2 #include "object-store.h"
3 #include "repository.h"
17 #include "submodule-config.h"
19 #include "credential.h"
22 static struct oidset gitmodules_found
= OIDSET_INIT
;
23 static struct oidset gitmodules_done
= OIDSET_INIT
;
28 #define FOREACH_MSG_ID(FUNC) \
30 FUNC(NUL_IN_HEADER, FATAL) \
31 FUNC(UNTERMINATED_HEADER, FATAL) \
33 FUNC(BAD_DATE, ERROR) \
34 FUNC(BAD_DATE_OVERFLOW, ERROR) \
35 FUNC(BAD_EMAIL, ERROR) \
36 FUNC(BAD_NAME, ERROR) \
37 FUNC(BAD_OBJECT_SHA1, ERROR) \
38 FUNC(BAD_PARENT_SHA1, ERROR) \
39 FUNC(BAD_TAG_OBJECT, ERROR) \
40 FUNC(BAD_TIMEZONE, ERROR) \
41 FUNC(BAD_TREE, ERROR) \
42 FUNC(BAD_TREE_SHA1, ERROR) \
43 FUNC(BAD_TYPE, ERROR) \
44 FUNC(DUPLICATE_ENTRIES, ERROR) \
45 FUNC(MISSING_AUTHOR, ERROR) \
46 FUNC(MISSING_COMMITTER, ERROR) \
47 FUNC(MISSING_EMAIL, ERROR) \
48 FUNC(MISSING_NAME_BEFORE_EMAIL, ERROR) \
49 FUNC(MISSING_OBJECT, ERROR) \
50 FUNC(MISSING_SPACE_BEFORE_DATE, ERROR) \
51 FUNC(MISSING_SPACE_BEFORE_EMAIL, ERROR) \
52 FUNC(MISSING_TAG, ERROR) \
53 FUNC(MISSING_TAG_ENTRY, ERROR) \
54 FUNC(MISSING_TREE, ERROR) \
55 FUNC(MISSING_TREE_OBJECT, ERROR) \
56 FUNC(MISSING_TYPE, ERROR) \
57 FUNC(MISSING_TYPE_ENTRY, ERROR) \
58 FUNC(MULTIPLE_AUTHORS, ERROR) \
59 FUNC(TREE_NOT_SORTED, ERROR) \
60 FUNC(UNKNOWN_TYPE, ERROR) \
61 FUNC(ZERO_PADDED_DATE, ERROR) \
62 FUNC(GITMODULES_MISSING, ERROR) \
63 FUNC(GITMODULES_BLOB, ERROR) \
64 FUNC(GITMODULES_LARGE, ERROR) \
65 FUNC(GITMODULES_NAME, ERROR) \
66 FUNC(GITMODULES_SYMLINK, ERROR) \
67 FUNC(GITMODULES_URL, ERROR) \
68 FUNC(GITMODULES_PATH, ERROR) \
69 FUNC(GITMODULES_UPDATE, ERROR) \
71 FUNC(BAD_FILEMODE, WARN) \
72 FUNC(EMPTY_NAME, WARN) \
73 FUNC(FULL_PATHNAME, WARN) \
75 FUNC(HAS_DOTDOT, WARN) \
76 FUNC(HAS_DOTGIT, WARN) \
77 FUNC(NULL_SHA1, WARN) \
78 FUNC(ZERO_PADDED_FILEMODE, WARN) \
79 FUNC(NUL_IN_COMMIT, WARN) \
80 /* infos (reported as warnings, but ignored by default) */ \
81 FUNC(GITMODULES_PARSE, INFO) \
82 FUNC(BAD_TAG_NAME, INFO) \
83 FUNC(MISSING_TAGGER_ENTRY, INFO)
85 #define MSG_ID(id, msg_type) FSCK_MSG_##id,
87 FOREACH_MSG_ID(MSG_ID
)
93 #define MSG_ID(id, msg_type) { STR(id), NULL, NULL, FSCK_##msg_type },
95 const char *id_string
;
96 const char *downcased
;
97 const char *camelcased
;
99 } msg_id_info
[FSCK_MSG_MAX
+ 1] = {
100 FOREACH_MSG_ID(MSG_ID
)
101 { NULL
, NULL
, NULL
, -1 }
105 static void prepare_msg_ids(void)
109 if (msg_id_info
[0].downcased
)
112 /* convert id_string to lower case, without underscores. */
113 for (i
= 0; i
< FSCK_MSG_MAX
; i
++) {
114 const char *p
= msg_id_info
[i
].id_string
;
116 char *q
= xmalloc(len
);
118 msg_id_info
[i
].downcased
= q
;
123 *(q
)++ = tolower(*(p
)++);
126 p
= msg_id_info
[i
].id_string
;
128 msg_id_info
[i
].camelcased
= q
;
135 *q
++ = tolower(*p
++);
142 static int parse_msg_id(const char *text
)
148 for (i
= 0; i
< FSCK_MSG_MAX
; i
++)
149 if (!strcmp(text
, msg_id_info
[i
].downcased
))
155 void list_config_fsck_msg_ids(struct string_list
*list
, const char *prefix
)
161 for (i
= 0; i
< FSCK_MSG_MAX
; i
++)
162 list_config_item(list
, prefix
, msg_id_info
[i
].camelcased
);
165 static int fsck_msg_type(enum fsck_msg_id msg_id
,
166 struct fsck_options
*options
)
170 assert(msg_id
>= 0 && msg_id
< FSCK_MSG_MAX
);
