2 #include "object-store.h"
3 #include "repository.h"
18 #include "submodule-config.h"
20 #include "credential.h"
24 #define MSG_ID(id, msg_type) { STR(id), NULL, NULL, FSCK_##msg_type },
26 const char *id_string
;
27 const char *downcased
;
28 const char *camelcased
;
29 enum fsck_msg_type msg_type
;
30 } msg_id_info
[FSCK_MSG_MAX
+ 1] = {
31 FOREACH_FSCK_MSG_ID(MSG_ID
)
32 { NULL
, NULL
, NULL
, -1 }
37 static void prepare_msg_ids(void)
41 if (msg_id_info
[0].downcased
)
44 /* convert id_string to lower case, without underscores. */
45 for (i
= 0; i
< FSCK_MSG_MAX
; i
++) {
46 const char *p
= msg_id_info
[i
].id_string
;
48 char *q
= xmalloc(len
);
50 msg_id_info
[i
].downcased
= q
;
55 *(q
)++ = tolower(*(p
)++);
58 p
= msg_id_info
[i
].id_string
;
60 msg_id_info
[i
].camelcased
= q
;
74 static int parse_msg_id(const char *text
)
80 for (i
= 0; i
< FSCK_MSG_MAX
; i
++)
81 if (!strcmp(text
, msg_id_info
[i
].downcased
))
87 void list_config_fsck_msg_ids(struct string_list
*list
, const char *prefix
)
93 for (i
= 0; i
< FSCK_MSG_MAX
; i
++)
94 list_config_item(list
, prefix
, msg_id_info
[i
].camelcased
);
97 static enum fsck_msg_type
fsck_msg_type(enum fsck_msg_id msg_id
,
98 struct fsck_options
*options
)
100 assert(msg_id
>= 0 && msg_id
< FSCK_MSG_MAX
);
102 if (!options
->msg_type
) {
103 enum fsck_msg_type msg_type
= msg_id_info
[msg_id
].msg_type
;
105 if (options
->strict
&& msg_type
== FSCK_WARN
)
106 msg_type
= FSCK_ERROR
;
110 return options
->msg_type
[msg_id
];
113 static enum fsck_msg_type
parse_msg_type(const char *str
)
115 if (!strcmp(str
, "error"))
117 else if (!strcmp(str
, "warn"))
119 else if (!strcmp(str
, "ignore"))
122 die("Unknown fsck message type: '%s'", str
);
125 int is_valid_msg_type(const char *msg_id
, const char *msg_type
)
127 if (parse_msg_id(msg_id
) < 0)
129 parse_msg_type(msg_type
);
133 void fsck_set_msg_type_from_ids(struct fsck_options
*options
,
134 enum fsck_msg_id msg_id
,
135 enum fsck_msg_type msg_type
)
137 if (!options
->msg_type
) {
139 enum fsck_msg_type
*severity
;
140 ALLOC_ARRAY(severity
, FSCK_MSG_MAX
);
141 for (i
= 0; i
< FSCK_MSG_MAX
; i
++)
142 severity
[i
] = fsck_msg_type(i
, options
);
143 options
->msg_type
= severity
;
146 options
->msg_type
[msg_id
] = msg_type
;
149 void fsck_set_msg_type(struct fsck_options
*options
,
150 const char *msg_id_str
, const char *msg_type_str
)
152 int msg_id
= parse_msg_id(msg_id_str
);
153 enum fsck_msg_type msg_type
= parse_msg_type(msg_type_str
);
156 die("Unhandled message id: %s", msg_id_str
);
158 if (msg_type
!= FSCK_ERROR
&& msg_id_info
[msg_id
].msg_type
== FSCK_FATAL
)
159 die("Cannot demote %s to %s", msg_id_str
, msg_type_str
);
161 fsck_set_msg_type_from_ids(options
, msg_id
, msg_type
);
164 void fsck_set_msg_types(struct fsck_options
*options
, const char *values
)
166 char *buf
= xstrdup(values
), *to_free
= buf
;
170 int len
= strcspn(buf
, " ,|"), equal
;
180 equal
< len
&& buf
[equal
] != '=' && buf
[equal
] != ':';
182 buf
[equal
] = tolower(buf
[equal
]);
185 if (!strcmp(buf
, "skiplist")) {
187 die("skiplist requires a path");
188 oidset_parse_file(&options
->skiplist
, buf
+ equal
+ 1);
194 die("Missing '=': '%s'", buf
);
196 fsck_set_msg_type(options
, buf
, buf
+ equal
+ 1);
202 static int object_on_skiplist(struct fsck_options
*opts
,
203 const struct object_id
*oid
)
205 return opts
&& oid
&& oidset_contains(&opts
->skiplist
, oid
);
208 __attribute__((format (printf
, 5, 6)))
209 static int report(struct fsck_options
*options
,
210 const struct object_id
*oid
, enum object_type object_type
,
211 enum fsck_msg_id msg_id
, const char *fmt
, ...)
