mode
);
347 static int fsck_walk_commit(struct commit
*commit
, void *data
, struct fsck_options
*options
)
349 int counter
= 0, generation
= 0, name_prefix_len
= 0;
350 struct commit_list
*parents
;
355 if (parse_commit(commit
))
358 name
= fsck_get_object_name(options
, &commit
->object
.oid
);
360 fsck_put_object_name(options
, get_commit_tree_oid(commit
),
363 result
= options
->walk((struct object
*)get_commit_tree(commit
),
364 OBJ_TREE
, data
, options
);
369 parents
= commit
->parents
;
370 if (name
&& parents
) {
371 int len
= strlen(name
), power
;
373 if (len
&& name
[len
- 1] == '^') {
375 name_prefix_len
= len
- 1;
377 else { /* parse ~<generation> suffix */
378 for (generation
= 0, power
= 1;
379 len
&& isdigit(name
[len
- 1]);
381 generation
+= power
* (name
[--len
] - '0');
382 if (power
> 1 && len
&& name
[len
- 1] == '~')
383 name_prefix_len
= len
- 1;
385 /* Maybe a non-first parent, e.g. HEAD^2 */
387 name_prefix_len
= len
;
394 struct object_id
*oid
= &parents
->item
->object
.oid
;
397 fsck_put_object_name(options
, oid
, "%s^%d",
399 else if (generation
> 0)
400 fsck_put_object_name(options
, oid
, "%.*s~%d",
401 name_prefix_len
, name
,
404 fsck_put_object_name(options
, oid
, "%s^", name
);
406 result
= options
->walk((struct object
*)parents
->item
, OBJ_COMMIT
, data
, options
);
411 parents
= parents
->next
;
416 static int fsck_walk_tag(struct tag
*tag
, void *data
, struct fsck_options
*options
)
418 const char *name
= fsck_get_object_name(options
, &tag
->object
.oid
);
423 fsck_put_object_name(options
, &tag
->tagged
->oid
, "%s", name
);
424 return options
->walk(tag
->tagged
, OBJ_ANY
, data
, options
);
427 int fsck_walk(struct object
*obj
, void *data
, struct fsck_options
*options
)
432 if (obj
->type
== OBJ_NONE
)
433 parse_object(the_repository
, &obj
->oid
);
439 return fsck_walk_tree((struct tree
*)obj
, data
, options
);
441 return fsck_walk_commit((struct commit
*)obj
, data
, options
);
443 return fsck_walk_tag((struct tag
*)obj
, data
, options
);
445 error("Unknown object type for %s",
446 fsck_describe_object(options
, &obj
->oid
));
456 static void name_stack_push(struct name_stack
*stack
, const char *name
)
458 ALLOC_GROW(stack
->names
, stack
->nr
+ 1, stack
->alloc
);
459 stack
->names
[stack
->nr
++] = name
;
462 static const char *name_stack_pop(struct name_stack
*stack
)
464 return stack
->nr
? stack
->names
[--stack
->nr
] : NULL
;
467 static void name_stack_clear(struct name_stack
*stack
)
469 FREE_AND_NULL(stack
->names
);
470 stack
->nr
= stack
->alloc
= 0;
474 * The entries in a tree are ordered in the _path_ order,
475 * which means that a directory entry is ordered by adding
476 * a slash to the end of it.
478 * So a directory called "a" is ordered _after_ a file
479 * called "a.c", because "a/" sorts after "a.c".
481 #define TREE_UNORDERED (-1)
482 #define TREE_HAS_DUPS (-2)
484 static int is_less_than_slash(unsigned char c
)
486 return '\0' < c
&& c
< '/';
489 static int verify_ordered(unsigned mode1
, const char *name1
,
490 unsigned mode2
, const char *name2
,
491 struct name_stack
*candidates
)
493 int len1
= strlen(name1
);
494 int len2
= strlen(name2
);
495 int len
= len1
< len2
? len1
: len2
;
496 unsigned char c1
, c2
;
499 cmp
= memcmp(name1
, name2
, len
);
503 return TREE_UNORDERED
;
506 * Ok, the first <len> characters are the same.