172 if (options
->msg_type
)
173 msg_type
= options
->msg_type
[msg_id
];
175 msg_type
= msg_id_info
[msg_id
].msg_type
;
176 if (options
->strict
&& msg_type
== FSCK_WARN
)
177 msg_type
= FSCK_ERROR
;
183 static int parse_msg_type(const char *str
)
185 if (!strcmp(str
, "error"))
187 else if (!strcmp(str
, "warn"))
189 else if (!strcmp(str
, "ignore"))
192 die("Unknown fsck message type: '%s'", str
);
195 int is_valid_msg_type(const char *msg_id
, const char *msg_type
)
197 if (parse_msg_id(msg_id
) < 0)
199 parse_msg_type(msg_type
);
203 void fsck_set_msg_type(struct fsck_options
*options
,
204 const char *msg_id
, const char *msg_type
)
206 int id
= parse_msg_id(msg_id
), type
;
209 die("Unhandled message id: %s", msg_id
);
210 type
= parse_msg_type(msg_type
);
212 if (type
!= FSCK_ERROR
&& msg_id_info
[id
].msg_type
== FSCK_FATAL
)
213 die("Cannot demote %s to %s", msg_id
, msg_type
);
215 if (!options
->msg_type
) {
218 ALLOC_ARRAY(msg_type
, FSCK_MSG_MAX
);
219 for (i
= 0; i
< FSCK_MSG_MAX
; i
++)
220 msg_type
[i
] = fsck_msg_type(i
, options
);
221 options
->msg_type
= msg_type
;
224 options
->msg_type
[id
] = type
;
227 void fsck_set_msg_types(struct fsck_options
*options
, const char *values
)
229 char *buf
= xstrdup(values
), *to_free
= buf
;
233 int len
= strcspn(buf
, " ,|"), equal
;
243 equal
< len
&& buf
[equal
] != '=' && buf
[equal
] != ':';
245 buf
[equal
] = tolower(buf
[equal
]);
248 if (!strcmp(buf
, "skiplist")) {
250 die("skiplist requires a path");
251 oidset_parse_file(&options
->skiplist
, buf
+ equal
+ 1);
257 die("Missing '=': '%s'", buf
);
259 fsck_set_msg_type(options
, buf
, buf
+ equal
+ 1);
265 static void append_msg_id(struct strbuf
*sb
, const char *msg_id
)
268 char c
= *(msg_id
)++;
273 strbuf_addch(sb
, tolower(c
));
276 strbuf_addch(sb
, *(msg_id
)++);
280 strbuf_addstr(sb
, ": ");
283 static int object_on_skiplist(struct fsck_options
*opts
,
284 const struct object_id
*oid
)
286 return opts
&& oid
&& oidset_contains(&opts
->skiplist
, oid
);
289 __attribute__((format (printf
, 5, 6)))
290 static int report(struct fsck_options
*options
,
291 const struct object_id
*oid
, enum object_type object_type
,
292 enum fsck_msg_id id
, const char *fmt
, ...)
295 struct strbuf sb
= STRBUF_INIT
;
296 int msg_type
= fsck_msg_type(id
, options
), result
;
298 if (msg_type
== FSCK_IGNORE
)
301 if (object_on_skiplist(options
, oid
))
304 if (msg_type
== FSCK_FATAL
)
305 msg_type
= FSCK_ERROR
;
306 else if (msg_type
== FSCK_INFO
)
307 msg_type
= FSCK_WARN
;
309 append_msg_id(&sb
, msg_id_info
[id
].id_string
);
312 strbuf_vaddf(&sb
, fmt
, ap
);
313 result
= options
->error_func(options
, oid
, object_type
,
321 void fsck_enable_object_names(struct fsck_options
*options
)
323 if (!options
->object_names
)
324 options
->object_names
= kh_init_oid_map();
327 const char *fsck_get_object_name(struct fsck_options
*options
,
328 const struct object_id
*oid
)
331 if (!options
->object_names
)
333 pos
= kh_get_oid_map(options
->object_names
, *oid
);
334 if (pos
>= kh_end(options
->object_names
))
336 return kh_value(options
->object_names
, pos
);
339 void fsck_put_object_name(struct fsck_options
*options
,
340 const struct object_id
*oid
,
341 const char *fmt
, ...)
