2 #include "object-store.h"
3 #include "repository.h"
17 #include "submodule-config.h"
19 #include "credential.h"
22 static struct oidset gitmodules_found
= OIDSET_INIT
;
23 static struct oidset gitmodules_done
= OIDSET_INIT
;
28 #define FOREACH_MSG_ID(FUNC) \
30 FUNC(NUL_IN_HEADER, FATAL) \
31 FUNC(UNTERMINATED_HEADER, FATAL) \
33 FUNC(BAD_DATE, ERROR) \
34 FUNC(BAD_DATE_OVERFLOW, ERROR) \
35 FUNC(BAD_EMAIL, ERROR) \
36 FUNC(BAD_NAME, ERROR) \
37 FUNC(BAD_OBJECT_SHA1, ERROR) \
38 FUNC(BAD_PARENT_SHA1, ERROR) \
39 FUNC(BAD_TAG_OBJECT, ERROR) \
40 FUNC(BAD_TIMEZONE, ERROR) \
41 FUNC(BAD_TREE, ERROR) \
42 FUNC(BAD_TREE_SHA1, ERROR) \
43 FUNC(BAD_TYPE, ERROR) \
44 FUNC(DUPLICATE_ENTRIES, ERROR) \
45 FUNC(MISSING_AUTHOR, ERROR) \
46 FUNC(MISSING_COMMITTER, ERROR) \
47 FUNC(MISSING_EMAIL, ERROR) \
48 FUNC(MISSING_NAME_BEFORE_EMAIL, ERROR) \
49 FUNC(MISSING_OBJECT, ERROR) \
50 FUNC(MISSING_SPACE_BEFORE_DATE, ERROR) \
51 FUNC(MISSING_SPACE_BEFORE_EMAIL, ERROR) \
52 FUNC(MISSING_TAG, ERROR) \
53 FUNC(MISSING_TAG_ENTRY, ERROR) \
54 FUNC(MISSING_TREE, ERROR) \
55 FUNC(MISSING_TREE_OBJECT, ERROR) \
56 FUNC(MISSING_TYPE, ERROR) \
57 FUNC(MISSING_TYPE_ENTRY, ERROR) \
58 FUNC(MULTIPLE_AUTHORS, ERROR) \
59 FUNC(TREE_NOT_SORTED, ERROR) \
60 FUNC(UNKNOWN_TYPE, ERROR) \
61 FUNC(ZERO_PADDED_DATE, ERROR) \
62 FUNC(GITMODULES_MISSING, ERROR) \
63 FUNC(GITMODULES_BLOB, ERROR) \
64 FUNC(GITMODULES_LARGE, ERROR) \
65 FUNC(GITMODULES_NAME, ERROR) \
66 FUNC(GITMODULES_SYMLINK, ERROR) \
67 FUNC(GITMODULES_URL, ERROR) \
68 FUNC(GITMODULES_PATH, ERROR) \
69 FUNC(GITMODULES_UPDATE, ERROR) \
71 FUNC(BAD_FILEMODE, WARN) \
72 FUNC(EMPTY_NAME, WARN) \
73 FUNC(FULL_PATHNAME, WARN) \
75 FUNC(HAS_DOTDOT, WARN) \
76 FUNC(HAS_DOTGIT, WARN) \
77 FUNC(NULL_SHA1, WARN) \
78 FUNC(ZERO_PADDED_FILEMODE, WARN) \
79 FUNC(NUL_IN_COMMIT, WARN) \
80 /* infos (reported as warnings, but ignored by default) */ \
81 FUNC(GITMODULES_PARSE, INFO) \
82 FUNC(BAD_TAG_NAME, INFO) \
83 FUNC(MISSING_TAGGER_ENTRY, INFO) \
84 /* ignored (elevated when requested) */ \
85 FUNC(EXTRA_HEADER_ENTRY, IGNORE)
87 #define MSG_ID(id, msg_type) FSCK_MSG_##id,
89 FOREACH_MSG_ID(MSG_ID
)
95 #define MSG_ID(id, msg_type) { STR(id), NULL, NULL, FSCK_##msg_type },
97 const char *id_string
;
98 const char *downcased
;
99 const char *camelcased
;
101 } msg_id_info
[FSCK_MSG_MAX
+ 1] = {
102 FOREACH_MSG_ID(MSG_ID
)
103 { NULL
, NULL
, NULL
, -1 }
107 static void prepare_msg_ids(void)
111 if (msg_id_info
[0].downcased
)
114 /* convert id_string to lower case, without underscores. */
115 for (i
= 0; i
< FSCK_MSG_MAX
; i
++) {
116 const char *p
= msg_id_info
[i
].id_string
;
118 char *q
= xmalloc(len
);
120 msg_id_info
[i
].downcased
= q
;
125 *(q
)++ = tolower(*(p
)++);
128 p
= msg_id_info
[i
].id_string
;
130 msg_id_info
[i
].camelcased
= q
;
137 *q
++ = tolower(*p
++);
144 static int parse_msg_id(const char *text
)
150 for (i
= 0; i
< FSCK_MSG_MAX
; i
++)
151 if (!strcmp(text
, msg_id_info
[i
].downcased
))
157 void list_config_fsck_msg_ids(struct string_list
*list
, const char *prefix
)
163 for (i
= 0; i
< FSCK_MSG_MAX
; i
++)
164 list_config_item(list
, prefix
, msg_id_info
[i
].camelcased
);
167 static int fsck_msg_type(enum fsck_msg_id msg_id
,
168 struct fsck_options
*options
)
172 assert(msg_id
