t/t7415-submodule-names.sh

   1 #!/bin/sh
   2
   3 test_description='check handling of .. in submodule names
   4
   5 Exercise the name-checking function on a variety of names, and then give a
   6 real-world setup that confirms we catch this in practice.
   7 '
   8 . ./test-lib.sh
   9 . "$TEST_DIRECTORY"/lib-pack.sh
  10
  11 test_expect_success 'setup' '
  12         git config --global protocol.file.allow always
  13 '
  14
  15 test_expect_success 'check names' '
  16         cat >expect <<-\EOF &&
  17         valid
  18         valid/with/paths
  19         EOF
  20
  21         git submodule--helper check-name >actual <<-\EOF &&
  22         valid
  23         valid/with/paths
  24
  25         ../foo
  26         /../foo
  27         ..\foo
  28         \..\foo
  29         foo/..
  30         foo/../
  31         foo\..
  32         foo\..\
  33         foo/../bar
  34         EOF
  35
  36         test_cmp expect actual
  37 '
  38
  39 test_expect_success 'create innocent subrepo' '
  40         git init innocent &&
  41         git -C innocent commit --allow-empty -m foo
  42 '
  43
  44 test_expect_success 'submodule add refuses invalid names' '
  45         test_must_fail \
  46                 git submodule add --name ../../modules/evil "$PWD/innocent" evil
  47 '
  48
  49 test_expect_success 'add evil submodule' '
  50         git submodule add "$PWD/innocent" evil &&
  51
  52         mkdir modules &&
  53         cp -r .git/modules/evil modules &&
  54         write_script modules/evil/hooks/post-checkout <<-\EOF &&
  55         echo >&2 "RUNNING POST CHECKOUT"
  56         EOF
  57
  58         git config -f .gitmodules submodule.evil.update checkout &&
  59         git config -f .gitmodules --rename-section \
  60                 submodule.evil submodule.../../modules/evil &&
  61         git add modules &&
  62         git commit -am evil
  63 '
  64
  65 # This step seems like it shouldn't be necessary, since the payload is
  66 # contained entirely in the evil submodule. But due to the vagaries of the
  67 # submodule code, checking out the evil module will fail unless ".git/modules"
  68 # exists. Adding another submodule (with a name that sorts before "evil") is an
  69 # easy way to make sure this is the case in the victim clone.
  70 test_expect_success 'add other submodule' '
  71         git submodule add "$PWD/innocent" another-module &&
  72         git add another-module &&
  73         git commit -am another
  74 '
  75
  76 test_expect_success 'clone evil superproject' '
  77         git clone --recurse-submodules . victim >output 2>&1 &&
  78         ! grep "RUNNING POST CHECKOUT" output
  79 '
  80
  81 test_expect_success 'fsck detects evil superproject' '
  82         test_must_fail git fsck
  83 '
  84
  85 test_expect_success 'transfer.fsckObjects detects evil superproject (unpack)' '
  86         rm -rf dst.git &&
  87         git init --bare dst.git &&
  88         git -C dst.git config transfer.fsckObjects true &&
  89         test_must_fail git push dst.git HEAD
  90 '
  91
  92 test_expect_success 'transfer.fsckObjects detects evil superproject (index)' '
  93         rm -rf dst.git &&
  94         git init --bare dst.git &&
  95         git -C dst.git config transfer.fsckObjects true &&
  96         git -C dst.git config transfer.unpackLimit 1 &&
  97         test_must_fail git push dst.git HEAD
  98 '
  99
 100 # Normally our packs contain commits followed by trees followed by blobs. This
 101 # reverses the order, which requires backtracking to find the context of a
 102 # blob. We'll start with a fresh gitmodules-only tree to make it simpler.
 103 test_expect_success 'create oddly ordered pack' '
 104         git checkout --orphan odd &&
 105         git rm -rf --cached . &&
 106         git add .gitmodules &&
 107         git commit -m odd &&
 108         {
 109                 pack_header 3 &&
 110                 pack_obj $(git rev-parse HEAD:.gitmodules) &&
 111                 pack_obj $(git rev-parse HEAD^{tree}) &&
 112                 pack_obj $(git rev-parse HEAD)
 113         } >odd.pack &&
 114         pack_trailer odd.pack
 115 '
 116
 117 test_expect_success 'transfer.fsckObjects handles odd pack (unpack)' '
 118         rm -rf dst.git &&
 119         git init --bare dst.git &&
 120         test_must_fail git -C dst.git unpack-objects --strict <odd.pack
 121 '
 122
 123 test_expect_success 'transfer.fsckObjects handles odd pack (index)' '
 124         rm -rf dst.git &&
 125         git init --bare dst.git &&
 126         test_must_fail git -C dst.git index-pack --strict --stdin <odd.pack
 127 '
 128
 129 test_expect_success 'index-pack --strict works for non-repo pack' '
 130         rm -rf dst.git &&
 131         git init --bare dst.git &&
 132         cp odd.pack dst.git &&
 133         test_must_fail git -C dst.git index-pack --strict odd.pack 2>output &&
 134         # Make sure we fail due to bad gitmodules content, not because we
 135         # could not read the blob in the first place.