344 struct strbuf buf
= STRBUF_INIT
;
348 if (!options
->object_names
)
351 pos
= kh_put_oid_map(options
->object_names
, *oid
, &hashret
);
355 strbuf_vaddf(&buf
, fmt
, ap
);
356 kh_value(options
->object_names
, pos
) = strbuf_detach(&buf
, NULL
);
360 const char *fsck_describe_object(struct fsck_options
*options
,
361 const struct object_id
*oid
)
363 static struct strbuf bufs
[] = {
364 STRBUF_INIT
, STRBUF_INIT
, STRBUF_INIT
, STRBUF_INIT
368 const char *name
= fsck_get_object_name(options
, oid
);
371 b
= (b
+ 1) % ARRAY_SIZE(bufs
);
373 strbuf_addstr(buf
, oid_to_hex(oid
));
375 strbuf_addf(buf
, " (%s)", name
);
380 static int fsck_walk_tree(struct tree
*tree
, void *data
, struct fsck_options
*options
)
382 struct tree_desc desc
;
383 struct name_entry entry
;
387 if (parse_tree(tree
))
390 name
= fsck_get_object_name(options
, &tree
->object
.oid
);
391 if (init_tree_desc_gently(&desc
, tree
->buffer
, tree
->size
))
393 while (tree_entry_gently(&desc
, &entry
)) {
397 if (S_ISGITLINK(entry
.mode
))
400 if (S_ISDIR(entry
.mode
)) {
401 obj
= (struct object
*)lookup_tree(the_repository
, &entry
.oid
);
403 fsck_put_object_name(options
, &entry
.oid
, "%s%s/",
405 result
= options
->walk(obj
, OBJ_TREE
, data
, options
);
407 else if (S_ISREG(entry
.mode
) || S_ISLNK(entry
.mode
)) {
408 obj
= (struct object
*)lookup_blob(the_repository
, &entry
.oid
);
410 fsck_put_object_name(options
, &entry
.oid
, "%s%s",
412 result
= options
->walk(obj
, OBJ_BLOB
, data
, options
);
415 result
= error("in tree %s: entry %s has bad mode %.6o",
416 fsck_describe_object(options
, &tree
->object
.oid
),
417 entry
.path
, entry
.mode
);
427 static int fsck_walk_commit(struct commit
*commit
, void *data
, struct fsck_options
*options
)
429 int counter
= 0, generation
= 0, name_prefix_len
= 0;
430 struct commit_list
*parents
;
435 if (parse_commit(commit
))
438 name
= fsck_get_object_name(options
, &commit
->object
.oid
);
440 fsck_put_object_name(options
, get_commit_tree_oid(commit
),
443 result
= options
->walk((struct object
*)get_commit_tree(commit
),
444 OBJ_TREE
, data
, options
);
449 parents
= commit
->parents
;
450 if (name
&& parents
) {
451 int len
= strlen(name
), power
;
453 if (len
&& name
[len
- 1] == '^') {
455 name_prefix_len
= len
- 1;
457 else { /* parse ~<generation> suffix */
458 for (generation
= 0, power
= 1;
459 len
&& isdigit(name
[len
- 1]);
461 generation
+= power
* (name
[--len
] - '0');
462 if (power
> 1 && len
&& name
[len
- 1] == '~')
463 name_prefix_len
= len
- 1;
469 struct object_id
*oid
= &parents
->item
->object
.oid
;
472 fsck_put_object_name(options
, oid
, "%s^%d",
474 else if (generation
> 0)
475 fsck_put_object_name(options
, oid
, "%.*s~%d",
476 name_prefix_len
, name
,
479 fsck_put_object_name(options
, oid
, "%s^", name
);
481 result
= options
->walk((struct object
*)parents
->item
, OBJ_COMMIT
, data
, options
);
486 parents
= parents
->next
;
491 static int fsck_walk_tag(struct tag
*tag
, void *data
, struct fsck_options
*options
)
493 const char *name
= fsck_get_object_name(options
, &tag
->object
.oid
);
498 fsck_put_object_name(options
, &tag
->tagged
->oid
, "%s", name
);
499 return options
->walk(tag
->tagged
, OBJ_ANY
, data
, options
);
502 int fsck_walk(struct object
*obj
, void *data
, struct fsck_options
*options
)
507 if (obj
->type
== OBJ_NONE
)
508 parse_object(the_repository
, &obj
->oid
);
514 return fsck_walk_tree((struct tree
*)obj
, data
, options
);
516 return fsck_walk_commit((struct commit
*)obj
, data
, options
);
518 return fsck_walk_tag((struct tag
*)obj
, data
, options
);
520 error("Unknown object type for %s",
521 fsck_describe_object(options
, &obj
->oid
));
531 static void name_stack_push(struct name_stack
*stack
, const char *name
)
533 ALLOC_GROW(stack
->names
, stack
->nr
+ 1, stack
->alloc
);
534 stack
->names
[stack
->nr
++] = name
;
537 static const char *name_stack_pop(struct name_stack
*stack
)
539 return stack
->nr
? stack
->names
[--stack
->nr
] : NULL
;
542 static void name_stack_clear(struct name_stack
*stack
)
544 FREE_AND_NULL(stack
->names
);
545 stack
->nr
= stack
->alloc
= 0;
549 * The entries in a tree are ordered in the _path_ order,
550 * which means that a directory entry is ordered by adding
551 * a slash to the end of it.