214 struct strbuf sb
= STRBUF_INIT
;
215 enum fsck_msg_type msg_type
= fsck_msg_type(msg_id
, options
);
218 if (msg_type
== FSCK_IGNORE
)
221 if (object_on_skiplist(options
, oid
))
224 if (msg_type
== FSCK_FATAL
)
225 msg_type
= FSCK_ERROR
;
226 else if (msg_type
== FSCK_INFO
)
227 msg_type
= FSCK_WARN
;
230 strbuf_addf(&sb
, "%s: ", msg_id_info
[msg_id
].camelcased
);
233 strbuf_vaddf(&sb
, fmt
, ap
);
234 result
= options
->error_func(options
, oid
, object_type
,
235 msg_type
, msg_id
, sb
.buf
);
242 void fsck_enable_object_names(struct fsck_options
*options
)
244 if (!options
->object_names
)
245 options
->object_names
= kh_init_oid_map();
248 const char *fsck_get_object_name(struct fsck_options
*options
,
249 const struct object_id
*oid
)
252 if (!options
->object_names
)
254 pos
= kh_get_oid_map(options
->object_names
, *oid
);
255 if (pos
>= kh_end(options
->object_names
))
257 return kh_value(options
->object_names
, pos
);
260 void fsck_put_object_name(struct fsck_options
*options
,
261 const struct object_id
*oid
,
262 const char *fmt
, ...)
265 struct strbuf buf
= STRBUF_INIT
;
269 if (!options
->object_names
)
272 pos
= kh_put_oid_map(options
->object_names
, *oid
, &hashret
);
276 strbuf_vaddf(&buf
, fmt
, ap
);
277 kh_value(options
->object_names
, pos
) = strbuf_detach(&buf
, NULL
);
281 const char *fsck_describe_object(struct fsck_options
*options
,
282 const struct object_id
*oid
)
284 static struct strbuf bufs
[] = {
285 STRBUF_INIT
, STRBUF_INIT
, STRBUF_INIT
, STRBUF_INIT
289 const char *name
= fsck_get_object_name(options
, oid
);
292 b
= (b
+ 1) % ARRAY_SIZE(bufs
);
294 strbuf_addstr(buf
, oid_to_hex(oid
));
296 strbuf_addf(buf
, " (%s)", name
);
301 static int fsck_walk_tree(struct tree
*tree
, void *data
, struct fsck_options
*options
)
303 struct tree_desc desc
;
304 struct name_entry entry
;
308 if (parse_tree(tree
))
311 name
= fsck_get_object_name(options
, &tree
->object
.oid
);
312 if (init_tree_desc_gently(&desc
, tree
->buffer
, tree
->size
))
314 while (tree_entry_gently(&desc
, &entry
)) {
318 if (S_ISGITLINK(entry
.mode
))
321 if (S_ISDIR(entry
.mode
)) {
322 obj
= (struct object
*)lookup_tree(the_repository
, &entry
.oid
);
324 fsck_put_object_name(options
, &entry
.oid
, "%s%s/",
326 result
= options
->walk(obj
, OBJ_TREE
, data
, options
);
328 else if (S_ISREG(entry
.mode
) || S_ISLNK(entry
.mode
)) {
329 obj
= (struct object
*)lookup_blob(the_repository
, &entry
.oid
);
331 fsck_put_object_name(options
, &entry
.oid
, "%s%s",
333 result
= options
->walk(obj
, OBJ_BLOB
, data
, options
);
336 result
= error("in tree %s: entry %s has bad mode %.6o",
337 fsck_describe_object(options
, &tree
->object
.oid
),
338 entry
.path
, entry
.mode
);
348 static int fsck_walk_commit(struct commit
*commit
, void *data
, struct fsck_options
*options
)
350 int counter
= 0, generation
= 0, name_prefix_len
= 0;
351 struct commit_list
*parents
;
356 if (parse_commit(commit
))
359 name
= fsck_get_object_name(options
, &commit
->object
.oid
);
361 fsck_put_object_name(options
, get_commit_tree_oid(commit
),
364 result
= options
->walk((struct object
*)get_commit_tree(commit
),
365 OBJ_TREE
, data
, options
);
370 parents
= commit
->parents
;
371 if (name
&& parents
) {
372 int len
= strlen(name
), power
;
374 if (len
&& name
[len
- 1] == '^') {
376 name_prefix_len
= len
- 1;
378 else { /* parse ~<generation> suffix */
379 for (generation
= 0, power
= 1;
380 len
&& isdigit(name
[len
- 1]);
382 generation
+= power
* (name
[--len
] - '0');
383 if (power
> 1 && len
&& name
[len
- 1] == '~')
384 name_prefix_len
= len
- 1;
386 /* Maybe a non-first parent, e.g. HEAD^2 */
388 name_prefix_len
= len
;
395 struct object_id
*oid
= &parents
->item
->object
.oid
;
398 fsck_put_object_name(options
, oid
, "%s^%d",
400 else if (generation
> 0)
401 fsck_put_object_name(options
, oid
, "%.*s~%d",
402 name_prefix_len
, name
,