>= 0 && msg_id
< FSCK_MSG_MAX
);
174 if (options
->msg_type
)
175 msg_type
= options
->msg_type
[msg_id
];
177 msg_type
= msg_id_info
[msg_id
].msg_type
;
178 if (options
->strict
&& msg_type
== FSCK_WARN
)
179 msg_type
= FSCK_ERROR
;
185 static int parse_msg_type(const char *str
)
187 if (!strcmp(str
, "error"))
189 else if (!strcmp(str
, "warn"))
191 else if (!strcmp(str
, "ignore"))
194 die("Unknown fsck message type: '%s'", str
);
197 int is_valid_msg_type(const char *msg_id
, const char *msg_type
)
199 if (parse_msg_id(msg_id
) < 0)
201 parse_msg_type(msg_type
);
205 void fsck_set_msg_type(struct fsck_options
*options
,
206 const char *msg_id
, const char *msg_type
)
208 int id
= parse_msg_id(msg_id
), type
;
211 die("Unhandled message id: %s", msg_id
);
212 type
= parse_msg_type(msg_type
);
214 if (type
!= FSCK_ERROR
&& msg_id_info
[id
].msg_type
== FSCK_FATAL
)
215 die("Cannot demote %s to %s", msg_id
, msg_type
);
217 if (!options
->msg_type
) {
220 ALLOC_ARRAY(msg_type
, FSCK_MSG_MAX
);
221 for (i
= 0; i
< FSCK_MSG_MAX
; i
++)
222 msg_type
[i
] = fsck_msg_type(i
, options
);
223 options
->msg_type
= msg_type
;
226 options
->msg_type
[id
] = type
;
229 void fsck_set_msg_types(struct fsck_options
*options
, const char *values
)
231 char *buf
= xstrdup(values
), *to_free
= buf
;
235 int len
= strcspn(buf
, " ,|"), equal
;
245 equal
< len
&& buf
[equal
] != '=' && buf
[equal
] != ':';
247 buf
[equal
] = tolower(buf
[equal
]);
250 if (!strcmp(buf
, "skiplist")) {
252 die("skiplist requires a path");
253 oidset_parse_file(&options
->skiplist
, buf
+ equal
+ 1);
259 die("Missing '=': '%s'", buf
);
261 fsck_set_msg_type(options
, buf
, buf
+ equal
+ 1);
267 static void append_msg_id(struct strbuf
*sb
, const char *msg_id
)
270 char c
= *(msg_id
)++;
275 strbuf_addch(sb
, tolower(c
));
278 strbuf_addch(sb
, *(msg_id
)++);
282 strbuf_addstr(sb
, ": ");
285 static int object_on_skiplist(struct fsck_options
*opts
,
286 const struct object_id
*oid
)
288 return opts
&& oid
&& oidset_contains(&opts
->skiplist
, oid
);
291 __attribute__((format (printf
, 5, 6)))
292 static int report(struct fsck_options
*options
,
293 const struct object_id
*oid
, enum object_type object_type
,
294 enum fsck_msg_id id
, const char *fmt
, ...)
297 struct strbuf sb
= STRBUF_INIT
;
298 int msg_type
= fsck_msg_type(id
, options
), result
;
300 if (msg_type
== FSCK_IGNORE
)
303 if (object_on_skiplist(options
, oid
))
306 if (msg_type
== FSCK_FATAL
)
307 msg_type
= FSCK_ERROR
;
308 else if (msg_type
== FSCK_INFO
)
309 msg_type
= FSCK_WARN
;
311 append_msg_id(&sb
, msg_id_info
[id
].id_string
);
314 strbuf_vaddf(&sb
, fmt
, ap
);
315 result
= options
->error_func(options
, oid
, object_type
,
323 void fsck_enable_object_names(struct fsck_options
*options
)
325 if (!options
->object_names
)
326 options
->object_names
= kh_init_oid_map();
329 const char *fsck_get_object_name(struct fsck_options
*options
,
330 const struct object_id
*oid
)
333 if (!options
->object_names
)
335 pos
= kh_get_oid_map(options
->object_names
, *oid
);
336 if (pos
>= kh_end(options
->object_names
))
338 return kh_value(options
->object_names
, pos
);
341 void fsck_put_object_name(struct fsck_options
*options
,
342 const struct object_id
*oid
,
343 const char *fmt
, ...)