 136         grep gitmodulesName output
 137 '
 138
 139 test_expect_success 'fsck detects symlinked .gitmodules file' '
 140         git init symlink &&
 141         (
 142                 cd symlink &&
 143
 144                 # Make the tree directly to avoid index restrictions.
 145                 #
 146                 # Because symlinks store the target as a blob, choose
 147                 # a pathname that could be parsed as a .gitmodules file
 148                 # to trick naive non-symlink-aware checking.
 149                 tricky="[foo]bar=true" &&
 150                 content=$(git hash-object -w ../.gitmodules) &&
 151                 target=$(printf "$tricky" | git hash-object -w --stdin) &&
 152                 {
 153                         printf "100644 blob $content\t$tricky\n" &&
 154                         printf "120000 blob $target\t.gitmodules\n"
 155                 } | git mktree &&
 156
 157                 # Check not only that we fail, but that it is due to the
 158                 # symlink detector; this grep string comes from the config
 159                 # variable name and will not be translated.
 160                 test_must_fail git fsck 2>output &&
 161                 test_i18ngrep gitmodulesSymlink output
 162         )
 163 '
 164
 165 test_expect_success 'fsck detects non-blob .gitmodules' '
 166         git init non-blob &&
 167         (
 168                 cd non-blob &&
 169
 170                 # As above, make the funny tree directly to avoid index
 171                 # restrictions.
 172                 mkdir subdir &&
 173                 cp ../.gitmodules subdir/file &&
 174                 git add subdir/file &&
 175                 git commit -m ok &&
 176                 git ls-tree HEAD | sed s/subdir/.gitmodules/ | git mktree &&
 177
 178                 test_must_fail git fsck 2>output &&
 179                 test_i18ngrep gitmodulesBlob output
 180         )
 181 '
 182
 183 test_expect_success 'fsck detects corrupt .gitmodules' '
 184         git init corrupt &&
 185         (
 186                 cd corrupt &&
 187
 188                 echo "[broken" >.gitmodules &&
 189                 git add .gitmodules &&
 190                 git commit -m "broken gitmodules" &&
 191
 192                 git fsck 2>output &&
 193                 test_i18ngrep gitmodulesParse output &&
 194                 test_i18ngrep ! "bad config" output
 195         )
 196 '
 197
 198 test_expect_success MINGW 'prevent git~1 squatting on Windows' '
 199         git init squatting &&
 200         (
 201                 cd squatting &&
 202                 mkdir a &&
 203                 touch a/..git &&
 204                 git add a/..git &&
 205                 test_tick &&
 206                 git commit -m initial &&
 207
 208                 modules="$(test_write_lines \
 209                         "[submodule \"b.\"]" "url = ." "path = c" \
 210                         "[submodule \"b\"]" "url = ." "path = d\\\\a" |
 211                         git hash-object -w --stdin)" &&
 212                 rev="$(git rev-parse --verify HEAD)" &&
 213                 hash="$(echo x | git hash-object -w --stdin)" &&
 214                 test_must_fail git update-index --add \
 215                         --cacheinfo 160000,$rev,d\\a 2>err &&
 216                 test_i18ngrep "Invalid path" err &&
 217                 git -c core.protectNTFS=false update-index --add \
 218                         --cacheinfo 100644,$modules,.gitmodules \
 219                         --cacheinfo 160000,$rev,c \
 220                         --cacheinfo 160000,$rev,d\\a \
 221                         --cacheinfo 100644,$hash,d./a/x \
 222                         --cacheinfo 100644,$hash,d./a/..git &&
 223                 test_tick &&
 224                 git -c core.protectNTFS=false commit -m "module"
 225         ) &&
 226         test_must_fail git -c core.protectNTFS=false \
 227                 clone --recurse-submodules squatting squatting-clone 2>err &&
 228         test_i18ngrep -e "directory not empty" -e "not an empty directory" err &&
 229         ! grep gitdir squatting-clone/d/a/git~2
 230 '
 231
 232 test_expect_success 'git dirs of sibling submodules must not be nested' '
 233         git init nested &&
 234         test_commit -C nested nested &&
 235         (
 236                 cd nested &&
 237                 cat >.gitmodules <<-EOF &&
 238                 [submodule "hippo"]
 239                         url = .
 240                         path = thing1
 241                 [submodule "hippo/hooks"]
 242                         url = .
 243                         path = thing2
 244                 EOF
 245                 git clone . thing1 &&
 246                 git clone . thing2 &&
 247                 git add .gitmodules thing1 thing2 &&
 248                 test_tick &&
 249                 git commit -m nested
 250         ) &&
 251         test_must_fail git clone --recurse-submodules nested clone 2>err &&
 252         test_i18ngrep "is inside git dir" err
 253 '
 254
 255 test_done