405 fsck_put_object_name(options
, oid
, "%s^", name
);
407 result
= options
->walk((struct object
*)parents
->item
, OBJ_COMMIT
, data
, options
);
412 parents
= parents
->next
;
417 static int fsck_walk_tag(struct tag
*tag
, void *data
, struct fsck_options
*options
)
419 const char *name
= fsck_get_object_name(options
, &tag
->object
.oid
);
424 fsck_put_object_name(options
, &tag
->tagged
->oid
, "%s", name
);
425 return options
->walk(tag
->tagged
, OBJ_ANY
, data
, options
);
428 int fsck_walk(struct object
*obj
, void *data
, struct fsck_options
*options
)
433 if (obj
->type
== OBJ_NONE
)
434 parse_object(the_repository
, &obj
->oid
);
440 return fsck_walk_tree((struct tree
*)obj
, data
, options
);
442 return fsck_walk_commit((struct commit
*)obj
, data
, options
);
444 return fsck_walk_tag((struct tag
*)obj
, data
, options
);
446 error("Unknown object type for %s",
447 fsck_describe_object(options
, &obj
->oid
));
457 static void name_stack_push(struct name_stack
*stack
, const char *name
)
459 ALLOC_GROW(stack
->names
, stack
->nr
+ 1, stack
->alloc
);
460 stack
->names
[stack
->nr
++] = name
;
463 static const char *name_stack_pop(struct name_stack
*stack
)
465 return stack
->nr
? stack
->names
[--stack
->nr
] : NULL
;
468 static void name_stack_clear(struct name_stack
*stack
)
470 FREE_AND_NULL(stack
->names
);
471 stack
->nr
= stack
->alloc
= 0;
475 * The entries in a tree are ordered in the _path_ order,
476 * which means that a directory entry is ordered by adding
477 * a slash to the end of it.
479 * So a directory called "a" is ordered _after_ a file
480 * called "a.c", because "a/" sorts after "a.c".
482 #define TREE_UNORDERED (-1)
483 #define TREE_HAS_DUPS (-2)
485 static int is_less_than_slash(unsigned char c
)
487 return '\0' < c
&& c
< '/';
490 static int verify_ordered(unsigned mode1
, const char *name1
,
491 unsigned mode2
, const char *name2
,
492 struct name_stack
*candidates
)
494 int len1
= strlen(name1
);
495 int len2
= strlen(name2
);
496 int len
= len1
< len2
? len1
: len2
;
497 unsigned char c1
, c2
;
500 cmp
= memcmp(name1
, name2
, len
);
504 return TREE_UNORDERED
;
507 * Ok, the first <len> characters are the same.
508 * Now we need to order the next one, but turn
509 * a '\0' into a '/' for a directory entry.
515 * git-write-tree used to write out a nonsense tree that has
516 * entries with the same name, one blob and one tree. Make
517 * sure we do not have duplicate entries.
519 return TREE_HAS_DUPS
;
520 if (!c1
&& S_ISDIR(mode1
))
522 if (!c2
&& S_ISDIR(mode2
))
526 * There can be non-consecutive duplicates due to the implicitly
535 * Record non-directory candidates (like "foo" and "foo.bar" in
536 * the example) on a stack and check directory candidates (like
537 * foo/" and "foo.bar/") against that stack.
539 if (!c1
&& is_less_than_slash(c2
)) {
540 name_stack_push(candidates
, name1
);
541 } else if (c2
== '/' && is_less_than_slash(c1
)) {
544 const char *f_name
= name_stack_pop(candidates
);
548 if (!skip_prefix(name2
, f_name
, &p
))
551 return TREE_HAS_DUPS
;
552 if (is_less_than_slash(*p
)) {
553 name_stack_push(candidates
, f_name
);
559 return c1
< c2
? 0 : TREE_UNORDERED
;
562 static int fsck_tree(const struct object_id
*tree_oid
,
563 const char *buffer
, unsigned long size
,
564 struct fsck_options
*options
)
567 int has_null_sha1
= 0;
568 int has_full_path
= 0;
569 int has_empty_name
= 0;
573 int has_zero_pad
= 0;
574 int has_bad_modes
= 0;
575 int has_dup_entries
= 0;
576 int not_properly_sorted
= 0;
577 struct tree_desc desc
;
580 struct name_stack df_dup_candidates
= { NULL
};
582 if (init_tree_desc_gently(&desc
, buffer
, size
)) {
583 retval
+= report(options
, tree_oid
, OBJ_TREE
,
585 "cannot be parsed as a tree");
594 const char *name
, *backslash
;
595 const struct object_id
*entry_oid
;
597 entry_oid
= tree_entry_extract(&desc
, &name
, &mode
);
599 has_null_sha1
