debian/patches/0007-fast-import-disallow-feature-import-marks-by-default.diff

   1 From 0f2f6c8e785da26652690cd79827742871950d14 Mon Sep 17 00:00:00 2001
   2 From: Jeff King <peff@peff.net>
   3 Date: Thu, 29 Aug 2019 15:08:42 -0400
   4 Subject: fast-import: disallow "feature import-marks" by default
   5
   6 As with export-marks in the previous commit, import-marks can access the
   7 filesystem. This is significantly less dangerous than export-marks
   8 because it only involves reading from arbitrary paths, rather than
   9 writing them. However, it could still be surprising and have security
  10 implications (e.g., exfiltrating data from a service that accepts
  11 fast-import streams).
  12
  13 Let's lump it (and its "if-exists" counterpart) in with export-marks,
  14 and enable the in-stream version only if --allow-unsafe-features is set.
  15
  16 Signed-off-by: Jeff King <peff@peff.net>
  17 (cherry picked from commit a52ed76142f6e8d993bb4c50938a408966eb2b7c)
  18 Signed-off-by: Jonathan Nieder <jrnieder@gmail.com>
  19 ---
  20  Documentation/git-fast-import.txt |  3 ++-
  21  fast-import.c                     |  2 ++
  22  t/t9300-fast-import.sh            | 22 +++++++++++++++++-----
  23  3 files changed, 21 insertions(+), 6 deletions(-)
  24
  25 diff --git a/Documentation/git-fast-import.txt b/Documentation/git-fast-import.txt
  26 index a94b576d64..7889f95940 100644
  27 --- a/Documentation/git-fast-import.txt
  28 +++ b/Documentation/git-fast-import.txt
  29 @@ -58,7 +58,8 @@ OPTIONS
  30         allowing fast-import to access the filesystem outside of the
  31         repository). These options are disabled by default, but can be
  32         allowed by providing this option on the command line.  This
  33 -       currently impacts only the `feature export-marks` command.
  34 +       currently impacts only the `export-marks`, `import-marks`, and
  35 +       `import-marks-if-exists` feature commands.
  36  +
  37         Only enable this option if you trust the program generating the
  38         fast-import stream! This option is enabled automatically for
  39 diff --git a/fast-import.c b/fast-import.c
  40 index 1f4e4a0438..b8b65a801c 100644
  41 --- a/fast-import.c
  42 +++ b/fast-import.c
  43 @@ -3262,8 +3262,10 @@ static int parse_one_feature(const char *feature, int from_stream)
  44         if (skip_prefix(feature, "date-format=", &arg)) {
  45                 option_date_format(arg);
  46         } else if (skip_prefix(feature, "import-marks=", &arg)) {
  47 +               check_unsafe_feature("import-marks", from_stream);
  48                 option_import_marks(arg, from_stream, 0);
  49         } else if (skip_prefix(feature, "import-marks-if-exists=", &arg)) {
  50 +               check_unsafe_feature("import-marks-if-exists", from_stream);
  51                 option_import_marks(arg, from_stream, 1);
  52         } else if (skip_prefix(feature, "export-marks=", &arg)) {
  53                 check_unsafe_feature(feature, from_stream);
  54 diff --git a/t/t9300-fast-import.sh b/t/t9300-fast-import.sh
  55 index b65555750f..17bb6dccbd 100755
  56 --- a/t/t9300-fast-import.sh
  57 +++ b/t/t9300-fast-import.sh
  58 @@ -2143,6 +2143,14 @@ test_expect_success 'R: abort on receiving feature after data command' '
  59         test_must_fail git fast-import <input
  60  '
  61
  62 +test_expect_success 'R: import-marks features forbidden by default' '
  63 +       >git.marks &&
  64 +       echo "feature import-marks=git.marks" >input &&
  65 +       test_must_fail git fast-import <input &&
  66 +       echo "feature import-marks-if-exists=git.marks" >input &&
  67 +       test_must_fail git fast-import <input
  68 +'
  69 +
  70  test_expect_success 'R: only one import-marks feature allowed per stream' '
  71         >git.marks &&
  72         >git2.marks &&
  73 @@ -2151,7 +2159,7 @@ test_expect_success 'R: only one import-marks feature allowed per stream' '
  74         feature import-marks=git2.marks
  75         EOF
  76
  77 -       test_must_fail git fast-import <input
  78 +       test_must_fail git fast-import --allow-unsafe-features <input
  79  '
  80
  81  test_expect_success 'R: export-marks feature forbidden by default' '
  82 @@ -2246,7 +2254,8 @@ test_expect_success 'R: --import-marks-if-exists' '
  83  test_expect_success 'R: feature import-marks-if-exists' '
  84         rm -f io.marks &&
  85
  86 -       git fast-import --export-marks=io.marks <<-\EOF &&
  87 +       git fast-import --export-marks=io.marks \
  88 +                       --allow-unsafe-features <<-\EOF &&
  89         feature import-marks-if-exists=not_io.marks
  90         EOF
  91         test_must_be_empty io.marks &&
  92 @@ -2257,7 +2266,8 @@ test_expect_success 'R: feature import-marks-if-exists' '
  93         echo ":1 $blob" >expect &&
  94         echo ":2 $blob" >>expect &&
  95
  96 -       git fast-import --export-marks=io.marks <<-\EOF &&
  97 +       git fast-import --export-marks=io.marks \
  98 +                       --allow-unsafe-features <<-\EOF &&
  99         feature import-marks-if-exists=io.marks
 100         blob
 101         mark :2
 102 @@ -2270,7 +2280,8 @@ test_expect_success 'R: feature import-marks-if-exists' '
 103         echo ":3 $blob" >>expect &&
 104
 105         git fast-import --import-marks=io.marks \
 106 -                       --export-marks=io.marks <<-\EOF &&
 107 +                       --export-marks=io.marks \
 108 +                       --allow-unsafe-features <<-\EOF &&
 109         feature import-marks-if-exists=not_io.marks
 110         blob
 111         mark :3
 112 @@ -2281,7 +2292,8 @@ test_expect_success 'R: feature import-marks-if-exists' '
 113         test_cmp expect io.marks &&
 114
 115         git fast-import --import-marks-if-exists=not_io.marks \
 116 -                       --export-marks=io.marks <<-\EOF &&
 117 +                       --export-marks=io.marks \
 118 +                       --allow-unsafe-features <<-\EOF &&
 119         feature import-marks-if-exists=io.marks
 120         EOF
 121         test_must_be_empty io.marks
 122 --
 123 2.24.0.393.g34dc348eaf
 124