1 #include "git-compat-util.h"
6 #include "object-store-ll.h"
8 #include "repository.h"
13 #include "tree-walk.h"
23 #include "submodule-config.h"
25 #include "credential.h"
29 #define MSG_ID(id, msg_type) { STR(id), NULL, NULL, FSCK_##msg_type },
31 const char *id_string
;
32 const char *downcased
;
33 const char *camelcased
;
34 enum fsck_msg_type msg_type
;
35 } msg_id_info
[FSCK_MSG_MAX
+ 1] = {
36 FOREACH_FSCK_MSG_ID(MSG_ID
)
37 { NULL
, NULL
, NULL
, -1 }
42 static void prepare_msg_ids(void)
46 if (msg_id_info
[0].downcased
)
49 /* convert id_string to lower case, without underscores. */
50 for (i
= 0; i
< FSCK_MSG_MAX
; i
++) {
51 const char *p
= msg_id_info
[i
].id_string
;
53 char *q
= xmalloc(len
);
55 msg_id_info
[i
].downcased
= q
;
60 *(q
)++ = tolower(*(p
)++);
63 p
= msg_id_info
[i
].id_string
;
65 msg_id_info
[i
].camelcased
= q
;
79 static int parse_msg_id(const char *text
)
85 for (i
= 0; i
< FSCK_MSG_MAX
; i
++)
86 if (!strcmp(text
, msg_id_info
[i
].downcased
))
92 void list_config_fsck_msg_ids(struct string_list
*list
, const char *prefix
)
98 for (i
= 0; i
< FSCK_MSG_MAX
; i
++)
99 list_config_item(list
, prefix
, msg_id_info
[i
].camelcased
);
102 static enum fsck_msg_type
fsck_msg_type(enum fsck_msg_id msg_id
,
103 struct fsck_options
*options
)
105 assert(msg_id
>= 0 && msg_id
< FSCK_MSG_MAX
);
107 if (!options
->msg_type
) {
108 enum fsck_msg_type msg_type
= msg_id_info
[msg_id
].msg_type
;
110 if (options
->strict
&& msg_type
== FSCK_WARN
)
111 msg_type
= FSCK_ERROR
;
115 return options
->msg_type
[msg_id
];
118 static enum fsck_msg_type
parse_msg_type(const char *str
)
120 if (!strcmp(str
, "error"))
122 else if (!strcmp(str
, "warn"))
124 else if (!strcmp(str
, "ignore"))
127 die("Unknown fsck message type: '%s'", str
);
130 int is_valid_msg_type(const char *msg_id
, const char *msg_type
)
132 if (parse_msg_id(msg_id
) < 0)
134 parse_msg_type(msg_type
);
138 void fsck_set_msg_type_from_ids(struct fsck_options
*options
,
139 enum fsck_msg_id msg_id
,
140 enum fsck_msg_type msg_type
)
142 if (!options
->msg_type
) {
144 enum fsck_msg_type
*severity
;
145 ALLOC_ARRAY(severity
, FSCK_MSG_MAX
);
146 for (i
= 0; i
< FSCK_MSG_MAX
; i
++)
147 severity
[i
] = fsck_msg_type(i
, options
);
148 options
->msg_type
= severity
;
151 options
->msg_type
[msg_id
] = msg_type
;
154 void fsck_set_msg_type(struct fsck_options
*options
,
155 const char *msg_id_str
, const char *msg_type_str
)
157 int msg_id
= parse_msg_id(msg_id_str
);
158 enum fsck_msg_type msg_type
= parse_msg_type(msg_type_str
);
161 die("Unhandled message id: %s", msg_id_str
);
163 if (msg_type
!= FSCK_ERROR
&& msg_id_info
[msg_id
].msg_type
== FSCK_FATAL
)
164 die("Cannot demote %s to %s", msg_id_str
, msg_type_str
);
166 fsck_set_msg_type_from_ids(options
, msg_id
, msg_type
);
169 void fsck_set_msg_types(struct fsck_options
*options
, const char *values
)
171 char *buf
= xstrdup(values
), *to_free
= buf
;
175 int len
= strcspn(buf
, " ,|"), equal
;
185 equal
< len
&& buf
[equal
] != '=' && buf
[equal
] != ':';
187 buf
[equal
] = tolower(buf
[equal
]);
190 if (!strcmp(buf
, "skiplist")) {
192 die("skiplist requires a path");
193 oidset_parse_file(&options
->skiplist
, buf
+ equal
+ 1);
199 die("Missing '=': '%s'", buf
);
201 fsck_set_msg_type(options
, buf
, buf
+ equal
+ 1);
207 static int object_on_skiplist(struct fsck_options
*opts
,
208 const struct object_id
*oid
)
210 return opts
&& oid
&& oidset_contains(&opts
->skiplist
, oid
);
213 __attribute__((format (printf
, 5, 6)))
214 static int report(struct fsck_options
*options
,
215 const struct object_id
*oid
, enum object_type object_type
,
216 enum fsck_msg_id msg_id
, const char *fmt
, ...)