346 struct strbuf buf
= STRBUF_INIT
;
350 if (!options
->object_names
)
353 pos
= kh_put_oid_map(options
->object_names
, *oid
, &hashret
);
357 strbuf_vaddf(&buf
, fmt
, ap
);
358 kh_value(options
->object_names
, pos
) = strbuf_detach(&buf
, NULL
);
362 const char *fsck_describe_object(struct fsck_options
*options
,
363 const struct object_id
*oid
)
365 static struct strbuf bufs
[] = {
366 STRBUF_INIT
, STRBUF_INIT
, STRBUF_INIT
, STRBUF_INIT
370 const char *name
= fsck_get_object_name(options
, oid
);
373 b
= (b
+ 1) % ARRAY_SIZE(bufs
);
375 strbuf_addstr(buf
, oid_to_hex(oid
));
377 strbuf_addf(buf
, " (%s)", name
);
382 static int fsck_walk_tree(struct tree
*tree
, void *data
, struct fsck_options
*options
)
384 struct tree_desc desc
;
385 struct name_entry entry
;
389 if (parse_tree(tree
))
392 name
= fsck_get_object_name(options
, &tree
->object
.oid
);
393 if (init_tree_desc_gently(&desc
, tree
->buffer
, tree
->size
))
395 while (tree_entry_gently(&desc
, &entry
)) {
399 if (S_ISGITLINK(entry
.mode
))
402 if (S_ISDIR(entry
.mode
)) {
403 obj
= (struct object
*)lookup_tree(the_repository
, &entry
.oid
);
405 fsck_put_object_name(options
, &entry
.oid
, "%s%s/",
407 result
= options
->walk(obj
, OBJ_TREE
, data
, options
);
409 else if (S_ISREG(entry
.mode
) || S_ISLNK(entry
.mode
)) {
410 obj
= (struct object
*)lookup_blob(the_repository
, &entry
.oid
);
412 fsck_put_object_name(options
, &entry
.oid
, "%s%s",
414 result
= options
->walk(obj
, OBJ_BLOB
, data
, options
);
417 result
= error("in tree %s: entry %s has bad mode %.6o",
418 fsck_describe_object(options
, &tree
->object
.oid
),
419 entry
.path
, entry
.mode
);
429 static int fsck_walk_commit(struct commit
*commit
, void *data
, struct fsck_options
*options
)
431 int counter
= 0, generation
= 0, name_prefix_len
= 0;
432 struct commit_list
*parents
;
437 if (parse_commit(commit
))
440 name
= fsck_get_object_name(options
, &commit
->object
.oid
);
442 fsck_put_object_name(options
, get_commit_tree_oid(commit
),
445 result
= options
->walk((struct object
*)get_commit_tree(commit
),
446 OBJ_TREE
, data
, options
);
451 parents
= commit
->parents
;
452 if (name
&& parents
) {
453 int len
= strlen(name
), power
;
455 if (len
&& name
[len
- 1] == '^') {
457 name_prefix_len
= len
- 1;
459 else { /* parse ~<generation> suffix */
460 for (generation
= 0, power
= 1;
461 len
&& isdigit(name
[len
- 1]);
463 generation
+= power
* (name
[--len
] - '0');
464 if (power
> 1 && len
&& name
[len
- 1] == '~')
465 name_prefix_len
= len
- 1;
471 struct object_id
*oid
= &parents
->item
->object
.oid
;
474 fsck_put_object_name(options
, oid
, "%s^%d",
476 else if (generation
> 0)
477 fsck_put_object_name(options
, oid
, "%.*s~%d",
478 name_prefix_len
, name
,
481 fsck_put_object_name(options
, oid
, "%s^", name
);
483 result
= options
->walk((struct object
*)parents
->item
, OBJ_COMMIT
, data
, options
);
488 parents
= parents
->next
;
493 static int fsck_walk_tag(struct tag
*tag
, void *data
, struct fsck_options
*options
)
495 const char *name
= fsck_get_object_name(options
, &tag
->object
.oid
);
500 fsck_put_object_name(options
, &tag
->tagged
->oid
, "%s", name
);
501 return options
->walk(tag
->tagged
, OBJ_ANY
, data
, options
);
504 int fsck_walk(struct object
*obj
, void *data
, struct fsck_options
*options
)
509 if (obj
->type
== OBJ_NONE
)
510 parse_object(the_repository
, &obj
->oid
);
516 return fsck_walk_tree((struct tree
*)obj
, data
, options
);
518 return fsck_walk_commit((struct commit
*)obj
, data
, options
);
520 return fsck_walk_tag((struct tag
*)obj
, data
, options
);
522 error("Unknown object type for %s",
523 fsck_describe_object(options
, &obj
->oid
));
533 static void name_stack_push(struct name_stack
*stack
, const char *name
)
535 ALLOC_GROW(stack
->names
, stack
->nr
+ 1, stack
->alloc
);
536 stack
->names
[stack
->nr
++] = name
;
539 static const char *name_stack_pop(struct name_stack
*stack
)
541 return stack
->nr
? stack
->names
[--stack
->nr
] : NULL
;
544 static void name_stack_clear(struct name_stack
*stack
)
546 FREE_AND_NULL(stack
->names
);
547 stack
->nr
= stack
->alloc
= 0;
551 * The entries in a tree are ordered in the _path_ order,
552 * which means that a directory entry is ordered by adding
553 * a slash to the end of it.
