2 #include "object-store.h"
3 #include "repository.h"
17 #include "submodule-config.h"
19 #include "credential.h"
22 static struct oidset gitmodules_found
= OIDSET_INIT
;
23 static struct oidset gitmodules_done
= OIDSET_INIT
;
28 #define FOREACH_MSG_ID(FUNC) \
30 FUNC(NUL_IN_HEADER, FATAL) \
31 FUNC(UNTERMINATED_HEADER, FATAL) \
33 FUNC(BAD_DATE, ERROR) \
34 FUNC(BAD_DATE_OVERFLOW, ERROR) \
35 FUNC(BAD_EMAIL, ERROR) \
36 FUNC(BAD_NAME, ERROR) \
37 FUNC(BAD_OBJECT_SHA1, ERROR) \
38 FUNC(BAD_PARENT_SHA1, ERROR) \
39 FUNC(BAD_TAG_OBJECT, ERROR) \
40 FUNC(BAD_TIMEZONE, ERROR) \
41 FUNC(BAD_TREE, ERROR) \
42 FUNC(BAD_TREE_SHA1, ERROR) \
43 FUNC(BAD_TYPE, ERROR) \
44 FUNC(DUPLICATE_ENTRIES, ERROR) \
45 FUNC(MISSING_AUTHOR, ERROR) \
46 FUNC(MISSING_COMMITTER, ERROR) \
47 FUNC(MISSING_EMAIL, ERROR) \
48 FUNC(MISSING_GRAFT, ERROR) \
49 FUNC(MISSING_NAME_BEFORE_EMAIL, ERROR) \
50 FUNC(MISSING_OBJECT, ERROR) \
51 FUNC(MISSING_PARENT, ERROR) \
52 FUNC(MISSING_SPACE_BEFORE_DATE, ERROR) \
53 FUNC(MISSING_SPACE_BEFORE_EMAIL, ERROR) \
54 FUNC(MISSING_TAG, ERROR) \
55 FUNC(MISSING_TAG_ENTRY, ERROR) \
56 FUNC(MISSING_TAG_OBJECT, ERROR) \
57 FUNC(MISSING_TREE, ERROR) \
58 FUNC(MISSING_TREE_OBJECT, ERROR) \
59 FUNC(MISSING_TYPE, ERROR) \
60 FUNC(MISSING_TYPE_ENTRY, ERROR) \
61 FUNC(MULTIPLE_AUTHORS, ERROR) \
62 FUNC(TAG_OBJECT_NOT_TAG, ERROR) \
63 FUNC(TREE_NOT_SORTED, ERROR) \
64 FUNC(UNKNOWN_TYPE, ERROR) \
65 FUNC(ZERO_PADDED_DATE, ERROR) \
66 FUNC(GITMODULES_MISSING, ERROR) \
67 FUNC(GITMODULES_BLOB, ERROR) \
68 FUNC(GITMODULES_LARGE, ERROR) \
69 FUNC(GITMODULES_NAME, ERROR) \
70 FUNC(GITMODULES_SYMLINK, ERROR) \
71 FUNC(GITMODULES_URL, ERROR) \
72 FUNC(GITMODULES_PATH, ERROR) \
73 FUNC(GITMODULES_UPDATE, ERROR) \
75 FUNC(BAD_FILEMODE, WARN) \
76 FUNC(EMPTY_NAME, WARN) \
77 FUNC(FULL_PATHNAME, WARN) \
79 FUNC(HAS_DOTDOT, WARN) \
80 FUNC(HAS_DOTGIT, WARN) \
81 FUNC(NULL_SHA1, WARN) \
82 FUNC(ZERO_PADDED_FILEMODE, WARN) \
83 FUNC(NUL_IN_COMMIT, WARN) \
84 /* infos (reported as warnings, but ignored by default) */ \
85 FUNC(GITMODULES_PARSE, INFO) \
86 FUNC(BAD_TAG_NAME, INFO) \
87 FUNC(MISSING_TAGGER_ENTRY, INFO)
89 #define MSG_ID(id, msg_type) FSCK_MSG_##id,
91 FOREACH_MSG_ID(MSG_ID
)
97 #define MSG_ID(id, msg_type) { STR(id), NULL, NULL, FSCK_##msg_type },
99 const char *id_string
;
100 const char *downcased
;
101 const char *camelcased
;
103 } msg_id_info
[FSCK_MSG_MAX
+ 1] = {
104 FOREACH_MSG_ID(MSG_ID
)
105 { NULL
, NULL
, NULL
, -1 }
109 static void prepare_msg_ids(void)
113 if (msg_id_info
[0].downcased
)
116 /* convert id_string to lower case, without underscores. */
117 for (i
= 0; i
< FSCK_MSG_MAX
; i
++) {
118 const char *p
= msg_id_info
[i
].id_string
;
120 char *q
= xmalloc(len
);
122 msg_id_info
[i
].downcased
= q
;
127 *(q
)++ = tolower(*(p
)++);
130 p
= msg_id_info
[i
].id_string
;
132 msg_id_info
[i
].camelcased
= q
;
139 *q
++ = tolower(*p
++);
146 static int parse_msg_id(const char *text
)
152 for (i
= 0; i
< FSCK_MSG_MAX
; i
++)
153 if (!strcmp(text
, msg_id_info
[i
].downcased
))
159 void list_config_fsck_msg_ids(struct string_list
*list
, const char *prefix
)
165 for (i
= 0; i
< FSCK_MSG_MAX