219 struct strbuf sb
= STRBUF_INIT
;
220 enum fsck_msg_type msg_type
= fsck_msg_type(msg_id
, options
);
223 if (msg_type
== FSCK_IGNORE
)
226 if (object_on_skiplist(options
, oid
))
229 if (msg_type
== FSCK_FATAL
)
230 msg_type
= FSCK_ERROR
;
231 else if (msg_type
== FSCK_INFO
)
232 msg_type
= FSCK_WARN
;
235 strbuf_addf(&sb
, "%s: ", msg_id_info
[msg_id
].camelcased
);
238 strbuf_vaddf(&sb
, fmt
, ap
);
239 result
= options
->error_func(options
, oid
, object_type
,
240 msg_type
, msg_id
, sb
.buf
);
247 void fsck_enable_object_names(struct fsck_options
*options
)
249 if (!options
->object_names
)
250 options
->object_names
= kh_init_oid_map();
253 const char *fsck_get_object_name(struct fsck_options
*options
,
254 const struct object_id
*oid
)
257 if (!options
->object_names
)
259 pos
= kh_get_oid_map(options
->object_names
, *oid
);
260 if (pos
>= kh_end(options
->object_names
))
262 return kh_value(options
->object_names
, pos
);
265 void fsck_put_object_name(struct fsck_options
*options
,
266 const struct object_id
*oid
,
267 const char *fmt
, ...)
270 struct strbuf buf
= STRBUF_INIT
;
274 if (!options
->object_names
)
277 pos
= kh_put_oid_map(options
->object_names
, *oid
, &hashret
);
281 strbuf_vaddf(&buf
, fmt
, ap
);
282 kh_value(options
->object_names
, pos
) = strbuf_detach(&buf
, NULL
);
286 const char *fsck_describe_object(struct fsck_options
*options
,
287 const struct object_id
*oid
)
289 static struct strbuf bufs
[] = {
290 STRBUF_INIT
, STRBUF_INIT
, STRBUF_INIT
, STRBUF_INIT
294 const char *name
= fsck_get_object_name(options
, oid
);
297 b
= (b
+ 1) % ARRAY_SIZE(bufs
);
299 strbuf_addstr(buf
, oid_to_hex(oid
));
301 strbuf_addf(buf
, " (%s)", name
);
306 static int fsck_walk_tree(struct tree
*tree
, void *data
, struct fsck_options
*options
)
308 struct tree_desc desc
;
309 struct name_entry entry
;
313 if (parse_tree(tree
))
316 name
= fsck_get_object_name(options
, &tree
->object
.oid
);
317 if (init_tree_desc_gently(&desc
, tree
->buffer
, tree
->size
, 0))
319 while (tree_entry_gently(&desc
, &entry
)) {
323 if (S_ISGITLINK(entry
.mode
))
326 if (S_ISDIR(entry
.mode
)) {
327 obj
= (struct object
*)lookup_tree(the_repository
, &entry
.oid
);
329 fsck_put_object_name(options
, &entry
.oid
, "%s%s/",
331 result
= options
->walk(obj
, OBJ_TREE
, data
, options
);
333 else if (S_ISREG(entry
.mode
) || S_ISLNK(entry
.mode
)) {
334 obj
= (struct object
*)lookup_blob(the_repository
, &entry
.oid
);
336 fsck_put_object_name(options
, &entry
.oid
, "%s%s",
338 result
= options
->walk(obj
, OBJ_BLOB
, data
, options
);
341 result
= error("in tree %s: entry %s has bad mode %.6o",
342 fsck_describe_object(options
, &tree
->object
.oid
),
343 entry
.path
, entry
.mode
);
353 static int fsck_walk_commit(struct commit
*commit
, void *data
, struct fsck_options
*options
)
355 int counter
= 0, generation
= 0, name_prefix_len
= 0;
356 struct commit_list
*parents
;
361 if (repo_parse_commit(the_repository
, commit
))
364 name
= fsck_get_object_name(options
, &commit
->object
.oid
);
366 fsck_put_object_name(options
, get_commit_tree_oid(commit
),
369 result
= options
->walk((struct object
*) repo_get_commit_tree(the_repository
, commit
),
370 OBJ_TREE
, data
, options
);
375 parents
= commit
->parents
;
376 if (name
&& parents
) {
377 int len
= strlen(name
), power
;
379 if (len
&& name
[len
- 1] == '^') {
381 name_prefix_len
= len
- 1;
383 else { /* parse ~<generation> suffix */
384 for (generation
= 0, power
= 1;
385 len
&& isdigit(name
[len
- 1]);
387 generation
+= power
* (name
[--len
] - '0');
388 if (power
> 1 && len
&& name
[len
- 1] == '~')
389 name_prefix_len
= len
- 1;
391 /* Maybe a non-first parent, e.g. HEAD^2 */
393 name_prefix_len
= len
;
400 struct object_id
*oid
= &parents
->item
->object
.oid
;
403 fsck_put_object_name(options
, oid
, "%s^%d",
405 else if (generation
> 0)
406 fsck_put_object_name(options
, oid
, "%.*s~%d",
407 name_prefix_len
, name
,
410 fsck_put_object_name(options
, oid
, "%s^", name
);
412 result
= options
->walk((struct object
*)parents
->item
, OBJ_COMMIT
, data
, options
);
417 parents
= parents
->next
;
422 static int fsck_walk_tag(struct tag
*tag
, void *data
, struct fsck_options
*options
)
424 const char *name
= fsck_get_object_name(options
, &tag
->object
.oid
);
429 fsck_put_object_name(options
, &tag
->tagged
->oid
, "%s", name
);
430 return options
->walk(tag
->tagged
, OBJ_ANY
, data
, options
);
433 int fsck_walk(struct object
*obj
, void *data
, struct fsck_options
*options
)
438 if (obj
->type
== OBJ_NONE
)
439 parse_object(the_repository
, &obj
->oid
);
445 return fsck_walk_tree((struct tree
*)obj
, data
, options
);
447 return fsck_walk_commit((struct commit
*)obj
, data
, options
);
449 return fsck_walk_tag((struct tag
*)obj
, data
, options
);
451 error("Unknown object type for %s",
452 fsck_describe_object(options
, &obj
->oid
));
462 static void name_stack_push(struct name_stack
*stack
, const char *name
)
464 ALLOC_GROW(stack
->names
, stack
->nr
+ 1, stack
->alloc
);
465 stack
->names
[stack
->nr
++] = name
;
468 static const char *name_stack_pop(struct name_stack
*stack
)
470 return stack
->nr
? stack
->names
[--stack
->nr
] : NULL
;
473 static void name_stack_clear(struct name_stack
*stack
)
475 FREE_AND_NULL(stack
->names
);
476 stack
->nr
= stack
->alloc
= 0;
480 * The entries in a tree are ordered in the _path_ order,
481 * which means that a directory entry is ordered by adding
482 * a slash to the end of it.