|= is_null_oid(entry_oid
);
600 has_full_path
|= !!strchr(name
, '/');
601 has_empty_name
|= !*name
;
602 has_dot
|= !strcmp(name
, ".");
603 has_dotdot
|= !strcmp(name
, "..");
604 has_dotgit
|= is_hfs_dotgit(name
) || is_ntfs_dotgit(name
);
605 has_zero_pad
|= *(char *)desc
.buffer
== '0';
607 if (is_hfs_dotgitmodules(name
) || is_ntfs_dotgitmodules(name
)) {
609 oidset_insert(&options
->gitmodules_found
,
612 retval
+= report(options
,
614 FSCK_MSG_GITMODULES_SYMLINK
,
615 ".gitmodules is a symbolic link");
618 if (is_hfs_dotgitattributes(name
) || is_ntfs_dotgitattributes(name
)) {
620 oidset_insert(&options
->gitattributes_found
,
623 retval
+= report(options
, tree_oid
, OBJ_TREE
,
624 FSCK_MSG_GITATTRIBUTES_SYMLINK
,
625 ".gitattributes is a symlink");
629 if (is_hfs_dotgitignore(name
) ||
630 is_ntfs_dotgitignore(name
))
631 retval
+= report(options
, tree_oid
, OBJ_TREE
,
632 FSCK_MSG_GITIGNORE_SYMLINK
,
633 ".gitignore is a symlink");
634 if (is_hfs_dotmailmap(name
) ||
635 is_ntfs_dotmailmap(name
))
636 retval
+= report(options
, tree_oid
, OBJ_TREE
,
637 FSCK_MSG_MAILMAP_SYMLINK
,
638 ".mailmap is a symlink");
641 if ((backslash
= strchr(name
, '\\'))) {
644 has_dotgit
|= is_ntfs_dotgit(backslash
);
645 if (is_ntfs_dotgitmodules(backslash
)) {
647 oidset_insert(&options
->gitmodules_found
,
650 retval
+= report(options
, tree_oid
, OBJ_TREE
,
651 FSCK_MSG_GITMODULES_SYMLINK
,
652 ".gitmodules is a symbolic link");
654 backslash
= strchr(backslash
, '\\');
658 if (update_tree_entry_gently(&desc
)) {
659 retval
+= report(options
, tree_oid
, OBJ_TREE
,
661 "cannot be parsed as a tree");
676 * This is nonstandard, but we had a few of these
677 * early on when we honored the full set of mode
681 if (!options
->strict
)
689 switch (verify_ordered(o_mode
, o_name
, mode
, name
,
690 &df_dup_candidates
)) {
692 not_properly_sorted
= 1;
706 name_stack_clear(&df_dup_candidates
);
709 retval
+= report(options
, tree_oid
, OBJ_TREE
,
711 "contains entries pointing to null sha1");
713 retval
+= report(options
, tree_oid
, OBJ_TREE
,
714 FSCK_MSG_FULL_PATHNAME
,
715 "contains full pathnames");
717 retval
+= report(options
, tree_oid
, OBJ_TREE
,
719 "contains empty pathname");
721 retval
+= report(options
, tree_oid
, OBJ_TREE
,
725 retval
+= report(options
, tree_oid
, OBJ_TREE
,
729 retval
+= report(options
, tree_oid
, OBJ_TREE
,
733 retval
+= report(options
, tree_oid
, OBJ_TREE
,
734 FSCK_MSG_ZERO_PADDED_FILEMODE
,
735 "contains zero-padded file modes");
737 retval
+= report(options
, tree_oid
, OBJ_TREE
,
738 FSCK_MSG_BAD_FILEMODE
,
739 "contains bad file modes");
741 retval
+= report(options
, tree_oid
, OBJ_TREE
,
742 FSCK_MSG_DUPLICATE_ENTRIES
,
743 "contains duplicate file entries");
744 if (not_properly_sorted
)
745 retval
+= report(options
, tree_oid
, OBJ_TREE
,
746 FSCK_MSG_TREE_NOT_SORTED
,
747 "not properly sorted");
751 static int verify_headers(const void *data
, unsigned long size
,
752 const struct object_id
*oid
, enum object_type type
,
753 struct fsck_options
*options
)
755 const char *buffer
= (const char *)data
;
758 for (i
= 0; i
< size
; i
++) {
761 return report(options
, oid
, type
,
762 FSCK_MSG_NUL_IN_HEADER
,
763 "unterminated header: NUL at offset %ld", i
);
765 if (i
+ 1 < size
&& buffer
[i
+ 1] == '\n')
771 * We did not find double-LF that separates the header
772 * and the body. Not having a body is not a crime but
773 * we do want to see the terminating LF for the last header
776 if (size
&& buffer
[size
- 1] == '\n')
779 return report(options
, oid
, type
,
780 FSCK_MSG_UNTERMINATED_HEADER
, "unterminated header");
783 static int fsck_ident(const char **ident
,
784 const struct object_id
*oid
, enum object_type type
,
785 struct fsck_options
*options
)
787 const char *p
= *ident
;
790 *ident
= strchrnul(*ident
, '\n');
795 return report(options
, oid
, type
, FSCK_MSG_MISSING_NAME_BEFORE_EMAIL