507 * Now we need to order the next one, but turn
508 * a '\0' into a '/' for a directory entry.
514 * git-write-tree used to write out a nonsense tree that has
515 * entries with the same name, one blob and one tree. Make
516 * sure we do not have duplicate entries.
518 return TREE_HAS_DUPS
;
519 if (!c1
&& S_ISDIR(mode1
))
521 if (!c2
&& S_ISDIR(mode2
))
525 * There can be non-consecutive duplicates due to the implicitly
534 * Record non-directory candidates (like "foo" and "foo.bar" in
535 * the example) on a stack and check directory candidates (like
536 * foo/" and "foo.bar/") against that stack.
538 if (!c1
&& is_less_than_slash(c2
)) {
539 name_stack_push(candidates
, name1
);
540 } else if (c2
== '/' && is_less_than_slash(c1
)) {
543 const char *f_name
= name_stack_pop(candidates
);
547 if (!skip_prefix(name2
, f_name
, &p
))
550 return TREE_HAS_DUPS
;
551 if (is_less_than_slash(*p
)) {
552 name_stack_push(candidates
, f_name
);
558 return c1
< c2
? 0 : TREE_UNORDERED
;
561 static int fsck_tree(const struct object_id
*tree_oid
,
562 const char *buffer
, unsigned long size
,
563 struct fsck_options
*options
)
566 int has_null_sha1
= 0;
567 int has_full_path
= 0;
568 int has_empty_name
= 0;
572 int has_zero_pad
= 0;
573 int has_bad_modes
= 0;
574 int has_dup_entries
= 0;
575 int not_properly_sorted
= 0;
576 struct tree_desc desc
;
579 struct name_stack df_dup_candidates
= { NULL
};
581 if (init_tree_desc_gently(&desc
, buffer
, size
)) {
582 retval
+= report(options
, tree_oid
, OBJ_TREE
, FSCK_MSG_BAD_TREE
, "cannot be parsed as a tree");
591 const char *name
, *backslash
;
592 const struct object_id
*entry_oid
;
594 entry_oid
= tree_entry_extract(&desc
, &name
, &mode
);
596 has_null_sha1
|= is_null_oid(entry_oid
);
597 has_full_path
|= !!strchr(name
, '/');
598 has_empty_name
|= !*name
;
599 has_dot
|= !strcmp(name
, ".");
600 has_dotdot
|= !strcmp(name
, "..");
601 has_dotgit
|= is_hfs_dotgit(name
) || is_ntfs_dotgit(name
);
602 has_zero_pad
|= *(char *)desc
.buffer
== '0';
604 if (is_hfs_dotgitmodules(name
) || is_ntfs_dotgitmodules(name
)) {
606 oidset_insert(&options
->gitmodules_found
,
609 retval
+= report(options
,
611 FSCK_MSG_GITMODULES_SYMLINK
,
612 ".gitmodules is a symbolic link");
615 if ((backslash
= strchr(name
, '\\'))) {
618 has_dotgit
|= is_ntfs_dotgit(backslash
);
619 if (is_ntfs_dotgitmodules(backslash
)) {
621 oidset_insert(&options
->gitmodules_found
,
624 retval
+= report(options
, tree_oid
, OBJ_TREE
,
625 FSCK_MSG_GITMODULES_SYMLINK
,
626 ".gitmodules is a symbolic link");
628 backslash
= strchr(backslash
, '\\');
632 if (update_tree_entry_gently(&desc
)) {
633 retval
+= report(options
, tree_oid
, OBJ_TREE
, FSCK_MSG_BAD_TREE
, "cannot be parsed as a tree");
648 * This is nonstandard, but we had a few of these
649 * early on when we honored the full set of mode
653 if (!options
->strict
)
661 switch (verify_ordered(o_mode
, o_name
, mode
, name
,
662 &df_dup_candidates
)) {
664 not_properly_sorted
= 1;
678 name_stack_clear(&df_dup_candidates
);
681 retval
+= report(options
, tree_oid
, OBJ_TREE
, FSCK_MSG_NULL_SHA1
, "contains entries pointing to null sha1");
683 retval
+= report(options
, tree_oid
, OBJ_TREE
, FSCK_MSG_FULL_PATHNAME
