Skip to content

Commit

Permalink
fast-import: disallow "." and ".." path components
Browse files Browse the repository at this point in the history
If a user specified e.g.
   M 100644 :1 ../some-file
then fast-import previously would happily create a git history where
there is a tree in the top-level directory named "..", and with a file
inside that directory named "some-file".  The top-level ".." directory
causes problems.  While git checkout will die with errors and fsck will
report hasDotdot problems, the user is going to have problems trying to
remove the problematic file.  Simply avoid creating this bad history in
the first place.

Signed-off-by: Elijah Newren <[email protected]>
  • Loading branch information
newren committed Nov 25, 2024
1 parent 04eaff6 commit 447b679
Show file tree
Hide file tree
Showing 2 changed files with 22 additions and 0 deletions.
2 changes: 2 additions & 0 deletions builtin/fast-import.c
Original file line number Diff line number Diff line change
Expand Up @@ -1466,6 +1466,8 @@ static int tree_content_set(
root->tree = t = grow_tree_content(t, t->entry_count);
e = new_tree_entry();
e->name = to_atom(p, n);
if (is_dot_or_dotdot(e->name->str_dat))
die("path %s contains invalid component", p);
e->versions[0].mode = 0;
oidclr(&e->versions[0].oid, the_repository->hash_algo);
t->entries[t->entry_count++] = e;
Expand Down
20 changes: 20 additions & 0 deletions t/t9300-fast-import.sh
Original file line number Diff line number Diff line change
Expand Up @@ -522,6 +522,26 @@ test_expect_success 'B: fail on invalid committer (5)' '
test_must_fail git fast-import <input
'

test_expect_success 'B: fail on invalid file path' '
cat >input <<-INPUT_END &&
blob
mark :1
data <<EOF
File contents
EOF
commit refs/heads/badpath
committer Name <email> $GIT_COMMITTER_DATE
data <<COMMIT
Commit Message
COMMIT
M 100644 :1 ../invalid-path
INPUT_END
test_when_finished "git update-ref -d refs/heads/badpath" &&
test_must_fail git fast-import <input
'

###
### series C
###
Expand Down

0 comments on commit 447b679

Please sign in to comment.