, "invalid author/committer line - missing space before email");
796 p
+= strcspn(p
, "<>\n");
798 return report(options
, oid
, type
, FSCK_MSG_BAD_NAME
, "invalid author/committer line - bad name");
800 return report(options
, oid
, type
, FSCK_MSG_MISSING_EMAIL
, "invalid author/committer line - missing email");
802 return report(options
, oid
, type
, FSCK_MSG_MISSING_SPACE_BEFORE_EMAIL
, "invalid author/committer line - missing space before email");
804 p
+= strcspn(p
, "<>\n");
806 return report(options
, oid
, type
, FSCK_MSG_BAD_EMAIL
, "invalid author/committer line - bad email");
809 return report(options
, oid
, type
, FSCK_MSG_MISSING_SPACE_BEFORE_DATE
, "invalid author/committer line - missing space before date");
811 if (*p
== '0' && p
[1] != ' ')
812 return report(options
, oid
, type
, FSCK_MSG_ZERO_PADDED_DATE
, "invalid author/committer line - zero-padded date");
813 if (date_overflows(parse_timestamp(p
, &end
, 10)))
814 return report(options
, oid
, type
, FSCK_MSG_BAD_DATE_OVERFLOW
, "invalid author/committer line - date causes integer overflow");
815 if ((end
== p
|| *end
!= ' '))
816 return report(options
, oid
, type
, FSCK_MSG_BAD_DATE
, "invalid author/committer line - bad date");
818 if ((*p
!= '+' && *p
!= '-') ||
824 return report(options
, oid
, type
, FSCK_MSG_BAD_TIMEZONE
, "invalid author/committer line - bad time zone");
829 static int fsck_commit(const struct object_id
*oid
,
830 const char *buffer
, unsigned long size
,
831 struct fsck_options
*options
)
833 struct object_id tree_oid
, parent_oid
;
834 unsigned author_count
;
836 const char *buffer_begin
= buffer
;
839 if (verify_headers(buffer
, size
, oid
, OBJ_COMMIT
, options
))
842 if (!skip_prefix(buffer
, "tree ", &buffer
))
843 return report(options
, oid
, OBJ_COMMIT
, FSCK_MSG_MISSING_TREE
, "invalid format - expected 'tree' line");
844 if (parse_oid_hex(buffer
, &tree_oid
, &p
) || *p
!= '\n') {
845 err
= report(options
, oid
, OBJ_COMMIT
, FSCK_MSG_BAD_TREE_SHA1
, "invalid 'tree' line format - bad sha1");
850 while (skip_prefix(buffer
, "parent ", &buffer
)) {
851 if (parse_oid_hex(buffer
, &parent_oid
, &p
) || *p
!= '\n') {
852 err
= report(options
, oid
, OBJ_COMMIT
, FSCK_MSG_BAD_PARENT_SHA1
, "invalid 'parent' line format - bad sha1");
859 while (skip_prefix(buffer
, "author ", &buffer
)) {
861 err
= fsck_ident(&buffer
, oid
, OBJ_COMMIT
, options
);
865 if (author_count
< 1)
866 err
= report(options
, oid
, OBJ_COMMIT
, FSCK_MSG_MISSING_AUTHOR
, "invalid format - expected 'author' line");
867 else if (author_count
> 1)
868 err
= report(options
, oid
, OBJ_COMMIT
, FSCK_MSG_MULTIPLE_AUTHORS
, "invalid format - multiple 'author' lines");
871 if (!skip_prefix(buffer
, "committer ", &buffer
))
872 return report(options
, oid
, OBJ_COMMIT
, FSCK_MSG_MISSING_COMMITTER
, "invalid format - expected 'committer' line");
873 err
= fsck_ident(&buffer
, oid
, OBJ_COMMIT
, options
);
876 if (memchr(buffer_begin
, '\0', size
)) {
877 err
= report(options
, oid
, OBJ_COMMIT
, FSCK_MSG_NUL_IN_COMMIT
,
878 "NUL byte in the commit object body");
885 static int fsck_tag(const struct object_id
*oid
, const char *buffer
,
886 unsigned long size
, struct fsck_options
*options
)
888 struct object_id tagged_oid
;
890 return fsck_tag_standalone(oid
, buffer
, size
, options
, &tagged_oid
,
894 int fsck_tag_standalone(const struct object_id
*oid
, const char *buffer
,
895 unsigned long size
, struct fsck_options
*options
,
896 struct object_id
*tagged_oid
,
901 struct strbuf sb
= STRBUF_INIT
;
904 ret
= verify_headers(buffer
, size
, oid
, OBJ_TAG
, options
);
908 if (!skip_prefix(buffer
, "object ", &buffer
)) {
909 ret
= report(options
, oid
, OBJ_TAG
, FSCK_MSG_MISSING_OBJECT
, "invalid format - expected 'object' line");
912 if (parse_oid_hex(buffer
, tagged_oid
, &p
) || *p
!= '\n') {
913 ret
= report(options
, oid
, OBJ_TAG
, FSCK_MSG_BAD_OBJECT_SHA1