; i
++)
166 list_config_item(list
, prefix
, msg_id_info
[i
].camelcased
);
169 static int fsck_msg_type(enum fsck_msg_id msg_id
,
170 struct fsck_options
*options
)
174 assert(msg_id
>= 0 && msg_id
< FSCK_MSG_MAX
);
176 if (options
->msg_type
)
177 msg_type
= options
->msg_type
[msg_id
];
179 msg_type
= msg_id_info
[msg_id
].msg_type
;
180 if (options
->strict
&& msg_type
== FSCK_WARN
)
181 msg_type
= FSCK_ERROR
;
187 static int parse_msg_type(const char *str
)
189 if (!strcmp(str
, "error"))
191 else if (!strcmp(str
, "warn"))
193 else if (!strcmp(str
, "ignore"))
196 die("Unknown fsck message type: '%s'", str
);
199 int is_valid_msg_type(const char *msg_id
, const char *msg_type
)
201 if (parse_msg_id(msg_id
) < 0)
203 parse_msg_type(msg_type
);
207 void fsck_set_msg_type(struct fsck_options
*options
,
208 const char *msg_id
, const char *msg_type
)
210 int id
= parse_msg_id(msg_id
), type
;
213 die("Unhandled message id: %s", msg_id
);
214 type
= parse_msg_type(msg_type
);
216 if (type
!= FSCK_ERROR
&& msg_id_info
[id
].msg_type
== FSCK_FATAL
)
217 die("Cannot demote %s to %s", msg_id
, msg_type
);
219 if (!options
->msg_type
) {
222 ALLOC_ARRAY(msg_type
, FSCK_MSG_MAX
);
223 for (i
= 0; i
< FSCK_MSG_MAX
; i
++)
224 msg_type
[i
] = fsck_msg_type(i
, options
);
225 options
->msg_type
= msg_type
;
228 options
->msg_type
[id
] = type
;
231 void fsck_set_msg_types(struct fsck_options
*options
, const char *values
)
233 char *buf
= xstrdup(values
), *to_free
= buf
;
237 int len
= strcspn(buf
, " ,|"), equal
;
247 equal
< len
&& buf
[equal
] != '=' && buf
[equal
] != ':';
249 buf
[equal
] = tolower(buf
[equal
]);
252 if (!strcmp(buf
, "skiplist")) {
254 die("skiplist requires a path");
255 oidset_parse_file(&options
->skiplist
, buf
+ equal
+ 1);
261 die("Missing '=': '%s'", buf
);
263 fsck_set_msg_type(options
, buf
, buf
+ equal
+ 1);
269 static void append_msg_id(struct strbuf
*sb
, const char *msg_id
)
272 char c
= *(msg_id
)++;
277 strbuf_addch(sb
, tolower(c
));
280 strbuf_addch(sb
, *(msg_id
)++);
284 strbuf_addstr(sb
, ": ");
287 static int object_on_skiplist(struct fsck_options
*opts
, struct object
*obj
)
289 return opts
&& obj
&& oidset_contains(&opts
->skiplist
, &obj
->oid
);
292 __attribute__((format (printf
, 4, 5)))
293 static int report(struct fsck_options
*options
, struct object
*object
,
294 enum fsck_msg_id id
, const char *fmt
, ...)
297 struct strbuf sb
= STRBUF_INIT
;
298 int msg_type
= fsck_msg_type(id
, options
), result
;
300 if (msg_type
== FSCK_IGNORE
)
303 if (object_on_skiplist(options
, object
))
306 if (msg_type
== FSCK_FATAL
)
307 msg_type
= FSCK_ERROR
;
308 else if (msg_type
== FSCK_INFO
)
309 msg_type
= FSCK_WARN
;
311 append_msg_id(&sb
, msg_id_info
[id
].id_string
);
314 strbuf_vaddf(&sb
, fmt
, ap
);
315 result
= options
->error_func(options
, object
, msg_type
, sb
.buf
);
322 static char *get_object_name(struct fsck_options
*options
, struct object
*obj
)
324 if (!options
->object_names
)
326 return lookup_decoration(options
->object_names
, obj
);
329 static void put_object_name(struct fsck_options
*options
, struct object
*obj
,
330 const char *fmt
, ...)