555 * So a directory called "a" is ordered _after_ a file
556 * called "a.c", because "a/" sorts after "a.c".
558 #define TREE_UNORDERED (-1)
559 #define TREE_HAS_DUPS (-2)
561 static int is_less_than_slash(unsigned char c
)
563 return '\0' < c
&& c
< '/';
566 static int verify_ordered(unsigned mode1
, const char *name1
,
567 unsigned mode2
, const char *name2
,
568 struct name_stack
*candidates
)
570 int len1
= strlen(name1
);
571 int len2
= strlen(name2
);
572 int len
= len1
< len2
? len1
: len2
;
573 unsigned char c1
, c2
;
576 cmp
= memcmp(name1
, name2
, len
);
580 return TREE_UNORDERED
;
583 * Ok, the first <len> characters are the same.
584 * Now we need to order the next one, but turn
585 * a '\0' into a '/' for a directory entry.
591 * git-write-tree used to write out a nonsense tree that has
592 * entries with the same name, one blob and one tree. Make
593 * sure we do not have duplicate entries.
595 return TREE_HAS_DUPS
;
596 if (!c1
&& S_ISDIR(mode1
))
598 if (!c2
&& S_ISDIR(mode2
))
602 * There can be non-consecutive duplicates due to the implicitly
611 * Record non-directory candidates (like "foo" and "foo.bar" in
612 * the example) on a stack and check directory candidates (like
613 * foo/" and "foo.bar/") against that stack.
615 if (!c1
&& is_less_than_slash(c2
)) {
616 name_stack_push(candidates
, name1
);
617 } else if (c2
== '/' && is_less_than_slash(c1
)) {
620 const char *f_name
= name_stack_pop(candidates
);
624 if (!skip_prefix(name2
, f_name
, &p
))
627 return TREE_HAS_DUPS
;
628 if (is_less_than_slash(*p
)) {
629 name_stack_push(candidates
, f_name
);
635 return c1
< c2
? 0 : TREE_UNORDERED
;
638 static int fsck_tree(const struct object_id
*oid
,
639 const char *buffer
, unsigned long size
,
640 struct fsck_options
*options
)
643 int has_null_sha1
= 0;
644 int has_full_path
= 0;
645 int has_empty_name
= 0;
649 int has_zero_pad
= 0;
650 int has_bad_modes
= 0;
651 int has_dup_entries
= 0;
652 int not_properly_sorted
= 0;
653 struct tree_desc desc
;
656 struct name_stack df_dup_candidates
= { NULL
};
658 if (init_tree_desc_gently(&desc
, buffer
, size
)) {
659 retval
+= report(options
, oid
, OBJ_TREE
, FSCK_MSG_BAD_TREE
, "cannot be parsed as a tree");
668 const char *name
, *backslash
;
669 const struct object_id
*oid
;
671 oid
= tree_entry_extract(&desc
, &name
, &mode
);
673 has_null_sha1
|= is_null_oid(oid
);
674 has_full_path
|= !!strchr(name
, '/');
675 has_empty_name
|= !*name
;
676 has_dot
|= !strcmp(name
, ".");
677 has_dotdot
|= !strcmp(name
, "..");
678 has_dotgit
|= is_hfs_dotgit(name
) || is_ntfs_dotgit(name
);
679 has_zero_pad
|= *(char *)desc
.buffer
== '0';
681 if (is_hfs_dotgitmodules(name
) || is_ntfs_dotgitmodules(name
)) {
683 oidset_insert(&gitmodules_found
, oid
);
685 retval
+= report(options
,
687 FSCK_MSG_GITMODULES_SYMLINK
,
688 ".gitmodules is a symbolic link");
691 if ((backslash
= strchr(name
, '\\'))) {
694 has_dotgit
|= is_ntfs_dotgit(backslash
);
695 if (is_ntfs_dotgitmodules(backslash
)) {
697 oidset_insert(&gitmodules_found
, oid
);
699 retval
+= report(options
, oid
, OBJ_TREE
,
700 FSCK_MSG_GITMODULES_SYMLINK
,
701 ".gitmodules is a symbolic link");
703 backslash
= strchr(backslash
, '\\');
707 if (update_tree_entry_gently(&desc
)) {
708 retval
+= report(options
, oid
, OBJ_TREE
, FSCK_MSG_BAD_TREE
, "cannot be parsed as a tree");
723 * This is nonstandard, but we had a few of these
724 * early on when we honored the full set of mode
728 if (!options
->strict
)
736 switch (verify_ordered(o_mode
, o_name
, mode
, name
,
737 &df_dup_candidates
)) {
739 not_properly_sorted
= 1;
753 name_stack_clear(&df_dup_candidates
);
756 retval
+= report(options
, oid
, OBJ_TREE
, FSCK_MSG_NULL_SHA1
, "contains entries pointing to null sha1");
758 retval