553 * So a directory called "a" is ordered _after_ a file
554 * called "a.c", because "a/" sorts after "a.c".
556 #define TREE_UNORDERED (-1)
557 #define TREE_HAS_DUPS (-2)
559 static int is_less_than_slash(unsigned char c
)
561 return '\0' < c
&& c
< '/';
564 static int verify_ordered(unsigned mode1
, const char *name1
,
565 unsigned mode2
, const char *name2
,
566 struct name_stack
*candidates
)
568 int len1
= strlen(name1
);
569 int len2
= strlen(name2
);
570 int len
= len1
< len2
? len1
: len2
;
571 unsigned char c1
, c2
;
574 cmp
= memcmp(name1
, name2
, len
);
578 return TREE_UNORDERED
;
581 * Ok, the first <len> characters are the same.
582 * Now we need to order the next one, but turn
583 * a '\0' into a '/' for a directory entry.
589 * git-write-tree used to write out a nonsense tree that has
590 * entries with the same name, one blob and one tree. Make
591 * sure we do not have duplicate entries.
593 return TREE_HAS_DUPS
;
594 if (!c1
&& S_ISDIR(mode1
))
596 if (!c2
&& S_ISDIR(mode2
))
600 * There can be non-consecutive duplicates due to the implicitly
609 * Record non-directory candidates (like "foo" and "foo.bar" in
610 * the example) on a stack and check directory candidates (like
611 * foo/" and "foo.bar/") against that stack.
613 if (!c1
&& is_less_than_slash(c2
)) {
614 name_stack_push(candidates
, name1
);
615 } else if (c2
== '/' && is_less_than_slash(c1
)) {
618 const char *f_name
= name_stack_pop(candidates
);
622 if (!skip_prefix(name2
, f_name
, &p
))
625 return TREE_HAS_DUPS
;
626 if (is_less_than_slash(*p
)) {
627 name_stack_push(candidates
, f_name
);
633 return c1
< c2
? 0 : TREE_UNORDERED
;
636 static int fsck_tree(const struct object_id
*oid
,
637 const char *buffer
, unsigned long size
,
638 struct fsck_options
*options
)
641 int has_null_sha1
= 0;
642 int has_full_path
= 0;
643 int has_empty_name
= 0;
647 int has_zero_pad
= 0;
648 int has_bad_modes
= 0;
649 int has_dup_entries
= 0;
650 int not_properly_sorted
= 0;
651 struct tree_desc desc
;
654 struct name_stack df_dup_candidates
= { NULL
};
656 if (init_tree_desc_gently(&desc
, buffer
, size
)) {
657 retval
+= report(options
, oid
, OBJ_TREE
, FSCK_MSG_BAD_TREE
, "cannot be parsed as a tree");
666 const char *name
, *backslash
;
667 const struct object_id
*oid
;
669 oid
= tree_entry_extract(&desc
, &name
, &mode
);
671 has_null_sha1
|= is_null_oid(oid
);
672 has_full_path
|= !!strchr(name
, '/');
673 has_empty_name
|= !*name
;
674 has_dot
|= !strcmp(name
, ".");
675 has_dotdot
|= !strcmp(name
, "..");
676 has_dotgit
|= is_hfs_dotgit(name
) || is_ntfs_dotgit(name
);
677 has_zero_pad
|= *(char *)desc
.buffer
== '0';
679 if (is_hfs_dotgitmodules(name
) || is_ntfs_dotgitmodules(name
)) {
681 oidset_insert(&gitmodules_found
, oid
);
683 retval
+= report(options
,
685 FSCK_MSG_GITMODULES_SYMLINK
,
686 ".gitmodules is a symbolic link");
689 if ((backslash
= strchr(name
, '\\'))) {
692 has_dotgit
|= is_ntfs_dotgit(backslash
);
693 if (is_ntfs_dotgitmodules(backslash
)) {
695 oidset_insert(&gitmodules_found
, oid
);
697 retval
+= report(options
, oid
, OBJ_TREE
,
698 FSCK_MSG_GITMODULES_SYMLINK
,
699 ".gitmodules is a symbolic link");
701 backslash
= strchr(backslash
, '\\');
705 if (update_tree_entry_gently(&desc
)) {
706 retval
+= report(options
, oid
, OBJ_TREE
, FSCK_MSG_BAD_TREE
, "cannot be parsed as a tree");
721 * This is nonstandard, but we had a few of these
722 * early on when we honored the full set of mode
726 if (!options
->strict
)
734 switch (verify_ordered(o_mode
, o_name
, mode
, name
,
735 &df_dup_candidates
)) {
737 not_properly_sorted
= 1;
751 name_stack_clear(&df_dup_candidates