, "invalid 'object' line format - bad sha1");
919 if (!skip_prefix(buffer
, "type ", &buffer
)) {
920 ret
= report(options
, oid
, OBJ_TAG
, FSCK_MSG_MISSING_TYPE_ENTRY
, "invalid format - expected 'type' line");
923 eol
= strchr(buffer
, '\n');
925 ret
= report(options
, oid
, OBJ_TAG
, FSCK_MSG_MISSING_TYPE
, "invalid format - unexpected end after 'type' line");
928 *tagged_type
= type_from_string_gently(buffer
, eol
- buffer
, 1);
929 if (*tagged_type
< 0)
930 ret
= report(options
, oid
, OBJ_TAG
, FSCK_MSG_BAD_TYPE
, "invalid 'type' value");
935 if (!skip_prefix(buffer
, "tag ", &buffer
)) {
936 ret
= report(options
, oid
, OBJ_TAG
, FSCK_MSG_MISSING_TAG_ENTRY
, "invalid format - expected 'tag' line");
939 eol
= strchr(buffer
, '\n');
941 ret
= report(options
, oid
, OBJ_TAG
, FSCK_MSG_MISSING_TAG
, "invalid format - unexpected end after 'type' line");
944 strbuf_addf(&sb
, "refs/tags/%.*s", (int)(eol
- buffer
), buffer
);
945 if (check_refname_format(sb
.buf
, 0)) {
946 ret
= report(options
, oid
, OBJ_TAG
,
947 FSCK_MSG_BAD_TAG_NAME
,
948 "invalid 'tag' name: %.*s",
949 (int)(eol
- buffer
), buffer
);
955 if (!skip_prefix(buffer
, "tagger ", &buffer
)) {
956 /* early tags do not contain 'tagger' lines; warn only */
957 ret
= report(options
, oid
, OBJ_TAG
, FSCK_MSG_MISSING_TAGGER_ENTRY
, "invalid format - expected 'tagger' line");
962 ret
= fsck_ident(&buffer
, oid
, OBJ_TAG
, options
);
966 if (!starts_with(buffer
, "\n")) {
968 * The verify_headers() check will allow
969 * e.g. "[...]tagger <tagger>\nsome
970 * garbage\n\nmessage" to pass, thinking "some
971 * garbage" could be a custom header. E.g. "mktag"
972 * doesn't want any unknown headers.
974 ret
= report(options
, oid
, OBJ_TAG
, FSCK_MSG_EXTRA_HEADER_ENTRY
, "invalid format - extra header(s) after 'tagger'");
985 * Like builtin/submodule--helper.c's starts_with_dot_slash, but without
986 * relying on the platform-dependent is_dir_sep helper.
988 * This is for use in checking whether a submodule URL is interpreted as
989 * relative to the current directory on any platform, since \ is a
990 * directory separator on Windows but not on other platforms.
992 static int starts_with_dot_slash(const char *str
)
994 return str
[0] == '.' && (str
[1] == '/' || str
[1] == '\\');
998 * Like starts_with_dot_slash, this is a variant of submodule--helper's
999 * helper of the same name with the twist that it accepts backslash as a
1000 * directory separator even on non-Windows platforms.
1002 static int starts_with_dot_dot_slash(const char *str
)
1004 return str
[0] == '.' && starts_with_dot_slash(str
+ 1);
1007 static int submodule_url_is_relative(const char *url
)
1009 return starts_with_dot_slash(url
) || starts_with_dot_dot_slash(url
);
1013 * Count directory components that a relative submodule URL should chop
1014 * from the remote_url it is to be resolved against.
1016 * In other words, this counts "../" components at the start of a
1019 * Returns the number of directory components to chop and writes a
1020 * pointer to the next character of url after all leading "./" and
1021 * "../" components to out.
1023 static int count_leading_dotdots(const char *url
, const char **out
)
1027 if (starts_with_dot_dot_slash(url
)) {
1029 url
+= strlen("../");
1032 if (starts_with_dot_slash(url
)) {
1033 url
+= strlen("./");
1041 * Check whether a transport is implemented by git-remote-curl.
1043 * If it is, returns 1 and writes the URL that would be passed to
1044 * git-remote-curl to the "out" parameter.
1046 * Otherwise, returns 0 and leaves "out" untouched.
1049 * http::https://example.com/repo.git -> 1, https://example.com/repo.git
1050 * https://example.com/repo.git -> 1, https://example.com/repo.git
1051 * git://example.com/repo.git -> 0
1053 * This is for use in checking for previously exploitable bugs that
1054 * required a submodule URL to be passed to git-remote-curl.