, "contains full pathnames");
685 retval
+= report(options
, tree_oid
, OBJ_TREE
, FSCK_MSG_EMPTY_NAME
, "contains empty pathname");
687 retval
+= report(options
, tree_oid
, OBJ_TREE
, FSCK_MSG_HAS_DOT
, "contains '.'");
689 retval
+= report(options
, tree_oid
, OBJ_TREE
, FSCK_MSG_HAS_DOTDOT
, "contains '..'");
691 retval
+= report(options
, tree_oid
, OBJ_TREE
, FSCK_MSG_HAS_DOTGIT
, "contains '.git'");
693 retval
+= report(options
, tree_oid
, OBJ_TREE
, FSCK_MSG_ZERO_PADDED_FILEMODE
, "contains zero-padded file modes");
695 retval
+= report(options
, tree_oid
, OBJ_TREE
, FSCK_MSG_BAD_FILEMODE
, "contains bad file modes");
697 retval
+= report(options
, tree_oid
, OBJ_TREE
, FSCK_MSG_DUPLICATE_ENTRIES
, "contains duplicate file entries");
698 if (not_properly_sorted
)
699 retval
+= report(options
, tree_oid
, OBJ_TREE
, FSCK_MSG_TREE_NOT_SORTED
, "not properly sorted");
703 static int verify_headers(const void *data
, unsigned long size
,
704 const struct object_id
*oid
, enum object_type type
,
705 struct fsck_options
*options
)
707 const char *buffer
= (const char *)data
;
710 for (i
= 0; i
< size
; i
++) {
713 return report(options
, oid
, type
,
714 FSCK_MSG_NUL_IN_HEADER
,
715 "unterminated header: NUL at offset %ld", i
);
717 if (i
+ 1 < size
&& buffer
[i
+ 1] == '\n')
723 * We did not find double-LF that separates the header
724 * and the body. Not having a body is not a crime but
725 * we do want to see the terminating LF for the last header
728 if (size
&& buffer
[size
- 1] == '\n')
731 return report(options
, oid
, type
,
732 FSCK_MSG_UNTERMINATED_HEADER
, "unterminated header");
735 static int fsck_ident(const char **ident
,
736 const struct object_id
*oid
, enum object_type type
,
737 struct fsck_options
*options
)
739 const char *p
= *ident
;
742 *ident
= strchrnul(*ident
, '\n');
747 return report(options
, oid
, type
, FSCK_MSG_MISSING_NAME_BEFORE_EMAIL
, "invalid author/committer line - missing space before email");
748 p
+= strcspn(p
, "<>\n");
750 return report(options
, oid
, type
, FSCK_MSG_BAD_NAME
, "invalid author/committer line - bad name");
752 return report(options
, oid
, type
, FSCK_MSG_MISSING_EMAIL
, "invalid author/committer line - missing email");
754 return report(options
, oid
, type
, FSCK_MSG_MISSING_SPACE_BEFORE_EMAIL
, "invalid author/committer line - missing space before email");
756 p
+= strcspn(p
, "<>\n");
758 return report(options
, oid
, type
, FSCK_MSG_BAD_EMAIL
, "invalid author/committer line - bad email");
761 return report(options
, oid
, type
, FSCK_MSG_MISSING_SPACE_BEFORE_DATE
, "invalid author/committer line - missing space before date");
763 if (*p
== '0' && p
[1] != ' ')
764 return report(options
, oid
, type
, FSCK_MSG_ZERO_PADDED_DATE
, "invalid author/committer line - zero-padded date");
765 if (date_overflows(parse_timestamp(p
, &end
, 10)))
766 return report(options
, oid
, type
, FSCK_MSG_BAD_DATE_OVERFLOW
, "invalid author/committer line - date causes integer overflow");
767 if ((end
== p
|| *end
!= ' '))
768 return report(options
, oid
, type
, FSCK_MSG_BAD_DATE
, "invalid author/committer line - bad date");
770 if ((*p
!= '+' && *p
!= '-') ||
776 return report(options
, oid
, type