+= report(options
, oid
, OBJ_TREE
, FSCK_MSG_FULL_PATHNAME
, "contains full pathnames");
760 retval
+= report(options
, oid
, OBJ_TREE
, FSCK_MSG_EMPTY_NAME
, "contains empty pathname");
762 retval
+= report(options
, oid
, OBJ_TREE
, FSCK_MSG_HAS_DOT
, "contains '.'");
764 retval
+= report(options
, oid
, OBJ_TREE
, FSCK_MSG_HAS_DOTDOT
, "contains '..'");
766 retval
+= report(options
, oid
, OBJ_TREE
, FSCK_MSG_HAS_DOTGIT
, "contains '.git'");
768 retval
+= report(options
, oid
, OBJ_TREE
, FSCK_MSG_ZERO_PADDED_FILEMODE
, "contains zero-padded file modes");
770 retval
+= report(options
, oid
, OBJ_TREE
, FSCK_MSG_BAD_FILEMODE
, "contains bad file modes");
772 retval
+= report(options
, oid
, OBJ_TREE
, FSCK_MSG_DUPLICATE_ENTRIES
, "contains duplicate file entries");
773 if (not_properly_sorted
)
774 retval
+= report(options
, oid
, OBJ_TREE
, FSCK_MSG_TREE_NOT_SORTED
, "not properly sorted");
778 static int verify_headers(const void *data
, unsigned long size
,
779 const struct object_id
*oid
, enum object_type type
,
780 struct fsck_options
*options
)
782 const char *buffer
= (const char *)data
;
785 for (i
= 0; i
< size
; i
++) {
788 return report(options
, oid
, type
,
789 FSCK_MSG_NUL_IN_HEADER
,
790 "unterminated header: NUL at offset %ld", i
);
792 if (i
+ 1 < size
&& buffer
[i
+ 1] == '\n')
798 * We did not find double-LF that separates the header
799 * and the body. Not having a body is not a crime but
800 * we do want to see the terminating LF for the last header
803 if (size
&& buffer
[size
- 1] == '\n')
806 return report(options
, oid
, type
,
807 FSCK_MSG_UNTERMINATED_HEADER
, "unterminated header");
810 static int fsck_ident(const char **ident
,
811 const struct object_id
*oid
, enum object_type type
,
812 struct fsck_options
*options
)
814 const char *p
= *ident
;
817 *ident
= strchrnul(*ident
, '\n');
822 return report(options
, oid
, type
, FSCK_MSG_MISSING_NAME_BEFORE_EMAIL
, "invalid author/committer line - missing space before email");
823 p
+= strcspn(p
, "<>\n");
825 return report(options
, oid
, type
, FSCK_MSG_BAD_NAME
, "invalid author/committer line - bad name");
827 return report(options
, oid
, type
, FSCK_MSG_MISSING_EMAIL
, "invalid author/committer line - missing email");
829 return report(options
, oid
, type
, FSCK_MSG_MISSING_SPACE_BEFORE_EMAIL
, "invalid author/committer line - missing space before email");
831 p
+= strcspn(p
, "<>\n");
833 return report(options
, oid
, type
, FSCK_MSG_BAD_EMAIL
, "invalid author/committer line - bad email");
836 return report(options
, oid
, type
, FSCK_MSG_MISSING_SPACE_BEFORE_DATE
, "invalid author/committer line - missing space before date");
838 if (*p
== '0' && p
[1] != ' ')
839 return report(options
, oid
, type
, FSCK_MSG_ZERO_PADDED_DATE
, "invalid author/committer line - zero-padded date");
840 if (date_overflows(parse_timestamp(p
, &end
, 10)))
841 return report(options
, oid
, type
, FSCK_MSG_BAD_DATE_OVERFLOW
, "invalid author/committer line - date causes integer overflow");
842 if ((end
== p
|| *end
!= ' '))
843 return report(options
, oid
, type
, FSCK_MSG_BAD_DATE
, "invalid author/committer line - bad date");
845 if ((*p
!= '+' && *p
!= '-') ||
851 return report(options
, oid
, type
, FSCK_MSG_BAD_TIMEZONE
, "invalid author/committer line - bad time zone");
856 static int fsck_commit(const struct object_id
*oid
,
857 const char *buffer
, unsigned long size
,
858 struct fsck_options
*options
)
860 struct object_id tree_oid
, parent_oid
;
861 unsigned author_count
;
863 const char *buffer_begin
= buffer
;
866 if (verify_headers(buffer
, size
, oid
, OBJ_COMMIT
, options
))
869 if (!skip_prefix(buffer
, "tree ", &buffer
))
870 return report(options
, oid
, OBJ_COMMIT
, FSCK_MSG_MISSING_TREE