484 * So a directory called "a" is ordered _after_ a file
485 * called "a.c", because "a/" sorts after "a.c".
487 #define TREE_UNORDERED (-1)
488 #define TREE_HAS_DUPS (-2)
490 static int is_less_than_slash(unsigned char c
)
492 return '\0' < c
&& c
< '/';
495 static int verify_ordered(unsigned mode1
, const char *name1
,
496 unsigned mode2
, const char *name2
,
497 struct name_stack
*candidates
)
499 int len1
= strlen(name1
);
500 int len2
= strlen(name2
);
501 int len
= len1
< len2
? len1
: len2
;
502 unsigned char c1
, c2
;
505 cmp
= memcmp(name1
, name2
, len
);
509 return TREE_UNORDERED
;
512 * Ok, the first <len> characters are the same.
513 * Now we need to order the next one, but turn
514 * a '\0' into a '/' for a directory entry.
520 * git-write-tree used to write out a nonsense tree that has
521 * entries with the same name, one blob and one tree. Make
522 * sure we do not have duplicate entries.
524 return TREE_HAS_DUPS
;
525 if (!c1
&& S_ISDIR(mode1
))
527 if (!c2
&& S_ISDIR(mode2
))
531 * There can be non-consecutive duplicates due to the implicitly
540 * Record non-directory candidates (like "foo" and "foo.bar" in
541 * the example) on a stack and check directory candidates (like
542 * foo/" and "foo.bar/") against that stack.
544 if (!c1
&& is_less_than_slash(c2
)) {
545 name_stack_push(candidates
, name1
);
546 } else if (c2
== '/' && is_less_than_slash(c1
)) {
549 const char *f_name
= name_stack_pop(candidates
);
553 if (!skip_prefix(name2
, f_name
, &p
))
556 return TREE_HAS_DUPS
;
557 if (is_less_than_slash(*p
)) {
558 name_stack_push(candidates
, f_name
);
564 return c1
< c2
? 0 : TREE_UNORDERED
;
567 static int fsck_tree(const struct object_id
*tree_oid
,
568 const char *buffer
, unsigned long size
,
569 struct fsck_options
*options
)
572 int has_null_sha1
= 0;
573 int has_full_path
= 0;
574 int has_empty_name
= 0;
578 int has_zero_pad
= 0;
579 int has_bad_modes
= 0;
580 int has_dup_entries
= 0;
581 int not_properly_sorted
= 0;
582 struct tree_desc desc
;
585 struct name_stack df_dup_candidates
= { NULL
};
587 if (init_tree_desc_gently(&desc
, buffer
, size
, TREE_DESC_RAW_MODES
)) {
588 retval
+= report(options
, tree_oid
, OBJ_TREE
,
590 "cannot be parsed as a tree");
599 const char *name
, *backslash
;
600 const struct object_id
*entry_oid
;
602 entry_oid
= tree_entry_extract(&desc
, &name
, &mode
);
604 has_null_sha1
|= is_null_oid(entry_oid
);
605 has_full_path
|= !!strchr(name
, '/');
606 has_empty_name
|= !*name
;
607 has_dot
|= !strcmp(name
, ".");
608 has_dotdot
|= !strcmp(name
, "..");
609 has_dotgit
|= is_hfs_dotgit(name
) || is_ntfs_dotgit(name
);
610 has_zero_pad
|= *(char *)desc
.buffer
== '0';
612 if (is_hfs_dotgitmodules(name
) || is_ntfs_dotgitmodules(name
)) {
614 oidset_insert(&options
->gitmodules_found
,
617 retval
+= report(options
,
619 FSCK_MSG_GITMODULES_SYMLINK
,
620 ".gitmodules is a symbolic link");
623 if (is_hfs_dotgitattributes(name
) || is_ntfs_dotgitattributes(name
)) {
625 oidset_insert(&options
->gitattributes_found
,
628 retval
+= report(options
, tree_oid
, OBJ_TREE
,
629 FSCK_MSG_GITATTRIBUTES_SYMLINK
,
630 ".gitattributes is a symlink");
634 if (is_hfs_dotgitignore(name
) ||
635 is_ntfs_dotgitignore(name
))
636 retval
+= report(options
, tree_oid
, OBJ_TREE
,
637 FSCK_MSG_GITIGNORE_SYMLINK
,
638 ".gitignore is a symlink");
639 if (is_hfs_dotmailmap(name
) ||
640 is_ntfs_dotmailmap(name
))
641 retval
+= report(options
, tree_oid
, OBJ_TREE
,
642 FSCK_MSG_MAILMAP_SYMLINK
,
643 ".mailmap is a symlink");
646 if ((backslash
= strchr(name
, '\\'))) {
649 has_dotgit
|= is_ntfs_dotgit(backslash
);
650 if (is_ntfs_dotgitmodules(backslash
)) {
652 oidset_insert(&options
->gitmodules_found
,
655 retval
+= report(options
, tree_oid
, OBJ_TREE
,
656 FSCK_MSG_GITMODULES_SYMLINK
,
657 ".gitmodules is a symbolic link");
659 backslash
= strchr(backslash
, '\\');
663 if (update_tree_entry_gently(&desc
)) {
664 retval
+= report(options
, tree_oid
, OBJ_TREE
,
666 "cannot be parsed as a tree");
681 * This is nonstandard, but we had a few of these
682 * early on when we honored the full set of mode
686 if (!options