, FSCK_MSG_BAD_TIMEZONE
, "invalid author/committer line - bad time zone");
781 static int fsck_commit(const struct object_id
*oid
,
782 const char *buffer
, unsigned long size
,
783 struct fsck_options
*options
)
785 struct object_id tree_oid
, parent_oid
;
786 unsigned author_count
;
788 const char *buffer_begin
= buffer
;
791 if (verify_headers(buffer
, size
, oid
, OBJ_COMMIT
, options
))
794 if (!skip_prefix(buffer
, "tree ", &buffer
))
795 return report(options
, oid
, OBJ_COMMIT
, FSCK_MSG_MISSING_TREE
, "invalid format - expected 'tree' line");
796 if (parse_oid_hex(buffer
, &tree_oid
, &p
) || *p
!= '\n') {
797 err
= report(options
, oid
, OBJ_COMMIT
, FSCK_MSG_BAD_TREE_SHA1
, "invalid 'tree' line format - bad sha1");
802 while (skip_prefix(buffer
, "parent ", &buffer
)) {
803 if (parse_oid_hex(buffer
, &parent_oid
, &p
) || *p
!= '\n') {
804 err
= report(options
, oid
, OBJ_COMMIT
, FSCK_MSG_BAD_PARENT_SHA1
, "invalid 'parent' line format - bad sha1");
811 while (skip_prefix(buffer
, "author ", &buffer
)) {
813 err
= fsck_ident(&buffer
, oid
, OBJ_COMMIT
, options
);
817 if (author_count
< 1)
818 err
= report(options
, oid
, OBJ_COMMIT
, FSCK_MSG_MISSING_AUTHOR
, "invalid format - expected 'author' line");
819 else if (author_count
> 1)
820 err
= report(options
, oid
, OBJ_COMMIT
, FSCK_MSG_MULTIPLE_AUTHORS
, "invalid format - multiple 'author' lines");
823 if (!skip_prefix(buffer
, "committer ", &buffer
))
824 return report(options
, oid
, OBJ_COMMIT
, FSCK_MSG_MISSING_COMMITTER
, "invalid format - expected 'committer' line");
825 err
= fsck_ident(&buffer
, oid
, OBJ_COMMIT
, options
);
828 if (memchr(buffer_begin
, '\0', size
)) {
829 err
= report(options
, oid
, OBJ_COMMIT
, FSCK_MSG_NUL_IN_COMMIT
,
830 "NUL byte in the commit object body");
837 static int fsck_tag(const struct object_id
*oid
, const char *buffer
,
838 unsigned long size
, struct fsck_options
*options
)
840 struct object_id tagged_oid
;
842 return fsck_tag_standalone(oid
, buffer
, size
, options
, &tagged_oid
,
846 int fsck_tag_standalone(const struct object_id
*oid
, const char *buffer
,
847 unsigned long size
, struct fsck_options
*options
,
848 struct object_id
*tagged_oid
,
853 struct strbuf sb
= STRBUF_INIT
;
856 ret
= verify_headers(buffer
, size
, oid
, OBJ_TAG
, options
);
860 if (!skip_prefix(buffer
, "object ", &buffer
)) {
861 ret
= report(options
, oid
, OBJ_TAG
, FSCK_MSG_MISSING_OBJECT
, "invalid format - expected 'object' line");
864 if (parse_oid_hex(buffer
, tagged_oid
, &p
) || *p
!= '\n') {
865 ret
= report(options
, oid
, OBJ_TAG
, FSCK_MSG_BAD_OBJECT_SHA1
, "invalid 'object' line format - bad sha1");
871 if (!skip_prefix(buffer
, "type ", &buffer
)) {
872 ret
= report(options
, oid
, OBJ_TAG
, FSCK_MSG_MISSING_TYPE_ENTRY
, "invalid format - expected 'type' line");
875 eol
= strchr(buffer
, '\n');
877 ret
= report(options
, oid
, OBJ_TAG
, FSCK_MSG_MISSING_TYPE
, "invalid format - unexpected end after 'type' line");
880 *tagged_type
= type_from_string_gently(buffer
, eol
- buffer
, 1);
881 if (*tagged_type
< 0)
882 ret
= report(options
, oid
, OBJ_TAG
, FSCK_MSG_BAD_TYPE
, "invalid 'type' value");
887 if (!skip_prefix(buffer
, "tag ", &buffer
)) {
888 ret
= report(options