, "invalid format - expected 'tree' line");
871 if (parse_oid_hex(buffer
, &tree_oid
, &p
) || *p
!= '\n') {
872 err
= report(options
, oid
, OBJ_COMMIT
, FSCK_MSG_BAD_TREE_SHA1
, "invalid 'tree' line format - bad sha1");
877 while (skip_prefix(buffer
, "parent ", &buffer
)) {
878 if (parse_oid_hex(buffer
, &parent_oid
, &p
) || *p
!= '\n') {
879 err
= report(options
, oid
, OBJ_COMMIT
, FSCK_MSG_BAD_PARENT_SHA1
, "invalid 'parent' line format - bad sha1");
886 while (skip_prefix(buffer
, "author ", &buffer
)) {
888 err
= fsck_ident(&buffer
, oid
, OBJ_COMMIT
, options
);
892 if (author_count
< 1)
893 err
= report(options
, oid
, OBJ_COMMIT
, FSCK_MSG_MISSING_AUTHOR
, "invalid format - expected 'author' line");
894 else if (author_count
> 1)
895 err
= report(options
, oid
, OBJ_COMMIT
, FSCK_MSG_MULTIPLE_AUTHORS
, "invalid format - multiple 'author' lines");
898 if (!skip_prefix(buffer
, "committer ", &buffer
))
899 return report(options
, oid
, OBJ_COMMIT
, FSCK_MSG_MISSING_COMMITTER
, "invalid format - expected 'committer' line");
900 err
= fsck_ident(&buffer
, oid
, OBJ_COMMIT
, options
);
903 if (memchr(buffer_begin
, '\0', size
)) {
904 err
= report(options
, oid
, OBJ_COMMIT
, FSCK_MSG_NUL_IN_COMMIT
,
905 "NUL byte in the commit object body");
912 static int fsck_tag(const struct object_id
*oid
, const char *buffer
,
913 unsigned long size
, struct fsck_options
*options
)
915 struct object_id tagged_oid
;
917 return fsck_tag_standalone(oid
, buffer
, size
, options
, &tagged_oid
,
921 int fsck_tag_standalone(const struct object_id
*oid
, const char *buffer
,
922 unsigned long size
, struct fsck_options
*options
,
923 struct object_id
*tagged_oid
,
928 struct strbuf sb
= STRBUF_INIT
;
931 ret
= verify_headers(buffer
, size
, oid
, OBJ_TAG
, options
);
935 if (!skip_prefix(buffer
, "object ", &buffer
)) {
936 ret
= report(options
, oid
, OBJ_TAG
, FSCK_MSG_MISSING_OBJECT
, "invalid format - expected 'object' line");
939 if (parse_oid_hex(buffer
, tagged_oid
, &p
) || *p
!= '\n') {
940 ret
= report(options
, oid
, OBJ_TAG
, FSCK_MSG_BAD_OBJECT_SHA1
, "invalid 'object' line format - bad sha1");
946 if (!skip_prefix(buffer
, "type ", &buffer
)) {
947 ret
= report(options
, oid
, OBJ_TAG
, FSCK_MSG_MISSING_TYPE_ENTRY
, "invalid format - expected 'type' line");
950 eol
= strchr(buffer
, '\n');
952 ret
= report(options
, oid
, OBJ_TAG
, FSCK_MSG_MISSING_TYPE
, "invalid format - unexpected end after 'type' line");
955 *tagged_type
= type_from_string_gently(buffer
, eol
- buffer
, 1);
956 if (*tagged_type
< 0)
957 ret
= report(options
, oid
, OBJ_TAG
, FSCK_MSG_BAD_TYPE
, "invalid 'type' value");
962 if (!skip_prefix(buffer
, "tag ", &buffer
)) {
963 ret
= report(options
, oid
, OBJ_TAG
, FSCK_MSG_MISSING_TAG_ENTRY
, "invalid format - expected 'tag' line");
966 eol
= strchr(buffer
, '\n');
968 ret
= report(options
, oid
, OBJ_TAG
, FSCK_MSG_MISSING_TAG
, "invalid format - unexpected end after 'type' line");
971 strbuf_addf(&sb
, "refs/tags/%.*s", (int)(eol
- buffer
), buffer
);
972 if (check_refname_format(sb
.buf
, 0)) {
973 ret
= report(options
, oid
, OBJ_TAG
,
974 FSCK_MSG_BAD_TAG_NAME
,
975 "invalid 'tag' name: %.*s",
976 (int)(eol
- buffer
), buffer
);
982 if (!skip_prefix(buffer
, "tagger ", &buffer
)) {
983 /* early tags do not contain 'tagger' lines; warn only */
984 ret
= report(options
, oid
, OBJ_TAG
, FSCK_MSG_MISSING_TAGGER_ENTRY
, "invalid format - expected 'tagger' line");
989 ret
= fsck_ident(&buffer
, oid
, OBJ_TAG
, options
);
993 if (!starts_with(buffer
, "\n")) {
995 * The verify_headers() check will allow
996 * e.g. "[...]tagger <tagger>\nsome
997 * garbage\n\nmessage" to pass, thinking "some
998 * garbage" could be a custom header. E.g. "mktag"
999 * doesn't want any unknown headers.