1056 static int url_to_curl_url(const char *url
, const char **out
)
1059 * We don't need to check for case-aliases, "http.exe", and so
1060 * on because in the default configuration, is_transport_allowed
1061 * prevents URLs with those schemes from being cloned
1064 if (skip_prefix(url
, "http::", out
) ||
1065 skip_prefix(url
, "https::", out
) ||
1066 skip_prefix(url
, "ftp::", out
) ||
1067 skip_prefix(url
, "ftps::", out
))
1069 if (starts_with(url
, "http://") ||
1070 starts_with(url
, "https://") ||
1071 starts_with(url
, "ftp://") ||
1072 starts_with(url
, "ftps://")) {
1079 static int check_submodule_url(const char *url
)
1081 const char *curl_url
;
1083 if (looks_like_command_line_option(url
))
1086 if (submodule_url_is_relative(url
) || starts_with(url
, "git://")) {
1092 * This could be appended to an http URL and url-decoded;
1093 * check for malicious characters.
1095 decoded
= url_decode(url
);
1096 has_nl
= !!strchr(decoded
, '\n');
1103 * URLs which escape their root via "../" can overwrite
1104 * the host field and previous components, resolving to
1105 * URLs like https::example.com/submodule.git and
1106 * https:///example.com/submodule.git that were
1107 * susceptible to CVE-2020-11008.
1109 if (count_leading_dotdots(url
, &next
) > 0 &&
1110 (*next
== ':' || *next
== '/'))
1114 else if (url_to_curl_url(url
, &curl_url
)) {
1115 struct credential c
= CREDENTIAL_INIT
;
1117 if (credential_from_url_gently(&c
, curl_url
, 1) ||
1120 credential_clear(&c
);
1127 struct fsck_gitmodules_data
{
1128 const struct object_id
*oid
;
1129 struct fsck_options
*options
;
1133 static int fsck_gitmodules_fn(const char *var
, const char *value
, void *vdata
)
1135 struct fsck_gitmodules_data
*data
= vdata
;
1136 const char *subsection
, *key
;
1137 size_t subsection_len
;
1140 if (parse_config_key(var
, "submodule", &subsection
, &subsection_len
, &key
) < 0 ||
1144 name
= xmemdupz(subsection
, subsection_len
);
1145 if (check_submodule_name(name
) < 0)
1146 data
->ret
|= report(data
->options
,
1147 data
->oid
, OBJ_BLOB
,
1148 FSCK_MSG_GITMODULES_NAME
,
1149 "disallowed submodule name: %s",
1151 if (!strcmp(key
, "url") && value
&&
1152 check_submodule_url(value
) < 0)
1153 data
->ret
|= report(data
->options
,
1154 data
->oid
, OBJ_BLOB
,
1155 FSCK_MSG_GITMODULES_URL
,
1156 "disallowed submodule url: %s",
1158 if (!strcmp(key
, "path") && value
&&
1159 looks_like_command_line_option(value
))
1160 data
->ret
|= report(data
->options
,
1161 data
->oid
, OBJ_BLOB
,
1162 FSCK_MSG_GITMODULES_PATH
,
1163 "disallowed submodule path: %s",
1165 if (!strcmp(key
, "update") && value
&&
1166 parse_submodule_update_type(value
) == SM_UPDATE_COMMAND
)
1167 data
->ret
|= report(data
->options
, data
->oid
, OBJ_BLOB
,
1168 FSCK_MSG_GITMODULES_UPDATE
,
1169 "disallowed submodule update setting: %s",
1176 static int fsck_blob(const struct object_id
*oid
, const char *buf
,
1177 unsigned long size
, struct fsck_options
*options
)
1181 if (object_on_skiplist(options
, oid
))
1184 if (oidset_contains(&options
->gitmodules_found
, oid
)) {
1185 struct config_options config_opts
= { 0 };
1186 struct fsck_gitmodules_data data
;
1188 oidset_insert(&options
->gitmodules_done
, oid
);
1192 * A missing buffer here is a sign that the caller found the
1193 * blob too gigantic to load into memory. Let's just consider
1196 return report(options
, oid
, OBJ_BLOB
,
1197 FSCK_MSG_GITMODULES_LARGE
,
1198 ".gitmodules too large to parse");
1202 data
.options
= options
;
1204 config_opts
.error_action
= CONFIG_ERROR_SILENT
;
1205 if (git_config_from_mem(fsck_gitmodules_fn
, CONFIG_ORIGIN_BLOB
,
1206 ".gitmodules", buf
, size
, &data
, &config_opts
))
1207 data
.ret
|= report(options
, oid
, OBJ_BLOB
,
1208 FSCK_MSG_GITMODULES_PARSE
,
1209 "could not parse gitmodules blob");
1213 if (oidset_contains(&options
->gitattributes_found
, oid
)) {
1216 oidset_insert(&options
->gitattributes_done
, oid
);
1218 if (!buf
|| size