);
754 retval
+= report(options
, oid
, OBJ_TREE
, FSCK_MSG_NULL_SHA1
, "contains entries pointing to null sha1");
756 retval
+= report(options
, oid
, OBJ_TREE
, FSCK_MSG_FULL_PATHNAME
, "contains full pathnames");
758 retval
+= report(options
, oid
, OBJ_TREE
, FSCK_MSG_EMPTY_NAME
, "contains empty pathname");
760 retval
+= report(options
, oid
, OBJ_TREE
, FSCK_MSG_HAS_DOT
, "contains '.'");
762 retval
+= report(options
, oid
, OBJ_TREE
, FSCK_MSG_HAS_DOTDOT
, "contains '..'");
764 retval
+= report(options
, oid
, OBJ_TREE
, FSCK_MSG_HAS_DOTGIT
, "contains '.git'");
766 retval
+= report(options
, oid
, OBJ_TREE
, FSCK_MSG_ZERO_PADDED_FILEMODE
, "contains zero-padded file modes");
768 retval
+= report(options
, oid
, OBJ_TREE
, FSCK_MSG_BAD_FILEMODE
, "contains bad file modes");
770 retval
+= report(options
, oid
, OBJ_TREE
, FSCK_MSG_DUPLICATE_ENTRIES
, "contains duplicate file entries");
771 if (not_properly_sorted
)
772 retval
+= report(options
, oid
, OBJ_TREE
, FSCK_MSG_TREE_NOT_SORTED
, "not properly sorted");
776 static int verify_headers(const void *data
, unsigned long size
,
777 const struct object_id
*oid
, enum object_type type
,
778 struct fsck_options
*options
)
780 const char *buffer
= (const char *)data
;
783 for (i
= 0; i
< size
; i
++) {
786 return report(options
, oid
, type
,
787 FSCK_MSG_NUL_IN_HEADER
,
788 "unterminated header: NUL at offset %ld", i
);
790 if (i
+ 1 < size
&& buffer
[i
+ 1] == '\n')
796 * We did not find double-LF that separates the header
797 * and the body. Not having a body is not a crime but
798 * we do want to see the terminating LF for the last header
801 if (size
&& buffer
[size
- 1] == '\n')
804 return report(options
, oid
, type
,
805 FSCK_MSG_UNTERMINATED_HEADER
, "unterminated header");
808 static int fsck_ident(const char **ident
,
809 const struct object_id
*oid
, enum object_type type
,
810 struct fsck_options
*options
)
812 const char *p
= *ident
;
815 *ident
= strchrnul(*ident
, '\n');
820 return report(options
, oid
, type
, FSCK_MSG_MISSING_NAME_BEFORE_EMAIL
, "invalid author/committer line - missing space before email");
821 p
+= strcspn(p
, "<>\n");
823 return report(options
, oid
, type
, FSCK_MSG_BAD_NAME
, "invalid author/committer line - bad name");
825 return report(options
, oid
, type
, FSCK_MSG_MISSING_EMAIL
, "invalid author/committer line - missing email");
827 return report(options
, oid
, type
, FSCK_MSG_MISSING_SPACE_BEFORE_EMAIL
, "invalid author/committer line - missing space before email");
829 p
+= strcspn(p
, "<>\n");
831 return report(options
, oid
, type
, FSCK_MSG_BAD_EMAIL
, "invalid author/committer line - bad email");
834 return report(options
, oid
, type
, FSCK_MSG_MISSING_SPACE_BEFORE_DATE
, "invalid author/committer line - missing space before date");
836 if (*p
== '0' && p
[1] != ' ')
837 return report(options
, oid
, type
, FSCK_MSG_ZERO_PADDED_DATE
, "invalid author/committer line - zero-padded date");
838 if (date_overflows(parse_timestamp(p
, &end
, 10)))
839 return report(options
, oid
, type
, FSCK_MSG_BAD_DATE_OVERFLOW
, "invalid author/committer line - date causes integer overflow");
840 if ((end
== p
|| *end
!= ' '))
841 return report(options
, oid
, type
, FSCK_MSG_BAD_DATE
, "invalid author/committer line - bad date");
843 if ((*p
!= '+' && *p
!= '-') ||
849 return report(options
, oid
, type
, FSCK_MSG_BAD_TIMEZONE
, "invalid author/committer line - bad time zone");
854 static int fsck_commit(const struct object_id
*oid
,
855 const char *buffer
, unsigned long size
,
856 struct fsck_options
*options
)
858 struct object_id tree_oid
, parent_oid