->strict
)
694 switch (verify_ordered(o_mode
, o_name
, mode
, name
,
695 &df_dup_candidates
)) {
697 not_properly_sorted
= 1;
711 name_stack_clear(&df_dup_candidates
);
714 retval
+= report(options
, tree_oid
, OBJ_TREE
,
716 "contains entries pointing to null sha1");
718 retval
+= report(options
, tree_oid
, OBJ_TREE
,
719 FSCK_MSG_FULL_PATHNAME
,
720 "contains full pathnames");
722 retval
+= report(options
, tree_oid
, OBJ_TREE
,
724 "contains empty pathname");
726 retval
+= report(options
, tree_oid
, OBJ_TREE
,
730 retval
+= report(options
, tree_oid
, OBJ_TREE
,
734 retval
+= report(options
, tree_oid
, OBJ_TREE
,
738 retval
+= report(options
, tree_oid
, OBJ_TREE
,
739 FSCK_MSG_ZERO_PADDED_FILEMODE
,
740 "contains zero-padded file modes");
742 retval
+= report(options
, tree_oid
, OBJ_TREE
,
743 FSCK_MSG_BAD_FILEMODE
,
744 "contains bad file modes");
746 retval
+= report(options
, tree_oid
, OBJ_TREE
,
747 FSCK_MSG_DUPLICATE_ENTRIES
,
748 "contains duplicate file entries");
749 if (not_properly_sorted
)
750 retval
+= report(options
, tree_oid
, OBJ_TREE
,
751 FSCK_MSG_TREE_NOT_SORTED
,
752 "not properly sorted");
757 * Confirm that the headers of a commit or tag object end in a reasonable way,
758 * either with the usual "\n\n" separator, or at least with a trailing newline
759 * on the final header line.
761 * This property is important for the memory safety of our callers. It allows
762 * them to scan the buffer linewise without constantly checking the remaining
765 * - they check that there are bytes left in the buffer at the start of any
766 * line (i.e., that the last newline they saw was not the final one we
769 * - any intra-line scanning they do will stop at a newline, which will worst
770 * case hit the newline we found here as the end-of-header. This makes it
771 * OK for them to use helpers like parse_oid_hex(), or even skip_prefix().
773 static int verify_headers(const void *data
, unsigned long size
,
774 const struct object_id
*oid
, enum object_type type
,
775 struct fsck_options
*options
)
777 const char *buffer
= (const char *)data
;
780 for (i
= 0; i
< size
; i
++) {
783 return report(options
, oid
, type
,
784 FSCK_MSG_NUL_IN_HEADER
,
785 "unterminated header: NUL at offset %ld", i
);
787 if (i
+ 1 < size
&& buffer
[i
+ 1] == '\n')
793 * We did not find double-LF that separates the header
794 * and the body. Not having a body is not a crime but
795 * we do want to see the terminating LF for the last header
798 if (size
&& buffer
[size
- 1] == '\n')
801 return report(options
, oid
, type
,
802 FSCK_MSG_UNTERMINATED_HEADER
, "unterminated header");
805 static int fsck_ident(const char **ident
,
806 const struct object_id
*oid
, enum object_type type
,
807 struct fsck_options
*options
)
809 const char *p
= *ident
;
812 *ident
= strchrnul(*ident
, '\n');
817 return report(options
, oid
, type
, FSCK_MSG_MISSING_NAME_BEFORE_EMAIL
, "invalid author/committer line - missing space before email");
818 p
+= strcspn(p
, "<>\n");
820 return report(options
, oid
, type
, FSCK_MSG_BAD_NAME
, "invalid author/committer line - bad name");
822 return report(options
, oid
, type
, FSCK_MSG_MISSING_EMAIL
, "invalid author/committer line - missing email");
824 return report(options
, oid
, type
, FSCK_MSG_MISSING_SPACE_BEFORE_EMAIL
, "invalid author/committer line - missing space before email");
826 p
+= strcspn(p
, "<>\n");
828 return report(options
, oid
, type
, FSCK_MSG_BAD_EMAIL
, "invalid author/committer line - bad email");
831 return report(options
, oid
, type
, FSCK_MSG_MISSING_SPACE_BEFORE_DATE
, "invalid author/committer line - missing space before date");
834 * Our timestamp parser is based on the C strto*() functions, which
835 * will happily eat whitespace, including the newline that is supposed
836 * to prevent us walking past the end of the buffer. So do our own
837 * scan, skipping linear whitespace but not newlines, and then
838 * confirming we found a digit. We _could_ be even more strict here,
839 * as we really expect only a single space, but since we have
840 * traditionally allowed extra whitespace, we'll continue to do so.