1001 ret
= report(options
, oid
, OBJ_TAG
, FSCK_MSG_EXTRA_HEADER_ENTRY
, "invalid format - extra header(s) after 'tagger'");
1007 strbuf_release(&sb
);
1012 * Like builtin/submodule--helper.c's starts_with_dot_slash, but without
1013 * relying on the platform-dependent is_dir_sep helper.
1015 * This is for use in checking whether a submodule URL is interpreted as
1016 * relative to the current directory on any platform, since \ is a
1017 * directory separator on Windows but not on other platforms.
1019 static int starts_with_dot_slash(const char *str
)
1021 return str
[0] == '.' && (str
[1] == '/' || str
[1] == '\\');
1025 * Like starts_with_dot_slash, this is a variant of submodule--helper's
1026 * helper of the same name with the twist that it accepts backslash as a
1027 * directory separator even on non-Windows platforms.
1029 static int starts_with_dot_dot_slash(const char *str
)
1031 return str
[0] == '.' && starts_with_dot_slash(str
+ 1);
1034 static int submodule_url_is_relative(const char *url
)
1036 return starts_with_dot_slash(url
) || starts_with_dot_dot_slash(url
);
1040 * Count directory components that a relative submodule URL should chop
1041 * from the remote_url it is to be resolved against.
1043 * In other words, this counts "../" components at the start of a
1046 * Returns the number of directory components to chop and writes a
1047 * pointer to the next character of url after all leading "./" and
1048 * "../" components to out.
1050 static int count_leading_dotdots(const char *url
, const char **out
)
1054 if (starts_with_dot_dot_slash(url
)) {
1056 url
+= strlen("../");
1059 if (starts_with_dot_slash(url
)) {
1060 url
+= strlen("./");
1068 * Check whether a transport is implemented by git-remote-curl.
1070 * If it is, returns 1 and writes the URL that would be passed to
1071 * git-remote-curl to the "out" parameter.
1073 * Otherwise, returns 0 and leaves "out" untouched.
1076 * http::https://example.com/repo.git -> 1, https://example.com/repo.git
1077 * https://example.com/repo.git -> 1, https://example.com/repo.git
1078 * git://example.com/repo.git -> 0
1080 * This is for use in checking for previously exploitable bugs that
1081 * required a submodule URL to be passed to git-remote-curl.
1083 static int url_to_curl_url(const char *url
, const char **out
)
1086 * We don't need to check for case-aliases, "http.exe", and so
1087 * on because in the default configuration, is_transport_allowed
1088 * prevents URLs with those schemes from being cloned
1091 if (skip_prefix(url
, "http::", out
) ||
1092 skip_prefix(url
, "https::", out
) ||
1093 skip_prefix(url
, "ftp::", out
) ||
1094 skip_prefix(url
, "ftps::", out
))
1096 if (starts_with(url
, "http://") ||
1097 starts_with(url
, "https://") ||
1098 starts_with(url
, "ftp://") ||
1099 starts_with(url
, "ftps://")) {
1106 static int check_submodule_url(const char *url
)
1108 const char *curl_url
;
1110 if (looks_like_command_line_option(url
))
1113 if (submodule_url_is_relative(url
) || starts_with(url
, "git://")) {
1119 * This could be appended to an http URL and url-decoded;
1120 * check for malicious characters.
1122 decoded
= url_decode(url
);
1123 has_nl
= !!strchr(decoded
, '\n');
1130 * URLs which escape their root via "../" can overwrite
1131 * the host field and previous components, resolving to
1132 * URLs like https::example.com/submodule.git and
1133 * https:///example.com/submodule.git that were
1134 * susceptible to CVE-2020-11008.