;
859 unsigned author_count
;
861 const char *buffer_begin
= buffer
;
864 if (verify_headers(buffer
, size
, oid
, OBJ_COMMIT
, options
))
867 if (!skip_prefix(buffer
, "tree ", &buffer
))
868 return report(options
, oid
, OBJ_COMMIT
, FSCK_MSG_MISSING_TREE
, "invalid format - expected 'tree' line");
869 if (parse_oid_hex(buffer
, &tree_oid
, &p
) || *p
!= '\n') {
870 err
= report(options
, oid
, OBJ_COMMIT
, FSCK_MSG_BAD_TREE_SHA1
, "invalid 'tree' line format - bad sha1");
875 while (skip_prefix(buffer
, "parent ", &buffer
)) {
876 if (parse_oid_hex(buffer
, &parent_oid
, &p
) || *p
!= '\n') {
877 err
= report(options
, oid
, OBJ_COMMIT
, FSCK_MSG_BAD_PARENT_SHA1
, "invalid 'parent' line format - bad sha1");
884 while (skip_prefix(buffer
, "author ", &buffer
)) {
886 err
= fsck_ident(&buffer
, oid
, OBJ_COMMIT
, options
);
890 if (author_count
< 1)
891 err
= report(options
, oid
, OBJ_COMMIT
, FSCK_MSG_MISSING_AUTHOR
, "invalid format - expected 'author' line");
892 else if (author_count
> 1)
893 err
= report(options
, oid
, OBJ_COMMIT
, FSCK_MSG_MULTIPLE_AUTHORS
, "invalid format - multiple 'author' lines");
896 if (!skip_prefix(buffer
, "committer ", &buffer
))
897 return report(options
, oid
, OBJ_COMMIT
, FSCK_MSG_MISSING_COMMITTER
, "invalid format - expected 'committer' line");
898 err
= fsck_ident(&buffer
, oid
, OBJ_COMMIT
, options
);
901 if (memchr(buffer_begin
, '\0', size
)) {
902 err
= report(options
, oid
, OBJ_COMMIT
, FSCK_MSG_NUL_IN_COMMIT
,
903 "NUL byte in the commit object body");
910 static int fsck_tag(const struct object_id
*oid
, const char *buffer
,
911 unsigned long size
, struct fsck_options
*options
)
913 struct object_id tagged_oid
;
916 struct strbuf sb
= STRBUF_INIT
;
919 ret
= verify_headers(buffer
, size
, oid
, OBJ_TAG
, options
);
923 if (!skip_prefix(buffer
, "object ", &buffer
)) {
924 ret
= report(options
, oid
, OBJ_TAG
, FSCK_MSG_MISSING_OBJECT
, "invalid format - expected 'object' line");
927 if (parse_oid_hex(buffer
, &tagged_oid
, &p
) || *p
!= '\n') {
928 ret
= report(options
, oid
, OBJ_TAG
, FSCK_MSG_BAD_OBJECT_SHA1
, "invalid 'object' line format - bad sha1");
934 if (!skip_prefix(buffer
, "type ", &buffer
)) {
935 ret
= report(options
, oid
, OBJ_TAG
, FSCK_MSG_MISSING_TYPE_ENTRY
, "invalid format - expected 'type' line");
938 eol
= strchr(buffer
, '\n');
940 ret
= report(options
, oid
, OBJ_TAG
, FSCK_MSG_MISSING_TYPE
, "invalid format - unexpected end after 'type' line");
943 if (type_from_string_gently(buffer
, eol
- buffer
, 1) < 0)
944 ret
= report(options
, oid
, OBJ_TAG
, FSCK_MSG_BAD_TYPE
, "invalid 'type' value");
949 if (!skip_prefix(buffer
, "tag ", &buffer
)) {
950 ret
= report(options
, oid
, OBJ_TAG
, FSCK_MSG_MISSING_TAG_ENTRY
, "invalid format - expected 'tag' line");
953 eol
= strchr(buffer
, '\n');
955 ret
= report(options
, oid
, OBJ_TAG
, FSCK_MSG_MISSING_TAG
, "invalid format - unexpected end after 'type' line");
958 strbuf_addf(&sb
, "refs/tags/%.*s", (int)(eol
- buffer
), buffer
);
959 if (check_refname_format(sb
.buf
, 0)) {
960 ret
= report(options
, oid
, OBJ_TAG
,
961 FSCK_MSG_BAD_TAG_NAME
,
962 "invalid 'tag' name: %.*s",
963 (int)(eol
- buffer
), buffer
);
969 if (!skip_prefix(buffer
, "tagger ", &buffer
)) {
970 /* early tags do not contain 'tagger' lines; warn only */
971 ret
= report(options
, oid
, OBJ_TAG
, FSCK_MSG_MISSING_TAGGER_ENTRY
, "invalid format - expected 'tagger' line");
976 ret
= fsck_ident(&buffer
, oid
, OBJ_TAG
, options
);
984 * Like builtin/submodule--helper.c's starts_with_dot_slash, but without
985 * relying on the platform-dependent is_dir_sep helper.