842 while (*p
== ' ' || *p
== '\t')
845 return report(options
, oid
, type
, FSCK_MSG_BAD_DATE
,
846 "invalid author/committer line - bad date");
847 if (*p
== '0' && p
[1] != ' ')
848 return report(options
, oid
, type
, FSCK_MSG_ZERO_PADDED_DATE
, "invalid author/committer line - zero-padded date");
849 if (date_overflows(parse_timestamp(p
, &end
, 10)))
850 return report(options
, oid
, type
, FSCK_MSG_BAD_DATE_OVERFLOW
, "invalid author/committer line - date causes integer overflow");
851 if ((end
== p
|| *end
!= ' '))
852 return report(options
, oid
, type
, FSCK_MSG_BAD_DATE
, "invalid author/committer line - bad date");
854 if ((*p
!= '+' && *p
!= '-') ||
860 return report(options
, oid
, type
, FSCK_MSG_BAD_TIMEZONE
, "invalid author/committer line - bad time zone");
865 static int fsck_commit(const struct object_id
*oid
,
866 const char *buffer
, unsigned long size
,
867 struct fsck_options
*options
)
869 struct object_id tree_oid
, parent_oid
;
870 unsigned author_count
;
872 const char *buffer_begin
= buffer
;
873 const char *buffer_end
= buffer
+ size
;
877 * We _must_ stop parsing immediately if this reports failure, as the
878 * memory safety of the rest of the function depends on it. See the
879 * comment above the definition of verify_headers() for more details.
881 if (verify_headers(buffer
, size
, oid
, OBJ_COMMIT
, options
))
884 if (buffer
>= buffer_end
|| !skip_prefix(buffer
, "tree ", &buffer
))
885 return report(options
, oid
, OBJ_COMMIT
, FSCK_MSG_MISSING_TREE
, "invalid format - expected 'tree' line");
886 if (parse_oid_hex(buffer
, &tree_oid
, &p
) || *p
!= '\n') {
887 err
= report(options
, oid
, OBJ_COMMIT
, FSCK_MSG_BAD_TREE_SHA1
, "invalid 'tree' line format - bad sha1");
892 while (buffer
< buffer_end
&& skip_prefix(buffer
, "parent ", &buffer
)) {
893 if (parse_oid_hex(buffer
, &parent_oid
, &p
) || *p
!= '\n') {
894 err
= report(options
, oid
, OBJ_COMMIT
, FSCK_MSG_BAD_PARENT_SHA1
, "invalid 'parent' line format - bad sha1");
901 while (buffer
< buffer_end
&& skip_prefix(buffer
, "author ", &buffer
)) {
903 err
= fsck_ident(&buffer
, oid
, OBJ_COMMIT
, options
);
907 if (author_count
< 1)
908 err
= report(options
, oid
, OBJ_COMMIT
, FSCK_MSG_MISSING_AUTHOR
, "invalid format - expected 'author' line");
909 else if (author_count
> 1)
910 err
= report(options
, oid
, OBJ_COMMIT
, FSCK_MSG_MULTIPLE_AUTHORS
, "invalid format - multiple 'author' lines");
913 if (buffer
>= buffer_end
|| !skip_prefix(buffer
, "committer ", &buffer
))
914 return report(options
, oid
, OBJ_COMMIT
, FSCK_MSG_MISSING_COMMITTER
, "invalid format - expected 'committer' line");
915 err
= fsck_ident(&buffer
, oid
, OBJ_COMMIT
, options
);
918 if (memchr(buffer_begin
, '\0', size
)) {
919 err
= report(options
, oid
, OBJ_COMMIT
, FSCK_MSG_NUL_IN_COMMIT
,
920 "NUL byte in the commit object body");
927 static int fsck_tag(const struct object_id
*oid
, const char *buffer
,
928 unsigned long size
, struct fsck_options
*options
)
930 struct object_id tagged_oid
;
932 return fsck_tag_standalone(oid
, buffer
, size
, options
, &tagged_oid
,
936 int fsck_tag_standalone(const struct object_id
*oid
, const char *buffer
,
937 unsigned long size
, struct fsck_options
*options
,
938 struct object_id
*tagged_oid
,
943 struct strbuf sb
= STRBUF_INIT
;
944 const char *buffer_end
= buffer
+ size
;
948 * We _must_ stop parsing immediately if this reports failure, as the
949 * memory safety of the rest of the function depends on it. See the
950 * comment above the definition of verify_headers() for more details.