333 struct strbuf buf
= STRBUF_INIT
;
336 if (!options
->object_names
)
338 existing
= lookup_decoration(options
->object_names
, obj
);
342 strbuf_vaddf(&buf
, fmt
, ap
);
343 add_decoration(options
->object_names
, obj
, strbuf_detach(&buf
, NULL
));
347 static const char *describe_object(struct fsck_options
*o
, struct object
*obj
)
349 static struct strbuf buf
= STRBUF_INIT
;
353 strbuf_addstr(&buf
, oid_to_hex(&obj
->oid
));
354 if (o
->object_names
&& (name
= lookup_decoration(o
->object_names
, obj
)))
355 strbuf_addf(&buf
, " (%s)", name
);
360 static int fsck_walk_tree(struct tree
*tree
, void *data
, struct fsck_options
*options
)
362 struct tree_desc desc
;
363 struct name_entry entry
;
367 if (parse_tree(tree
))
370 name
= get_object_name(options
, &tree
->object
);
371 if (init_tree_desc_gently(&desc
, tree
->buffer
, tree
->size
))
373 while (tree_entry_gently(&desc
, &entry
)) {
377 if (S_ISGITLINK(entry
.mode
))
380 if (S_ISDIR(entry
.mode
)) {
381 obj
= (struct object
*)lookup_tree(the_repository
, &entry
.oid
);
383 put_object_name(options
, obj
, "%s%s/", name
,
385 result
= options
->walk(obj
, OBJ_TREE
, data
, options
);
387 else if (S_ISREG(entry
.mode
) || S_ISLNK(entry
.mode
)) {
388 obj
= (struct object
*)lookup_blob(the_repository
, &entry
.oid
);
390 put_object_name(options
, obj
, "%s%s", name
,
392 result
= options
->walk(obj
, OBJ_BLOB
, data
, options
);
395 result
= error("in tree %s: entry %s has bad mode %.6o",
396 describe_object(options
, &tree
->object
), entry
.path
, entry
.mode
);
406 static int fsck_walk_commit(struct commit
*commit
, void *data
, struct fsck_options
*options
)
408 int counter
= 0, generation
= 0, name_prefix_len
= 0;
409 struct commit_list
*parents
;
414 if (parse_commit(commit
))
417 name
= get_object_name(options
, &commit
->object
);
419 put_object_name(options
, &get_commit_tree(commit
)->object
,
422 result
= options
->walk((struct object
*)get_commit_tree(commit
),
423 OBJ_TREE
, data
, options
);
428 parents
= commit
->parents
;
429 if (name
&& parents
) {
430 int len
= strlen(name
), power
;
432 if (len
&& name
[len
- 1] == '^') {
434 name_prefix_len
= len
- 1;
436 else { /* parse ~<generation> suffix */
437 for (generation
= 0, power
= 1;
438 len
&& isdigit(name
[len
- 1]);
440 generation
+= power
* (name
[--len
] - '0');
441 if (power
> 1 && len
&& name
[len
- 1] == '~')
442 name_prefix_len
= len
- 1;
448 struct object
*obj
= &parents
->item
->object
;
451 put_object_name(options
, obj
, "%s^%d",
453 else if (generation
> 0)
454 put_object_name(options
, obj
, "%.*s~%d",
455 name_prefix_len
, name
, generation
+ 1);
457 put_object_name(options
, obj
, "%s^", name
);
459 result
= options
->walk((struct object
*)parents
->item
, OBJ_COMMIT
, data
, options
);
464 parents
= parents
->next
;
469 static int fsck_walk_tag(struct tag
*tag
, void *data
, struct fsck_options
*options
)
471 char *name
= get_object_name(options
, &tag
->object
);
476 put_object_name(options
, tag
->tagged
, "%s", name
);
477 return options
->walk(tag
->tagged
, OBJ_ANY
, data
, options
);
480 int fsck_walk(struct object
*obj
, void *data
, struct fsck_options
*options
)
485 if (obj
->type
== OBJ_NONE
)
486 parse_object(the_repository
, &obj
->oid
);
492 return fsck_walk_tree((struct tree
*)obj
, data
, options
);
494 return fsck_walk_commit((struct commit
*)obj
, data
, options
);
496 return fsck_walk_tag((struct tag
*)obj
, data
, options
);
498 error("Unknown object type for %s", describe_object(options
, obj
));
504 * The entries in a tree are ordered in the _path_ order,
505 * which means that a directory entry is ordered by adding
506 * a slash to the end of it.