, oid
, OBJ_TAG
, FSCK_MSG_MISSING_TAG_ENTRY
, "invalid format - expected 'tag' line");
891 eol
= strchr(buffer
, '\n');
893 ret
= report(options
, oid
, OBJ_TAG
, FSCK_MSG_MISSING_TAG
, "invalid format - unexpected end after 'type' line");
896 strbuf_addf(&sb
, "refs/tags/%.*s", (int)(eol
- buffer
), buffer
);
897 if (check_refname_format(sb
.buf
, 0)) {
898 ret
= report(options
, oid
, OBJ_TAG
,
899 FSCK_MSG_BAD_TAG_NAME
,
900 "invalid 'tag' name: %.*s",
901 (int)(eol
- buffer
), buffer
);
907 if (!skip_prefix(buffer
, "tagger ", &buffer
)) {
908 /* early tags do not contain 'tagger' lines; warn only */
909 ret
= report(options
, oid
, OBJ_TAG
, FSCK_MSG_MISSING_TAGGER_ENTRY
, "invalid format - expected 'tagger' line");
914 ret
= fsck_ident(&buffer
, oid
, OBJ_TAG
, options
);
918 if (!starts_with(buffer
, "\n")) {
920 * The verify_headers() check will allow
921 * e.g. "[...]tagger <tagger>\nsome
922 * garbage\n\nmessage" to pass, thinking "some
923 * garbage" could be a custom header. E.g. "mktag"
924 * doesn't want any unknown headers.
926 ret
= report(options
, oid
, OBJ_TAG
, FSCK_MSG_EXTRA_HEADER_ENTRY
, "invalid format - extra header(s) after 'tagger'");
937 * Like builtin/submodule--helper.c's starts_with_dot_slash, but without
938 * relying on the platform-dependent is_dir_sep helper.
940 * This is for use in checking whether a submodule URL is interpreted as
941 * relative to the current directory on any platform, since \ is a
942 * directory separator on Windows but not on other platforms.
944 static int starts_with_dot_slash(const char *str
)
946 return str
[0] == '.' && (str
[1] == '/' || str
[1] == '\\');
950 * Like starts_with_dot_slash, this is a variant of submodule--helper's
951 * helper of the same name with the twist that it accepts backslash as a
952 * directory separator even on non-Windows platforms.
954 static int starts_with_dot_dot_slash(const char *str
)
956 return str
[0] == '.' && starts_with_dot_slash(str
+ 1);
959 static int submodule_url_is_relative(const char *url
)
961 return starts_with_dot_slash(url
) || starts_with_dot_dot_slash(url
);
965 * Count directory components that a relative submodule URL should chop
966 * from the remote_url it is to be resolved against.
968 * In other words, this counts "../" components at the start of a
971 * Returns the number of directory components to chop and writes a
972 * pointer to the next character of url after all leading "./" and
973 * "../" components to out.
975 static int count_leading_dotdots(const char *url
, const char **out
)
979 if (starts_with_dot_dot_slash(url
)) {
981 url
+= strlen("../");
984 if (starts_with_dot_slash(url
)) {
993 * Check whether a transport is implemented by git-remote-curl.
995 * If it is, returns 1 and writes the URL that would be passed to
996 * git-remote-curl to the "out" parameter.
998 * Otherwise, returns 0 and leaves "out" untouched.
1001 * http::https://example.com/repo.git -> 1, https://example.com/repo.git
1002 * https://example.com/repo.git -> 1, https://example.com/repo.git
1003 * git://example.com/repo.git -> 0
1005 * This is for use in checking for previously exploitable bugs that
1006 * required a submodule URL to be passed to git-remote-curl.