952 ret
= verify_headers(buffer
, size
, oid
, OBJ_TAG
, options
);
956 if (buffer
>= buffer_end
|| !skip_prefix(buffer
, "object ", &buffer
)) {
957 ret
= report(options
, oid
, OBJ_TAG
, FSCK_MSG_MISSING_OBJECT
, "invalid format - expected 'object' line");
960 if (parse_oid_hex(buffer
, tagged_oid
, &p
) || *p
!= '\n') {
961 ret
= report(options
, oid
, OBJ_TAG
, FSCK_MSG_BAD_OBJECT_SHA1
, "invalid 'object' line format - bad sha1");
967 if (buffer
>= buffer_end
|| !skip_prefix(buffer
, "type ", &buffer
)) {
968 ret
= report(options
, oid
, OBJ_TAG
, FSCK_MSG_MISSING_TYPE_ENTRY
, "invalid format - expected 'type' line");
971 eol
= memchr(buffer
, '\n', buffer_end
- buffer
);
973 ret
= report(options
, oid
, OBJ_TAG
, FSCK_MSG_MISSING_TYPE
, "invalid format - unexpected end after 'type' line");
976 *tagged_type
= type_from_string_gently(buffer
, eol
- buffer
, 1);
977 if (*tagged_type
< 0)
978 ret
= report(options
, oid
, OBJ_TAG
, FSCK_MSG_BAD_TYPE
, "invalid 'type' value");
983 if (buffer
>= buffer_end
|| !skip_prefix(buffer
, "tag ", &buffer
)) {
984 ret
= report(options
, oid
, OBJ_TAG
, FSCK_MSG_MISSING_TAG_ENTRY
, "invalid format - expected 'tag' line");
987 eol
= memchr(buffer
, '\n', buffer_end
- buffer
);
989 ret
= report(options
, oid
, OBJ_TAG
, FSCK_MSG_MISSING_TAG
, "invalid format - unexpected end after 'type' line");
992 strbuf_addf(&sb
, "refs/tags/%.*s", (int)(eol
- buffer
), buffer
);
993 if (check_refname_format(sb
.buf
, 0)) {
994 ret
= report(options
, oid
, OBJ_TAG
,
995 FSCK_MSG_BAD_TAG_NAME
,
996 "invalid 'tag' name: %.*s",
997 (int)(eol
- buffer
), buffer
);
1003 if (buffer
>= buffer_end
|| !skip_prefix(buffer
, "tagger ", &buffer
)) {
1004 /* early tags do not contain 'tagger' lines; warn only */
1005 ret
= report(options
, oid
, OBJ_TAG
, FSCK_MSG_MISSING_TAGGER_ENTRY
, "invalid format - expected 'tagger' line");
1010 ret
= fsck_ident(&buffer
, oid
, OBJ_TAG
, options
);
1012 if (buffer
< buffer_end
&& !starts_with(buffer
, "\n")) {
1014 * The verify_headers() check will allow
1015 * e.g. "[...]tagger <tagger>\nsome
1016 * garbage\n\nmessage" to pass, thinking "some
1017 * garbage" could be a custom header. E.g. "mktag"
1018 * doesn't want any unknown headers.
1020 ret
= report(options
, oid
, OBJ_TAG
, FSCK_MSG_EXTRA_HEADER_ENTRY
, "invalid format - extra header(s) after 'tagger'");
1026 strbuf_release(&sb
);
1030 static int starts_with_dot_slash(const char *const path
)
1032 return path_match_flags(path
, PATH_MATCH_STARTS_WITH_DOT_SLASH
|
1033 PATH_MATCH_XPLATFORM
);
1036 static int starts_with_dot_dot_slash(const char *const path
)
1038 return path_match_flags(path
, PATH_MATCH_STARTS_WITH_DOT_DOT_SLASH
|
1039 PATH_MATCH_XPLATFORM
);
1042 static int submodule_url_is_relative(const char *url
)
1044 return starts_with_dot_slash(url
) || starts_with_dot_dot_slash(url
);
1048 * Count directory components that a relative submodule URL should chop
1049 * from the remote_url it is to be resolved against.
1051 * In other words, this counts "../" components at the start of a
1054 * Returns the number of directory components to chop and writes a
1055 * pointer to the next character of url after all leading "./" and
1056 * "../" components to out.
1058 static int count_leading_dotdots(const char *url
, const char **out
)
1062 if (starts_with_dot_dot_slash(url
)) {
1064 url
+= strlen("../");
1067 if (starts_with_dot_slash(url
)) {
1068 url
+= strlen("./");
1076 * Check whether a transport is implemented by git-remote-curl.
1078 * If it is, returns 1 and writes the URL that would be passed to
1079 * git-remote-curl to the "out" parameter.
1081 * Otherwise, returns 0 and leaves "out" untouched.
1084 * http::https://example.com/repo.git -> 1, https://example.com/repo.git
1085 * https://example.com/repo.git -> 1, https://example.com/repo.git
1086 * git://example.com/repo.git -> 0
1088 * This is for use in checking for previously exploitable bugs that
1089 * required a submodule URL to be passed to git-remote-curl.