508 * So a directory called "a" is ordered _after_ a file
509 * called "a.c", because "a/" sorts after "a.c".
511 #define TREE_UNORDERED (-1)
512 #define TREE_HAS_DUPS (-2)
514 static int verify_ordered(unsigned mode1
, const char *name1
, unsigned mode2
, const char *name2
)
516 int len1
= strlen(name1
);
517 int len2
= strlen(name2
);
518 int len
= len1
< len2
? len1
: len2
;
519 unsigned char c1
, c2
;
522 cmp
= memcmp(name1
, name2
, len
);
526 return TREE_UNORDERED
;
529 * Ok, the first <len> characters are the same.
530 * Now we need to order the next one, but turn
531 * a '\0' into a '/' for a directory entry.
537 * git-write-tree used to write out a nonsense tree that has
538 * entries with the same name, one blob and one tree. Make
539 * sure we do not have duplicate entries.
541 return TREE_HAS_DUPS
;
542 if (!c1
&& S_ISDIR(mode1
))
544 if (!c2
&& S_ISDIR(mode2
))
546 return c1
< c2
? 0 : TREE_UNORDERED
;
549 static int fsck_tree(struct tree
*item
, struct fsck_options
*options
)
552 int has_null_sha1
= 0;
553 int has_full_path
= 0;
554 int has_empty_name
= 0;
558 int has_zero_pad
= 0;
559 int has_bad_modes
= 0;
560 int has_dup_entries
= 0;
561 int not_properly_sorted
= 0;
562 struct tree_desc desc
;
566 if (init_tree_desc_gently(&desc
, item
->buffer
, item
->size
)) {
567 retval
+= report(options
, &item
->object
, FSCK_MSG_BAD_TREE
, "cannot be parsed as a tree");
576 const char *name
, *backslash
;
577 const struct object_id
*oid
;
579 oid
= tree_entry_extract(&desc
, &name
, &mode
);
581 has_null_sha1
|= is_null_oid(oid
);
582 has_full_path
|= !!strchr(name
, '/');
583 has_empty_name
|= !*name
;
584 has_dot
|= !strcmp(name
, ".");
585 has_dotdot
|= !strcmp(name
, "..");
586 has_dotgit
|= is_hfs_dotgit(name
) || is_ntfs_dotgit(name
);
587 has_zero_pad
|= *(char *)desc
.buffer
== '0';
589 if (is_hfs_dotgitmodules(name
) || is_ntfs_dotgitmodules(name
)) {
591 oidset_insert(&gitmodules_found
, oid
);
593 retval
+= report(options
, &item
->object
,
594 FSCK_MSG_GITMODULES_SYMLINK
,
595 ".gitmodules is a symbolic link");
598 if ((backslash
= strchr(name
, '\\'))) {
601 has_dotgit
|= is_ntfs_dotgit(backslash
);
602 if (is_ntfs_dotgitmodules(backslash
)) {
604 oidset_insert(&gitmodules_found
, oid
);
606 retval
+= report(options
, &item
->object
,
607 FSCK_MSG_GITMODULES_SYMLINK
,
608 ".gitmodules is a symbolic link");
610 backslash
= strchr(backslash
, '\\');
614 if (update_tree_entry_gently(&desc
)) {
615 retval
+= report(options
, &item
->object
, FSCK_MSG_BAD_TREE
, "cannot be parsed as a tree");
630 * This is nonstandard, but we had a few of these
631 * early on when we honored the full set of mode
635 if (!options
->strict
)
643 switch (verify_ordered(o_mode
, o_name
, mode
, name
)) {
645 not_properly_sorted
= 1;
660 retval
+= report(options
, &item
->object
, FSCK_MSG_NULL_SHA1
, "contains entries pointing to null sha1");
662 retval
+= report(options
, &item
->object
, FSCK_MSG_FULL_PATHNAME
, "contains full pathnames");
664 retval
+= report(options
, &item
->object
, FSCK_MSG_EMPTY_NAME
, "contains empty pathname");
666 retval
+= report(options
, &item
->object
, FSCK_MSG_HAS_DOT
, "contains '.'");
668 retval
+= report(options
, &item
->object
, FSCK_MSG_HAS_DOTDOT
, "contains '..'");
670 retval
+= report(options
, &item
->object
, FSCK_MSG_HAS_DOTGIT
, "contains '.git'");
672 retval
+= report(options
, &item
->object
, FSCK_MSG_ZERO_PADDED_FILEMODE
, "contains zero-padded file modes");
674 retval
+= report(options
, &item
->object
, FSCK_MSG_BAD_FILEMODE
, "contains bad file modes");
676 retval
+= report(options
, &item
->object
, FSCK_MSG_DUPLICATE_ENTRIES
, "contains duplicate file entries");
677 if (not_properly_sorted
)
678 retval
+= report(options
, &item
->object
, FSCK_MSG_TREE_NOT_SORTED
, "not properly sorted");
682 static int verify_headers(const void *data