1008 static int url_to_curl_url(const char *url
, const char **out
)
1011 * We don't need to check for case-aliases, "http.exe", and so
1012 * on because in the default configuration, is_transport_allowed
1013 * prevents URLs with those schemes from being cloned
1016 if (skip_prefix(url
, "http::", out
) ||
1017 skip_prefix(url
, "https::", out
) ||
1018 skip_prefix(url
, "ftp::", out
) ||
1019 skip_prefix(url
, "ftps::", out
))
1021 if (starts_with(url
, "http://") ||
1022 starts_with(url
, "https://") ||
1023 starts_with(url
, "ftp://") ||
1024 starts_with(url
, "ftps://")) {
1031 static int check_submodule_url(const char *url
)
1033 const char *curl_url
;
1035 if (looks_like_command_line_option(url
))
1038 if (submodule_url_is_relative(url
) || starts_with(url
, "git://")) {
1044 * This could be appended to an http URL and url-decoded;
1045 * check for malicious characters.
1047 decoded
= url_decode(url
);
1048 has_nl
= !!strchr(decoded
, '\n');
1055 * URLs which escape their root via "../" can overwrite
1056 * the host field and previous components, resolving to
1057 * URLs like https::example.com/submodule.git and
1058 * https:///example.com/submodule.git that were
1059 * susceptible to CVE-2020-11008.
1061 if (count_leading_dotdots(url
, &next
) > 0 &&
1062 (*next
== ':' || *next
== '/'))
1066 else if (url_to_curl_url(url
, &curl_url
)) {
1067 struct credential c
= CREDENTIAL_INIT
;
1069 if (credential_from_url_gently(&c
, curl_url
, 1) ||
1072 credential_clear(&c
);
1079 struct fsck_gitmodules_data
{
1080 const struct object_id
*oid
;
1081 struct fsck_options
*options
;
1085 static int fsck_gitmodules_fn(const char *var
, const char *value
, void *vdata
)
1087 struct fsck_gitmodules_data
*data
= vdata
;
1088 const char *subsection
, *key
;
1089 size_t subsection_len
;
1092 if (parse_config_key(var
, "submodule", &subsection
, &subsection_len
, &key
) < 0 ||
1096 name
= xmemdupz(subsection
, subsection_len
);
1097 if (check_submodule_name(name
) < 0)
1098 data
->ret
|= report(data
->options
,
1099 data
->oid
, OBJ_BLOB
,
1100 FSCK_MSG_GITMODULES_NAME
,
1101 "disallowed submodule name: %s",
1103 if (!strcmp(key
, "url") && value
&&
1104 check_submodule_url(value
) < 0)
1105 data
->ret
|= report(data
->options
,
1106 data
->oid
, OBJ_BLOB
,
1107 FSCK_MSG_GITMODULES_URL
,
1108 "disallowed submodule url: %s",
1110 if (!strcmp(key
, "path") && value
&&
1111 looks_like_command_line_option(value
))
1112 data
->ret
|= report(data
->options
,
1113 data
->oid
, OBJ_BLOB
,
1114 FSCK_MSG_GITMODULES_PATH
,
1115 "disallowed submodule path: %s",
1117 if (!strcmp(key
, "update") && value
&&
1118 parse_submodule_update_type(value
) == SM_UPDATE_COMMAND
)
1119 data
->ret
|= report(data
->options
, data
->oid
, OBJ_BLOB
,
1120 FSCK_MSG_GITMODULES_UPDATE
,
1121 "disallowed submodule update setting: %s",
1128 static int fsck_blob(const struct object_id
*oid
, const char *buf
,
1129 unsigned long size
, struct fsck_options
*options
)
1131 struct fsck_gitmodules_data data
;
1132 struct config_options config_opts
= { 0 };
1134 if (!oidset_contains(&options
->gitmodules_found
, oid
))
1136 oidset_insert(&options
->gitmodules_done
, oid
);
1138 if (object_on_skiplist(options
, oid
))
1143 * A missing buffer here is a sign that the caller found the
1144 * blob too gigantic to load into memory. Let's just consider