987 * This is for use in checking whether a submodule URL is interpreted as
988 * relative to the current directory on any platform, since \ is a
989 * directory separator on Windows but not on other platforms.
991 static int starts_with_dot_slash(const char *str
)
993 return str
[0] == '.' && (str
[1] == '/' || str
[1] == '\\');
997 * Like starts_with_dot_slash, this is a variant of submodule--helper's
998 * helper of the same name with the twist that it accepts backslash as a
999 * directory separator even on non-Windows platforms.
1001 static int starts_with_dot_dot_slash(const char *str
)
1003 return str
[0] == '.' && starts_with_dot_slash(str
+ 1);
1006 static int submodule_url_is_relative(const char *url
)
1008 return starts_with_dot_slash(url
) || starts_with_dot_dot_slash(url
);
1012 * Count directory components that a relative submodule URL should chop
1013 * from the remote_url it is to be resolved against.
1015 * In other words, this counts "../" components at the start of a
1018 * Returns the number of directory components to chop and writes a
1019 * pointer to the next character of url after all leading "./" and
1020 * "../" components to out.
1022 static int count_leading_dotdots(const char *url
, const char **out
)
1026 if (starts_with_dot_dot_slash(url
)) {
1028 url
+= strlen("../");
1031 if (starts_with_dot_slash(url
)) {
1032 url
+= strlen("./");
1040 * Check whether a transport is implemented by git-remote-curl.
1042 * If it is, returns 1 and writes the URL that would be passed to
1043 * git-remote-curl to the "out" parameter.
1045 * Otherwise, returns 0 and leaves "out" untouched.
1048 * http::https://example.com/repo.git -> 1, https://example.com/repo.git
1049 * https://example.com/repo.git -> 1, https://example.com/repo.git
1050 * git://example.com/repo.git -> 0
1052 * This is for use in checking for previously exploitable bugs that
1053 * required a submodule URL to be passed to git-remote-curl.
1055 static int url_to_curl_url(const char *url
, const char **out
)
1058 * We don't need to check for case-aliases, "http.exe", and so
1059 * on because in the default configuration, is_transport_allowed
1060 * prevents URLs with those schemes from being cloned
1063 if (skip_prefix(url
, "http::", out
) ||
1064 skip_prefix(url
, "https::", out
) ||
1065 skip_prefix(url
, "ftp::", out
) ||
1066 skip_prefix(url
, "ftps::", out
))
1068 if (starts_with(url
, "http://") ||
1069 starts_with(url
, "https://") ||
1070 starts_with(url
, "ftp://") ||
1071 starts_with(url
, "ftps://")) {
1078 static int check_submodule_url(const char *url
)
1080 const char *curl_url
;
1082 if (looks_like_command_line_option(url
))
1085 if (submodule_url_is_relative(url
)) {
1091 * This could be appended to an http URL and url-decoded;
1092 * check for malicious characters.
1094 decoded
= url_decode(url
);
1095 has_nl
= !!strchr(decoded
, '\n');
1102 * URLs which escape their root via "../" can overwrite
1103 * the host field and previous components, resolving to
1104 * URLs like https::example.com/submodule.git and
1105 * https:///example.com/submodule.git that were
1106 * susceptible to CVE-2020-11008.