, unsigned long size
,
683 struct object
*obj
, struct fsck_options
*options
)
685 const char *buffer
= (const char *)data
;
688 for (i
= 0; i
< size
; i
++) {
691 return report(options
, obj
,
692 FSCK_MSG_NUL_IN_HEADER
,
693 "unterminated header: NUL at offset %ld", i
);
695 if (i
+ 1 < size
&& buffer
[i
+ 1] == '\n')
701 * We did not find double-LF that separates the header
702 * and the body. Not having a body is not a crime but
703 * we do want to see the terminating LF for the last header
706 if (size
&& buffer
[size
- 1] == '\n')
709 return report(options
, obj
,
710 FSCK_MSG_UNTERMINATED_HEADER
, "unterminated header");
713 static int fsck_ident(const char **ident
, struct object
*obj
, struct fsck_options
*options
)
715 const char *p
= *ident
;
718 *ident
= strchrnul(*ident
, '\n');
723 return report(options
, obj
, FSCK_MSG_MISSING_NAME_BEFORE_EMAIL
, "invalid author/committer line - missing space before email");
724 p
+= strcspn(p
, "<>\n");
726 return report(options
, obj
, FSCK_MSG_BAD_NAME
, "invalid author/committer line - bad name");
728 return report(options
, obj
, FSCK_MSG_MISSING_EMAIL
, "invalid author/committer line - missing email");
730 return report(options
, obj
, FSCK_MSG_MISSING_SPACE_BEFORE_EMAIL
, "invalid author/committer line - missing space before email");
732 p
+= strcspn(p
, "<>\n");
734 return report(options
, obj
, FSCK_MSG_BAD_EMAIL
, "invalid author/committer line - bad email");
737 return report(options
, obj
, FSCK_MSG_MISSING_SPACE_BEFORE_DATE
, "invalid author/committer line - missing space before date");
739 if (*p
== '0' && p
[1] != ' ')
740 return report(options
, obj
, FSCK_MSG_ZERO_PADDED_DATE
, "invalid author/committer line - zero-padded date");
741 if (date_overflows(parse_timestamp(p
, &end
, 10)))
742 return report(options
, obj
, FSCK_MSG_BAD_DATE_OVERFLOW
, "invalid author/committer line - date causes integer overflow");
743 if ((end
== p
|| *end
!= ' '))
744 return report(options
, obj
, FSCK_MSG_BAD_DATE
, "invalid author/committer line - bad date");
746 if ((*p
!= '+' && *p
!= '-') ||
752 return report(options
, obj
, FSCK_MSG_BAD_TIMEZONE
, "invalid author/committer line - bad time zone");
757 static int fsck_commit_buffer(struct commit
*commit
, const char *buffer
,
758 unsigned long size
, struct fsck_options
*options
)
760 struct object_id tree_oid
, oid
;
761 struct commit_graft
*graft
;
762 unsigned parent_count
, parent_line_count
= 0, author_count
;
764 const char *buffer_begin
= buffer
;
767 if (verify_headers(buffer
, size
, &commit
->object
, options
))
770 if (!skip_prefix(buffer
, "tree ", &buffer
))
771 return report(options
, &commit
->object
, FSCK_MSG_MISSING_TREE
, "invalid format - expected 'tree' line");
772 if (parse_oid_hex(buffer
, &tree_oid
, &p
) || *p
!= '\n') {
773 err
= report(options
, &commit
->object
, FSCK_MSG_BAD_TREE_SHA1
, "invalid 'tree' line format - bad sha1");
778 while (skip_prefix(buffer
, "parent ", &buffer
)) {
779 if (parse_oid_hex(buffer
, &oid
, &p
) || *p
!= '\n') {
780 err
= report(options
, &commit
->object
, FSCK_MSG_BAD_PARENT_SHA1
, "invalid 'parent' line format - bad sha1");
787 graft
= lookup_commit_graft(the_repository
, &commit
->object
.oid
);
788 parent_count
= commit_list_count(commit
->parents
);
790 if (graft
->nr_parent
== -1 && !parent_count
)
791 ; /* shallow commit */
792 else if (graft
->nr_parent
!= parent_count
) {
793 err
= report(options
, &commit
->object
, FSCK_MSG_MISSING_GRAFT
, "graft objects missing");
798 if (parent_count
!= parent_line_count
) {
799 err
= report(options
, &commit
->object
, FSCK_MSG_MISSING_PARENT
, "parent objects missing");
805 while (skip_prefix(buffer
, "author ", &buffer
)) {
807 err
= fsck_ident(&buffer
, &commit
->object
, options
);
811 if (author_count
< 1)
812 err
= report(options
, &commit
->object