1091 static int url_to_curl_url(const char *url
, const char **out
)
1094 * We don't need to check for case-aliases, "http.exe", and so
1095 * on because in the default configuration, is_transport_allowed
1096 * prevents URLs with those schemes from being cloned
1099 if (skip_prefix(url
, "http::", out
) ||
1100 skip_prefix(url
, "https::", out
) ||
1101 skip_prefix(url
, "ftp::", out
) ||
1102 skip_prefix(url
, "ftps::", out
))
1104 if (starts_with(url
, "http://") ||
1105 starts_with(url
, "https://") ||
1106 starts_with(url
, "ftp://") ||
1107 starts_with(url
, "ftps://")) {
1114 static int check_submodule_url(const char *url
)
1116 const char *curl_url
;
1118 if (looks_like_command_line_option(url
))
1121 if (submodule_url_is_relative(url
) || starts_with(url
, "git://")) {
1127 * This could be appended to an http URL and url-decoded;
1128 * check for malicious characters.
1130 decoded
= url_decode(url
);
1131 has_nl
= !!strchr(decoded
, '\n');
1138 * URLs which escape their root via "../" can overwrite
1139 * the host field and previous components, resolving to
1140 * URLs like https::example.com/submodule.git and
1141 * https:///example.com/submodule.git that were
1142 * susceptible to CVE-2020-11008.
1144 if (count_leading_dotdots(url
, &next
) > 0 &&
1145 (*next
== ':' || *next
== '/'))
1149 else if (url_to_curl_url(url
, &curl_url
)) {
1150 struct credential c
= CREDENTIAL_INIT
;
1152 if (credential_from_url_gently(&c
, curl_url
, 1) ||
1155 credential_clear(&c
);
1162 struct fsck_gitmodules_data
{
1163 const struct object_id
*oid
;
1164 struct fsck_options
*options
;
1168 static int fsck_gitmodules_fn(const char *var
, const char *value
, void *vdata
)
1170 struct fsck_gitmodules_data
*data
= vdata
;
1171 const char *subsection
, *key
;
1172 size_t subsection_len
;
1175 if (parse_config_key(var
, "submodule", &subsection
, &subsection_len
, &key
) < 0 ||
1179 name
= xmemdupz(subsection
, subsection_len
);
1180 if (check_submodule_name(name
) < 0)
1181 data
->ret
|= report(data
->options
,
1182 data
->oid
, OBJ_BLOB
,
1183 FSCK_MSG_GITMODULES_NAME
,
1184 "disallowed submodule name: %s",
1186 if (!strcmp(key
, "url") && value
&&
1187 check_submodule_url(value
) < 0)
1188 data
->ret
|= report(data
->options
,
1189 data
->oid
, OBJ_BLOB
,
1190 FSCK_MSG_GITMODULES_URL
,
1191 "disallowed submodule url: %s",
1193 if (!strcmp(key
, "path") && value
&&
1194 looks_like_command_line_option(value
))
1195 data
->ret
|= report(data
->options
,
1196 data
->oid
, OBJ_BLOB
,
1197 FSCK_MSG_GITMODULES_PATH
,
1198 "disallowed submodule path: %s",
1200 if (!strcmp(key
, "update") && value
&&
1201 parse_submodule_update_type(value
) == SM_UPDATE_COMMAND
)
1202 data
->ret
|= report(data
->options
, data
->oid
, OBJ_BLOB
,
1203 FSCK_MSG_GITMODULES_UPDATE
,
1204 "disallowed submodule update setting: %s",
1211 static int fsck_blob(const struct object_id
*oid
, const char *buf
,
1212 unsigned long size
, struct fsck_options
*options
)
1216 if (object_on_skiplist(options
, oid
))
1219 if (oidset_contains(&options
->gitmodules_found
, oid
)) {
1220 struct config_options config_opts
= { 0 };
1221 struct fsck_gitmodules_data data
;
1223 oidset_insert(&options
->gitmodules_done
, oid
);
1227 * A missing buffer here is a sign that the caller found the
1228 * blob too gigantic to load into memory. Let's just consider
1231 return report(options
, oid
, OBJ_BLOB
,
1232 FSCK_MSG_GITMODULES_LARGE
,
1233 ".gitmodules too large to parse");
1237 data
.options
= options
;
1239 config_opts
.error_action
= CONFIG_ERROR_SILENT
;
1240 if (git_config_from_mem(fsck_gitmodules_fn
, CONFIG_ORIGIN_BLOB
,
1241 ".gitmodules", buf
, size
, &data
, &config_opts
))
1242 data
.ret
|= report(options
, oid
, OBJ_BLOB
,
1243 FSCK_MSG_GITMODULES_PARSE
,
1244 "could not parse gitmodules blob");
1248 if (oidset_contains(&options
->gitattributes_found
, oid
)) {
1251 oidset_insert(&options
->gitattributes_done
, oid
);
1253 if (!buf
|| size
> ATTR_MAX_FILE_SIZE
) {
1255 * A missing buffer here is a sign that the caller found the