1147 return report(options
, oid
, OBJ_BLOB
,
1148 FSCK_MSG_GITMODULES_LARGE
,
1149 ".gitmodules too large to parse");
1153 data
.options
= options
;
1155 config_opts
.error_action
= CONFIG_ERROR_SILENT
;
1156 if (git_config_from_mem(fsck_gitmodules_fn
, CONFIG_ORIGIN_BLOB
,
1157 ".gitmodules", buf
, size
, &data
, &config_opts
))
1158 data
.ret
|= report(options
, oid
, OBJ_BLOB
,
1159 FSCK_MSG_GITMODULES_PARSE
,
1160 "could not parse gitmodules blob");
1165 int fsck_object(struct object
*obj
, void *data
, unsigned long size
,
1166 struct fsck_options
*options
)
1169 return report(options
, NULL
, OBJ_NONE
, FSCK_MSG_BAD_OBJECT_SHA1
, "no valid object to fsck");
1171 if (obj
->type
== OBJ_BLOB
)
1172 return fsck_blob(&obj
->oid
, data
, size
, options
);
1173 if (obj
->type
== OBJ_TREE
)
1174 return fsck_tree(&obj
->oid
, data
, size
, options
);
1175 if (obj
->type
== OBJ_COMMIT
)
1176 return fsck_commit(&obj
->oid
, data
, size
, options
);
1177 if (obj
->type
== OBJ_TAG
)
1178 return fsck_tag(&obj
->oid
, data
, size
, options
);
1180 return report(options
, &obj
->oid
, obj
->type
,
1181 FSCK_MSG_UNKNOWN_TYPE
,
1182 "unknown type '%d' (internal fsck error)",
1186 int fsck_error_function(struct fsck_options
*o
,
1187 const struct object_id
*oid
,
1188 enum object_type object_type
,
1189 enum fsck_msg_type msg_type
,
1190 enum fsck_msg_id msg_id
,
1191 const char *message
)
1193 if (msg_type
== FSCK_WARN
) {
1194 warning("object %s: %s", fsck_describe_object(o
, oid
), message
);
1197 error("object %s: %s", fsck_describe_object(o
, oid
), message
);
1201 int fsck_finish(struct fsck_options
*options
)
1204 struct oidset_iter iter
;
1205 const struct object_id
*oid
;
1207 oidset_iter_init(&options
->gitmodules_found
, &iter
);
1208 while ((oid
= oidset_iter_next(&iter
))) {
1209 enum object_type type
;
1213 if (oidset_contains(&options
->gitmodules_done
, oid
))
1216 buf
= read_object_file(oid
, &type
, &size
);
1218 if (is_promisor_object(oid
))
1220 ret
|= report(options
,
1222 FSCK_MSG_GITMODULES_MISSING
,
1223 "unable to read .gitmodules blob");
1227 if (type
== OBJ_BLOB
)
1228 ret
|= fsck_blob(oid
, buf
, size
, options
);
1230 ret
|= report(options
,
1232 FSCK_MSG_GITMODULES_BLOB
,
1233 "non-blob found at .gitmodules");
1238 oidset_clear(&options
->gitmodules_found
);
1239 oidset_clear(&options
->gitmodules_done
);
1243 int git_fsck_config(const char *var
, const char *value
, void *cb
)
1245 struct fsck_options
*options
= cb
;
1246 if (strcmp(var
, "fsck.skiplist") == 0) {
1248 struct strbuf sb
= STRBUF_INIT
;
1250 if (git_config_pathname(&path
, var
, value
))
1252 strbuf_addf(&sb
, "skiplist=%s", path
);
1254 fsck_set_msg_types(options
, sb
.buf
);
1255 strbuf_release(&sb
);
1259 if (skip_prefix(var
, "fsck.", &var
)) {
1260 fsck_set_msg_type(options
, var
, value
);
1264 return git_default_config(var
, value
, cb
);
1268 * Custom error callbacks that are used in more than one place.
1271 int fsck_error_cb_print_missing_gitmodules(struct fsck_options
*o
,
1272 const struct object_id
*oid
,
1273 enum object_type object_type
,
1274 enum fsck_msg_type msg_type
,
1275 enum fsck_msg_id msg_id
,
1276 const char *message
)
1278 if (msg_id
== FSCK_MSG_GITMODULES_MISSING
) {
1279 puts(oid_to_hex(oid
));
1282 return fsck_error_function(o
, oid
, object_type
, msg_type
, msg_id
, message
);