, FSCK_MSG_MISSING_AUTHOR
, "invalid format - expected 'author' line");
813 else if (author_count
> 1)
814 err
= report(options
, &commit
->object
, FSCK_MSG_MULTIPLE_AUTHORS
, "invalid format - multiple 'author' lines");
817 if (!skip_prefix(buffer
, "committer ", &buffer
))
818 return report(options
, &commit
->object
, FSCK_MSG_MISSING_COMMITTER
, "invalid format - expected 'committer' line");
819 err
= fsck_ident(&buffer
, &commit
->object
, options
);
822 if (!get_commit_tree(commit
)) {
823 err
= report(options
, &commit
->object
, FSCK_MSG_BAD_TREE
, "could not load commit's tree %s", oid_to_hex(&tree_oid
));
827 if (memchr(buffer_begin
, '\0', size
)) {
828 err
= report(options
, &commit
->object
, FSCK_MSG_NUL_IN_COMMIT
,
829 "NUL byte in the commit object body");
836 static int fsck_commit(struct commit
*commit
, const char *data
,
837 unsigned long size
, struct fsck_options
*options
)
839 const char *buffer
= data
? data
: get_commit_buffer(commit
, &size
);
840 int ret
= fsck_commit_buffer(commit
, buffer
, size
, options
);
842 unuse_commit_buffer(commit
, buffer
);
846 static int fsck_tag_buffer(struct tag
*tag
, const char *data
,
847 unsigned long size
, struct fsck_options
*options
)
849 struct object_id oid
;
852 char *to_free
= NULL
, *eol
;
853 struct strbuf sb
= STRBUF_INIT
;
859 enum object_type type
;
862 read_object_file(&tag
->object
.oid
, &type
, &size
);
864 return report(options
, &tag
->object
,
865 FSCK_MSG_MISSING_TAG_OBJECT
,
866 "cannot read tag object");
868 if (type
!= OBJ_TAG
) {
869 ret
= report(options
, &tag
->object
,
870 FSCK_MSG_TAG_OBJECT_NOT_TAG
,
871 "expected tag got %s",
877 ret
= verify_headers(buffer
, size
, &tag
->object
, options
);
881 if (!skip_prefix(buffer
, "object ", &buffer
)) {
882 ret
= report(options
, &tag
->object
, FSCK_MSG_MISSING_OBJECT
, "invalid format - expected 'object' line");
885 if (parse_oid_hex(buffer
, &oid
, &p
) || *p
!= '\n') {
886 ret
= report(options
, &tag
->object
, FSCK_MSG_BAD_OBJECT_SHA1
, "invalid 'object' line format - bad sha1");
892 if (!skip_prefix(buffer
, "type ", &buffer
)) {
893 ret
= report(options
, &tag
->object
, FSCK_MSG_MISSING_TYPE_ENTRY
, "invalid format - expected 'type' line");
896 eol
= strchr(buffer
, '\n');
898 ret
= report(options
, &tag
->object
, FSCK_MSG_MISSING_TYPE
, "invalid format - unexpected end after 'type' line");
901 if (type_from_string_gently(buffer
, eol
- buffer
, 1) < 0)
902 ret
= report(options
, &tag
->object
, FSCK_MSG_BAD_TYPE
, "invalid 'type' value");
907 if (!skip_prefix(buffer
, "tag ", &buffer
)) {
908 ret
= report(options
, &tag
->object
, FSCK_MSG_MISSING_TAG_ENTRY
, "invalid format - expected 'tag' line");
911 eol
= strchr(buffer
, '\n');
913 ret
= report(options
, &tag
->object
, FSCK_MSG_MISSING_TAG
, "invalid format - unexpected end after 'type' line");
916 strbuf_addf(&sb
, "refs/tags/%.*s", (int)(eol
- buffer
), buffer
);
917 if (check_refname_format(sb
.buf
, 0)) {
918 ret
= report(options
, &tag
->object
, FSCK_MSG_BAD_TAG_NAME
,
919 "invalid 'tag' name: %.*s",
920 (int)(eol
- buffer
), buffer
);
926 if (!skip_prefix(buffer
, "tagger ", &buffer
)) {
927 /* early tags do not contain 'tagger' lines; warn only */
928 ret
= report(options
, &tag
->object
, FSCK_MSG_MISSING_TAGGER_ENTRY
, "invalid format - expected 'tagger' line");
933 ret
= fsck_ident(&buffer
, &tag
->object
, options
);
941 static int fsck_tag(struct tag
*tag
, const char *data
,
942 unsigned long size
, struct fsck_options
*options
)
944 struct object
*tagged
= tag
->tagged
;
947 return report(options
, &tag
->object
, FSCK_MSG_BAD_TAG_OBJECT
, "could not load tagged object");
949 return fsck_tag_buffer(tag
, data
, size
, options
);
953 * Like builtin/submodule--helper.c's starts_with_dot_slash, but without
954 * relying on the platform-dependent is_dir_sep helper.