1256 * blob too gigantic to load into memory. Let's just consider
1259 return report(options
, oid
, OBJ_BLOB
,
1260 FSCK_MSG_GITATTRIBUTES_LARGE
,
1261 ".gitattributes too large to parse");
1264 for (ptr
= buf
; *ptr
; ) {
1265 const char *eol
= strchrnul(ptr
, '\n');
1266 if (eol
- ptr
>= ATTR_MAX_LINE_LENGTH
) {
1267 ret
|= report(options
, oid
, OBJ_BLOB
,
1268 FSCK_MSG_GITATTRIBUTES_LINE_LENGTH
,
1269 ".gitattributes has too long lines to parse");
1273 ptr
= *eol
? eol
+ 1 : eol
;
1280 int fsck_object(struct object
*obj
, void *data
, unsigned long size
,
1281 struct fsck_options
*options
)
1284 return report(options
, NULL
, OBJ_NONE
, FSCK_MSG_BAD_OBJECT_SHA1
, "no valid object to fsck");
1286 return fsck_buffer(&obj
->oid
, obj
->type
, data
, size
, options
);
1289 int fsck_buffer(const struct object_id
*oid
, enum object_type type
,
1290 void *data
, unsigned long size
,
1291 struct fsck_options
*options
)
1293 if (type
== OBJ_BLOB
)
1294 return fsck_blob(oid
, data
, size
, options
);
1295 if (type
== OBJ_TREE
)
1296 return fsck_tree(oid
, data
, size
, options
);
1297 if (type
== OBJ_COMMIT
)
1298 return fsck_commit(oid
, data
, size
, options
);
1299 if (type
== OBJ_TAG
)
1300 return fsck_tag(oid
, data
, size
, options
);
1302 return report(options
, oid
, type
,
1303 FSCK_MSG_UNKNOWN_TYPE
,
1304 "unknown type '%d' (internal fsck error)",
1308 int fsck_error_function(struct fsck_options
*o
,
1309 const struct object_id
*oid
,
1310 enum object_type object_type
,
1311 enum fsck_msg_type msg_type
,
1312 enum fsck_msg_id msg_id
,
1313 const char *message
)
1315 if (msg_type
== FSCK_WARN
) {
1316 warning("object %s: %s", fsck_describe_object(o
, oid
), message
);
1319 error("object %s: %s", fsck_describe_object(o
, oid
), message
);
1323 static int fsck_blobs(struct oidset
*blobs_found
, struct oidset
*blobs_done
,
1324 enum fsck_msg_id msg_missing
, enum fsck_msg_id msg_type
,
1325 struct fsck_options
*options
, const char *blob_type
)
1328 struct oidset_iter iter
;
1329 const struct object_id
*oid
;
1331 oidset_iter_init(blobs_found
, &iter
);
1332 while ((oid
= oidset_iter_next(&iter
))) {
1333 enum object_type type
;
1337 if (oidset_contains(blobs_done
, oid
))
1340 buf
= repo_read_object_file(the_repository
, oid
, &type
, &size
);
1342 if (is_promisor_object(oid
))
1344 ret
|= report(options
,
1345 oid
, OBJ_BLOB
, msg_missing
,
1346 "unable to read %s blob", blob_type
);
1350 if (type
== OBJ_BLOB
)
1351 ret
|= fsck_blob(oid
, buf
, size
, options
);
1353 ret
|= report(options
, oid
, type
, msg_type
,
1354 "non-blob found at %s", blob_type
);
1358 oidset_clear(blobs_found
);
1359 oidset_clear(blobs_done
);
1364 int fsck_finish(struct fsck_options
*options
)
1368 ret
|= fsck_blobs(&options
->gitmodules_found
, &options
->gitmodules_done
,
1369 FSCK_MSG_GITMODULES_MISSING
, FSCK_MSG_GITMODULES_BLOB
,
1370 options
, ".gitmodules");
1371 ret
|= fsck_blobs(&options
->gitattributes_found
, &options
->gitattributes_done
,
1372 FSCK_MSG_GITATTRIBUTES_MISSING
, FSCK_MSG_GITATTRIBUTES_BLOB
,
1373 options
, ".gitattributes");
1378 int git_fsck_config(const char *var
, const char *value
, void *cb
)
1380 struct fsck_options
*options
= cb
;
1381 if (strcmp(var
, "fsck.skiplist") == 0) {
1383 struct strbuf sb
= STRBUF_INIT
;
1385 if (git_config_pathname(&path
, var
, value
))
1387 strbuf_addf(&sb
, "skiplist=%s", path
);
1389 fsck_set_msg_types(options
, sb
.buf
);
1390 strbuf_release(&sb
);
1394 if (skip_prefix(var
, "fsck.", &var
)) {
1395 fsck_set_msg_type(options
, var
, value
);
1399 return git_default_config(var
, value
, cb
);
1403 * Custom error callbacks that are used in more than one place.
1406 int fsck_error_cb_print_missing_gitmodules(struct fsck_options
*o
,
1407 const struct object_id
*oid
,
1408 enum object_type object_type
,
1409 enum fsck_msg_type msg_type
,
1410 enum fsck_msg_id msg_id
,
1411 const char *message
)
1413 if (msg_id
== FSCK_MSG_GITMODULES_MISSING
) {
1414 puts(oid_to_hex(oid
));
1417 return fsck_error_function(o
, oid
, object_type
, msg_type
, msg_id
, message
);