1108 if (count_leading_dotdots(url
, &next
) > 0 &&
1109 (*next
== ':' || *next
== '/'))
1113 else if (url_to_curl_url(url
, &curl_url
)) {
1114 struct credential c
= CREDENTIAL_INIT
;
1116 if (credential_from_url_gently(&c
, curl_url
, 1) ||
1119 credential_clear(&c
);
1126 struct fsck_gitmodules_data
{
1127 const struct object_id
*oid
;
1128 struct fsck_options
*options
;
1132 static int fsck_gitmodules_fn(const char *var
, const char *value
, void *vdata
)
1134 struct fsck_gitmodules_data
*data
= vdata
;
1135 const char *subsection
, *key
;
1136 size_t subsection_len
;
1139 if (parse_config_key(var
, "submodule", &subsection
, &subsection_len
, &key
) < 0 ||
1143 name
= xmemdupz(subsection
, subsection_len
);
1144 if (check_submodule_name(name
) < 0)
1145 data
->ret
|= report(data
->options
,
1146 data
->oid
, OBJ_BLOB
,
1147 FSCK_MSG_GITMODULES_NAME
,
1148 "disallowed submodule name: %s",
1150 if (!strcmp(key
, "url") && value
&&
1151 check_submodule_url(value
) < 0)
1152 data
->ret
|= report(data
->options
,
1153 data
->oid
, OBJ_BLOB
,
1154 FSCK_MSG_GITMODULES_URL
,
1155 "disallowed submodule url: %s",
1157 if (!strcmp(key
, "path") && value
&&
1158 looks_like_command_line_option(value
))
1159 data
->ret
|= report(data
->options
,
1160 data
->oid
, OBJ_BLOB
,
1161 FSCK_MSG_GITMODULES_PATH
,
1162 "disallowed submodule path: %s",
1164 if (!strcmp(key
, "update") && value
&&
1165 parse_submodule_update_type(value
) == SM_UPDATE_COMMAND
)
1166 data
->ret
|= report(data
->options
, data
->oid
, OBJ_BLOB
,
1167 FSCK_MSG_GITMODULES_UPDATE
,
1168 "disallowed submodule update setting: %s",
1175 static int fsck_blob(const struct object_id
*oid
, const char *buf
,
1176 unsigned long size
, struct fsck_options
*options
)
1178 struct fsck_gitmodules_data data
;
1179 struct config_options config_opts
= { 0 };
1181 if (!oidset_contains(&gitmodules_found
, oid
))
1183 oidset_insert(&gitmodules_done
, oid
);
1185 if (object_on_skiplist(options
, oid
))
1190 * A missing buffer here is a sign that the caller found the
1191 * blob too gigantic to load into memory. Let's just consider
1194 return report(options
, oid
, OBJ_BLOB
,
1195 FSCK_MSG_GITMODULES_LARGE
,
1196 ".gitmodules too large to parse");
1200 data
.options
= options
;
1202 config_opts
.error_action
= CONFIG_ERROR_SILENT
;
1203 if (git_config_from_mem(fsck_gitmodules_fn
, CONFIG_ORIGIN_BLOB
,
1204 ".gitmodules", buf
, size
, &data
, &config_opts
))
1205 data
.ret
|= report(options
, oid
, OBJ_BLOB
,
1206 FSCK_MSG_GITMODULES_PARSE
,
1207 "could not parse gitmodules blob");
1212 int fsck_object(struct object
*obj
, void *data
, unsigned long size
,
1213 struct fsck_options
*options
)
1216 return report(options
, NULL
, OBJ_NONE
, FSCK_MSG_BAD_OBJECT_SHA1
, "no valid object to fsck");
1218 if (obj
->type
== OBJ_BLOB
)
1219 return fsck_blob(&obj
->oid
, data
, size
, options
);
1220 if (obj
->type
== OBJ_TREE
)
1221 return fsck_tree(&obj
->oid
, data
, size
, options
);
1222 if (obj
->type
== OBJ_COMMIT
)
1223 return fsck_commit(&obj
->oid
, data
, size
, options
);
1224 if (obj
->type
== OBJ_TAG
)
1225 return fsck_tag(&obj
->oid
, data
, size
, options
);
1227 return report(options
, &obj
->oid
, obj
->type
,
1228 FSCK_MSG_UNKNOWN_TYPE
,
1229 "unknown type '%d' (internal fsck error)",
1233 int fsck_error_function(struct fsck_options
*o
,
1234 const struct object_id
*oid
,
1235 enum object_type object_type
,
1236 int msg_type
, const char *message
)
1238 if (msg_type
== FSCK_WARN
) {
1239 warning("object %s: %s", fsck_describe_object(o
, oid
), message
);
1242 error("object %s: %s", fsck_describe_object(o
, oid
), message
);
1246 int fsck_finish(struct fsck_options
*options
)
1249 struct oidset_iter iter
;
1250 const struct object_id
*oid
;
1252 oidset_iter_init(&gitmodules_found
, &iter
);
1253 while ((oid
= oidset_iter_next(&iter
))) {
1254 enum object_type type
;
1258 if (oidset_contains(&gitmodules_done
, oid
))
1261 buf
= read_object_file(oid
, &type
, &size
);
1263 if (is_promisor_object(oid
))
1265 ret
|= report(options
,
1267 FSCK_MSG_GITMODULES_MISSING
,
1268 "unable to read .gitmodules blob");
1272 if (type
== OBJ_BLOB
)
1273 ret
|= fsck_blob(oid
, buf
, size
, options
);
1275 ret
|= report(options
,
1277 FSCK_MSG_GITMODULES_BLOB
,
1278 "non-blob found at .gitmodules");
1283 oidset_clear(&gitmodules_found
);
1284 oidset_clear(&gitmodules_done
);