956 * This is for use in checking whether a submodule URL is interpreted as
957 * relative to the current directory on any platform, since \ is a
958 * directory separator on Windows but not on other platforms.
960 static int starts_with_dot_slash(const char *str
)
962 return str
[0] == '.' && (str
[1] == '/' || str
[1] == '\\');
966 * Like starts_with_dot_slash, this is a variant of submodule--helper's
967 * helper of the same name with the twist that it accepts backslash as a
968 * directory separator even on non-Windows platforms.
970 static int starts_with_dot_dot_slash(const char *str
)
972 return str
[0] == '.' && starts_with_dot_slash(str
+ 1);
975 static int submodule_url_is_relative(const char *url
)
977 return starts_with_dot_slash(url
) || starts_with_dot_dot_slash(url
);
981 * Count directory components that a relative submodule URL should chop
982 * from the remote_url it is to be resolved against.
984 * In other words, this counts "../" components at the start of a
987 * Returns the number of directory components to chop and writes a
988 * pointer to the next character of url after all leading "./" and
989 * "../" components to out.
991 static int count_leading_dotdots(const char *url
, const char **out
)
995 if (starts_with_dot_dot_slash(url
)) {
997 url
+= strlen("../");
1000 if (starts_with_dot_slash(url
)) {
1001 url
+= strlen("./");
1009 * Check whether a transport is implemented by git-remote-curl.
1011 * If it is, returns 1 and writes the URL that would be passed to
1012 * git-remote-curl to the "out" parameter.
1014 * Otherwise, returns 0 and leaves "out" untouched.
1017 * http::https://example.com/repo.git -> 1, https://example.com/repo.git
1018 * https://example.com/repo.git -> 1, https://example.com/repo.git
1019 * git://example.com/repo.git -> 0
1021 * This is for use in checking for previously exploitable bugs that
1022 * required a submodule URL to be passed to git-remote-curl.
1024 static int url_to_curl_url(const char *url
, const char **out
)
1027 * We don't need to check for case-aliases, "http.exe", and so
1028 * on because in the default configuration, is_transport_allowed
1029 * prevents URLs with those schemes from being cloned
1032 if (skip_prefix(url
, "http::", out
) ||
1033 skip_prefix(url
, "https::", out
) ||
1034 skip_prefix(url
, "ftp::", out
) ||
1035 skip_prefix(url
, "ftps::", out
))
1037 if (starts_with(url
, "http://") ||
1038 starts_with(url
, "https://") ||
1039 starts_with(url
, "ftp://") ||
1040 starts_with(url
, "ftps://")) {
1047 static int check_submodule_url(const char *url
)
1049 const char *curl_url
;
1051 if (looks_like_command_line_option(url
))
1054 if (submodule_url_is_relative(url
)) {
1060 * This could be appended to an http URL and url-decoded;
1061 * check for malicious characters.
1063 decoded
= url_decode(url
);
1064 has_nl
= !!strchr(decoded
, '\n');
1071 * URLs which escape their root via "../" can overwrite
1072 * the host field and previous components, resolving to
1073 * URLs like https::example.com/submodule.git and
1074 * https:///example.com/submodule.git that were
1075 * susceptible to CVE-2020-11008.