1136 if (count_leading_dotdots(url
, &next
) > 0 &&
1137 (*next
== ':' || *next
== '/'))
1141 else if (url_to_curl_url(url
, &curl_url
)) {
1142 struct credential c
= CREDENTIAL_INIT
;
1144 if (credential_from_url_gently(&c
, curl_url
, 1) ||
1147 credential_clear(&c
);
1154 struct fsck_gitmodules_data
{
1155 const struct object_id
*oid
;
1156 struct fsck_options
*options
;
1160 static int fsck_gitmodules_fn(const char *var
, const char *value
, void *vdata
)
1162 struct fsck_gitmodules_data
*data
= vdata
;
1163 const char *subsection
, *key
;
1164 size_t subsection_len
;
1167 if (parse_config_key(var
, "submodule", &subsection
, &subsection_len
, &key
) < 0 ||
1171 name
= xmemdupz(subsection
, subsection_len
);
1172 if (check_submodule_name(name
) < 0)
1173 data
->ret
|= report(data
->options
,
1174 data
->oid
, OBJ_BLOB
,
1175 FSCK_MSG_GITMODULES_NAME
,
1176 "disallowed submodule name: %s",
1178 if (!strcmp(key
, "url") && value
&&
1179 check_submodule_url(value
) < 0)
1180 data
->ret
|= report(data
->options
,
1181 data
->oid
, OBJ_BLOB
,
1182 FSCK_MSG_GITMODULES_URL
,
1183 "disallowed submodule url: %s",
1185 if (!strcmp(key
, "path") && value
&&
1186 looks_like_command_line_option(value
))
1187 data
->ret
|= report(data
->options
,
1188 data
->oid
, OBJ_BLOB
,
1189 FSCK_MSG_GITMODULES_PATH
,
1190 "disallowed submodule path: %s",
1192 if (!strcmp(key
, "update") && value
&&
1193 parse_submodule_update_type(value
) == SM_UPDATE_COMMAND
)
1194 data
->ret
|= report(data
->options
, data
->oid
, OBJ_BLOB
,
1195 FSCK_MSG_GITMODULES_UPDATE
,
1196 "disallowed submodule update setting: %s",
1203 static int fsck_blob(const struct object_id
*oid
, const char *buf
,
1204 unsigned long size
, struct fsck_options
*options
)
1206 struct fsck_gitmodules_data data
;
1207 struct config_options config_opts
= { 0 };
1209 if (!oidset_contains(&gitmodules_found
, oid
))
1211 oidset_insert(&gitmodules_done
, oid
);
1213 if (object_on_skiplist(options
, oid
))
1218 * A missing buffer here is a sign that the caller found the
1219 * blob too gigantic to load into memory. Let's just consider
1222 return report(options
, oid
, OBJ_BLOB
,
1223 FSCK_MSG_GITMODULES_LARGE
,
1224 ".gitmodules too large to parse");
1228 data
.options
= options
;
1230 config_opts
.error_action
= CONFIG_ERROR_SILENT
;
1231 if (git_config_from_mem(fsck_gitmodules_fn
, CONFIG_ORIGIN_BLOB
,
1232 ".gitmodules", buf
, size
, &data
, &config_opts
))
1233 data
.ret
|= report(options
, oid
, OBJ_BLOB
,
1234 FSCK_MSG_GITMODULES_PARSE
,
1235 "could not parse gitmodules blob");
1240 int fsck_object(struct object
*obj
, void *data
, unsigned long size
,
1241 struct fsck_options
*options
)
1244 return report(options
, NULL
, OBJ_NONE
, FSCK_MSG_BAD_OBJECT_SHA1
, "no valid object to fsck");
1246 if (obj
->type
== OBJ_BLOB
)
1247 return fsck_blob(&obj
->oid
, data
, size
, options
);
1248 if (obj
->type
== OBJ_TREE
)
1249 return fsck_tree(&obj
->oid
, data
, size
, options
);
1250 if (obj
->type
== OBJ_COMMIT
)
1251 return fsck_commit(&obj
->oid
, data
, size
, options
);
1252 if (obj
->type
== OBJ_TAG
)
1253 return fsck_tag(&obj
->oid
, data
, size
, options
);
1255 return report(options
, &obj
->oid
, obj
->type
,
1256 FSCK_MSG_UNKNOWN_TYPE
,
1257 "unknown type '%d' (internal fsck error)",
1261 int fsck_error_function(struct fsck_options
*o
,
1262 const struct object_id
*oid
,
1263 enum object_type object_type
,
1264 int msg_type
, const char *message
)
1266 if (msg_type
== FSCK_WARN
) {
1267 warning("object %s: %s", fsck_describe_object(o
, oid
), message
);
1270 error("object %s: %s", fsck_describe_object(o
, oid
), message
);
1274 int fsck_finish(struct fsck_options
*options
)
1277 struct oidset_iter iter
;
1278 const struct object_id
*oid
;
1280 oidset_iter_init(&gitmodules_found
, &iter
);
1281 while ((oid
= oidset_iter_next(&iter
))) {
1282 enum object_type type
;
1286 if (oidset_contains(&gitmodules_done
, oid
))
1289 buf
= read_object_file(oid
, &type
, &size
);
1291 if (is_promisor_object(oid
))
1293 ret
|= report(options
,
1295 FSCK_MSG_GITMODULES_MISSING
,
1296 "unable to read .gitmodules blob");
1300 if (type
== OBJ_BLOB
)
1301 ret
|= fsck_blob(oid
, buf
, size
, options
);
1303 ret
|= report(options
,
1305 FSCK_MSG_GITMODULES_BLOB
,
1306 "non-blob found at .gitmodules");
1311 oidset_clear(&gitmodules_found
);
1312 oidset_clear(&gitmodules_done
);
1316 int fsck_config_internal(const char *var
, const char *value
, void *cb
,
1317 struct fsck_options
*options
)
1319 if (strcmp(var
, "fsck.skiplist") == 0) {
1321 struct strbuf sb
= STRBUF_INIT
;
1323 if (git_config_pathname(&path
, var
, value
))
1325 strbuf_addf(&sb
, "skiplist=%s", path
);
1327 fsck_set_msg_types(options
, sb
.buf
);
1328 strbuf_release(&sb
);
1332 if (skip_prefix(var
, "fsck.", &var
)) {
1333 fsck_set_msg_type(options
, var
, value
);
1337 return git_default_config(var
, value
, cb
);