> ATTR_MAX_FILE_SIZE
) {
1220 * A missing buffer here is a sign that the caller found the
1221 * blob too gigantic to load into memory. Let's just consider
1224 return report(options
, oid
, OBJ_BLOB
,
1225 FSCK_MSG_GITATTRIBUTES_LARGE
,
1226 ".gitattributes too large to parse");
1229 for (ptr
= buf
; *ptr
; ) {
1230 const char *eol
= strchrnul(ptr
, '\n');
1231 if (eol
- ptr
>= ATTR_MAX_LINE_LENGTH
) {
1232 ret
|= report(options
, oid
, OBJ_BLOB
,
1233 FSCK_MSG_GITATTRIBUTES_LINE_LENGTH
,
1234 ".gitattributes has too long lines to parse");
1238 ptr
= *eol
? eol
+ 1 : eol
;
1245 int fsck_object(struct object
*obj
, void *data
, unsigned long size
,
1246 struct fsck_options
*options
)
1249 return report(options
, NULL
, OBJ_NONE
, FSCK_MSG_BAD_OBJECT_SHA1
, "no valid object to fsck");
1251 if (obj
->type
== OBJ_BLOB
)
1252 return fsck_blob(&obj
->oid
, data
, size
, options
);
1253 if (obj
->type
== OBJ_TREE
)
1254 return fsck_tree(&obj
->oid
, data
, size
, options
);
1255 if (obj
->type
== OBJ_COMMIT
)
1256 return fsck_commit(&obj
->oid
, data
, size
, options
);
1257 if (obj
->type
== OBJ_TAG
)
1258 return fsck_tag(&obj
->oid
, data
, size
, options
);
1260 return report(options
, &obj
->oid
, obj
->type
,
1261 FSCK_MSG_UNKNOWN_TYPE
,
1262 "unknown type '%d' (internal fsck error)",
1266 int fsck_error_function(struct fsck_options
*o
,
1267 const struct object_id
*oid
,
1268 enum object_type object_type
,
1269 enum fsck_msg_type msg_type
,
1270 enum fsck_msg_id msg_id
,
1271 const char *message
)
1273 if (msg_type
== FSCK_WARN
) {
1274 warning("object %s: %s", fsck_describe_object(o
, oid
), message
);
1277 error("object %s: %s", fsck_describe_object(o
, oid
), message
);
1281 static int fsck_blobs(struct oidset
*blobs_found
, struct oidset
*blobs_done
,
1282 enum fsck_msg_id msg_missing
, enum fsck_msg_id msg_type
,
1283 struct fsck_options
*options
, const char *blob_type
)
1286 struct oidset_iter iter
;
1287 const struct object_id
*oid
;
1289 oidset_iter_init(blobs_found
, &iter
);
1290 while ((oid
= oidset_iter_next(&iter
))) {
1291 enum object_type type
;
1295 if (oidset_contains(blobs_done
, oid
))
1298 buf
= read_object_file(oid
, &type
, &size
);
1300 if (is_promisor_object(oid
))
1302 ret
|= report(options
,
1303 oid
, OBJ_BLOB
, msg_missing
,
1304 "unable to read %s blob", blob_type
);
1308 if (type
== OBJ_BLOB
)
1309 ret
|= fsck_blob(oid
, buf
, size
, options
);
1311 ret
|= report(options
, oid
, type
, msg_type
,
1312 "non-blob found at %s", blob_type
);
1316 oidset_clear(blobs_found
);
1317 oidset_clear(blobs_done
);
1322 int fsck_finish(struct fsck_options
*options
)
1326 ret
|= fsck_blobs(&options
->gitmodules_found
, &options
->gitmodules_done
,
1327 FSCK_MSG_GITMODULES_MISSING
, FSCK_MSG_GITMODULES_BLOB
,
1328 options
, ".gitmodules");
1329 ret
|= fsck_blobs(&options
->gitattributes_found
, &options
->gitattributes_done
,
1330 FSCK_MSG_GITATTRIBUTES_MISSING
, FSCK_MSG_GITATTRIBUTES_BLOB
,
1331 options
, ".gitattributes");
1336 int git_fsck_config(const char *var
, const char *value
, void *cb
)
1338 struct fsck_options
*options
= cb
;
1339 if (strcmp(var
, "fsck.skiplist") == 0) {
1341 struct strbuf sb
= STRBUF_INIT
;
1343 if (git_config_pathname(&path
, var
, value
))
1345 strbuf_addf(&sb
, "skiplist=%s", path
);
1347 fsck_set_msg_types(options
, sb
.buf
);
1348 strbuf_release(&sb
);
1352 if (skip_prefix(var
, "fsck.", &var
)) {
1353 fsck_set_msg_type(options
, var
, value
);
1357 return git_default_config(var
, value
, cb
);
1361 * Custom error callbacks that are used in more than one place.
1364 int fsck_error_cb_print_missing_gitmodules(struct fsck_options
*o
,
1365 const struct object_id
*oid
,
1366 enum object_type object_type
,
1367 enum fsck_msg_type msg_type
,
1368 enum fsck_msg_id msg_id
,
1369 const char *message
)
1371 if (msg_id
== FSCK_MSG_GITMODULES_MISSING
) {
1372 puts(oid_to_hex(oid
));
1375 return fsck_error_function(o
, oid
, object_type
, msg_type
, msg_id
, message
);