1077 if (count_leading_dotdots(url
, &next
) > 0 &&
1078 (*next
== ':' || *next
== '/'))
1082 else if (url_to_curl_url(url
, &curl_url
)) {
1083 struct credential c
= CREDENTIAL_INIT
;
1085 if (credential_from_url_gently(&c
, curl_url
, 1) ||
1088 credential_clear(&c
);
1095 struct fsck_gitmodules_data
{
1097 struct fsck_options
*options
;
1101 static int fsck_gitmodules_fn(const char *var
, const char *value
, void *vdata
)
1103 struct fsck_gitmodules_data
*data
= vdata
;
1104 const char *subsection
, *key
;
1108 if (parse_config_key(var
, "submodule", &subsection
, &subsection_len
, &key
) < 0 ||
1112 name
= xmemdupz(subsection
, subsection_len
);
1113 if (check_submodule_name(name
) < 0)
1114 data
->ret
|= report(data
->options
, data
->obj
,
1115 FSCK_MSG_GITMODULES_NAME
,
1116 "disallowed submodule name: %s",
1118 if (!strcmp(key
, "url") && value
&&
1119 check_submodule_url(value
) < 0)
1120 data
->ret
|= report(data
->options
, data
->obj
,
1121 FSCK_MSG_GITMODULES_URL
,
1122 "disallowed submodule url: %s",
1124 if (!strcmp(key
, "path") && value
&&
1125 looks_like_command_line_option(value
))
1126 data
->ret
|= report(data
->options
, data
->obj
,
1127 FSCK_MSG_GITMODULES_PATH
,
1128 "disallowed submodule path: %s",
1130 if (!strcmp(key
, "update") && value
&&
1131 parse_submodule_update_type(value
) == SM_UPDATE_COMMAND
)
1132 data
->ret
|= report(data
->options
, data
->obj
,
1133 FSCK_MSG_GITMODULES_UPDATE
,
1134 "disallowed submodule update setting: %s",
1141 static int fsck_blob(struct blob
*blob
, const char *buf
,
1142 unsigned long size
, struct fsck_options
*options
)
1144 struct fsck_gitmodules_data data
;
1145 struct config_options config_opts
= { 0 };
1147 if (!oidset_contains(&gitmodules_found
, &blob
->object
.oid
))
1149 oidset_insert(&gitmodules_done
, &blob
->object
.oid
);
1151 if (object_on_skiplist(options
, &blob
->object
))
1156 * A missing buffer here is a sign that the caller found the
1157 * blob too gigantic to load into memory. Let's just consider
1160 return report(options
, &blob
->object
,
1161 FSCK_MSG_GITMODULES_LARGE
,
1162 ".gitmodules too large to parse");
1165 data
.obj
= &blob
->object
;
1166 data
.options
= options
;
1168 config_opts
.error_action
= CONFIG_ERROR_SILENT
;
1169 if (git_config_from_mem(fsck_gitmodules_fn
, CONFIG_ORIGIN_BLOB
,
1170 ".gitmodules", buf
, size
, &data
, &config_opts
))
1171 data
.ret
|= report(options
, &blob
->object
,
1172 FSCK_MSG_GITMODULES_PARSE
,
1173 "could not parse gitmodules blob");
1178 int fsck_object(struct object
*obj
, void *data
, unsigned long size
,
1179 struct fsck_options
*options
)
1182 return report(options
, obj
, FSCK_MSG_BAD_OBJECT_SHA1
, "no valid object to fsck");
1184 if (obj
->type
== OBJ_BLOB
)
1185 return fsck_blob((struct blob
*)obj
, data
, size
, options
);
1186 if (obj
->type
== OBJ_TREE
)
1187 return fsck_tree((struct tree
*) obj
, options
);
1188 if (obj
->type
== OBJ_COMMIT
)
1189 return fsck_commit((struct commit
*) obj
, (const char *) data
,
1191 if (obj
->type
== OBJ_TAG
)
1192 return fsck_tag((struct tag
*) obj
, (const char *) data
,
1195 return report(options
, obj
, FSCK_MSG_UNKNOWN_TYPE
, "unknown type '%d' (internal fsck error)",
1199 int fsck_error_function(struct fsck_options
*o
,
1200 struct object
*obj
, int msg_type
, const char *message
)
1202 if (msg_type
== FSCK_WARN
) {
1203 warning("object %s: %s", describe_object(o
, obj
), message
);
1206 error("object %s: %s", describe_object(o
, obj
), message
);
1210 int fsck_finish(struct fsck_options
*options
)
1213 struct oidset_iter iter
;
1214 const struct object_id
*oid
;
1216 oidset_iter_init(&gitmodules_found
, &iter
);
1217 while ((oid
= oidset_iter_next(&iter
))) {
1219 enum object_type type
;
1223 if (oidset_contains(&gitmodules_done
, oid
))
1226 blob
= lookup_blob(the_repository
, oid
);
1228 struct object
*obj
= lookup_unknown_object(oid
);
1229 ret
|= report(options
, obj
,
1230 FSCK_MSG_GITMODULES_BLOB
,
1231 "non-blob found at .gitmodules");
1235 buf
= read_object_file(oid
, &type
, &size
);
1237 if (is_promisor_object(&blob
->object
.oid
))
1239 ret
|= report(options
, &blob
->object
,
1240 FSCK_MSG_GITMODULES_MISSING
,
1241 "unable to read .gitmodules blob");
1245 if (type
== OBJ_BLOB
)
1246 ret
|= fsck_blob(blob
, buf
, size
, options
);
1248 ret
|= report(options
, &blob
->object
,
1249 FSCK_MSG_GITMODULES_BLOB
,
1250 "non-blob found at .gitmodules");
1255 oidset_clear(&gitmodules_found
);
1256 oidset_clear(&gitmodules_done
);