connect: reject paths that look like command line options

If we get a repo path like "-repo.git", we may try to invoke
"git-upload-pack -repo.git". This is going to fail, since
upload-pack will interpret it as a set of bogus options. But
let's reject this before we even run the sub-program, since
we would not want to allow any mischief with repo names that
actually are real command-line options.

You can still ask for such a path via git-daemon, but there's no
security problem there, because git-daemon enters the repo itself
and then passes "."  on the command line.

Signed-off-by: Jeff King <peff@peff.net>
Reviewed-by: Jonathan Nieder <jrnieder@gmail.com>
Signed-off-by: Junio C Hamano <gitster@pobox.com>

diff --git a/connect.c b/connect.c
index bdf2ca08acdbf6c551b782ece5ebc8c5f15b35e9..d77d39771b6c5101abe14df1e078af2a02ce8ace 100644 (file)
--- a/connect.c
+++ b/connect.c
@@ -727,6 +727,9 @@ struct child_process *git_connect(int fd[2], const char *url,
                conn = xmalloc(sizeof(*conn));
                child_process_init(conn);
 
+               if (looks_like_command_line_option(path))
+                       die("strange pathname '%s' blocked", path);
+
                strbuf_addstr(&cmd, prog);
                strbuf_addch(&cmd, ' ');
                sq_quote_buf(&cmd, path);

diff --git a/t/t5810-proto-disable-local.sh b/t/t5810-proto-disable-local.sh
index 563592d8a8a5f6fec7da160f292b2f8b8824327e..c1ef99b85c293e8a8bfc0872e3511fe8b7029213 100755 (executable)
--- a/t/t5810-proto-disable-local.sh
+++ b/t/t5810-proto-disable-local.sh
@@ -11,4 +11,27 @@ test_expect_success 'setup repository to clone' '
 test_proto "file://" file "file://$PWD"
 test_proto "path" file .
 
+test_expect_success 'setup repo with dash' '
+       git init --bare repo.git &&
+       git push repo.git HEAD &&
+       mv repo.git "$PWD/-repo.git"
+'
+
+# This will fail even without our rejection because upload-pack will
+# complain about the bogus option. So let's make sure that GIT_TRACE
+# doesn't show us even running upload-pack.
+#
+# We must also be sure to use "fetch" and not "clone" here, as the latter
+# actually canonicalizes our input into an absolute path (which is fine
+# to allow).
+test_expect_success 'repo names starting with dash are rejected' '
+       rm -f trace.out &&
+       test_must_fail env GIT_TRACE="$PWD/trace.out" git fetch -- -repo.git &&
+       ! grep upload-pack trace.out
+'
+
+test_expect_success 'full paths still work' '
+       git fetch "$PWD/-repo.git"
+'
+
 test_done

diff --git a/t/t5813-proto-disable-ssh.sh b/t/t5813-proto-disable-ssh.sh
index 0ecdceecd6cb6eda137cee1285040d4b14a2b42c..3f084ee306517b2bc991365f6f15b76627e1d125 100755 (executable)
--- a/t/t5813-proto-disable-ssh.sh
+++ b/t/t5813-proto-disable-ssh.sh
@@ -26,4 +26,18 @@ test_expect_success 'hostnames starting with dash are rejected' '
        ! grep ^ssh: stderr
 '
 
+test_expect_success 'setup repo with dash' '
+       git init --bare remote/-repo.git &&
+       git push remote/-repo.git HEAD
+'
+
+test_expect_success 'repo names starting with dash are rejected' '
+       test_must_fail git clone remote:-repo.git dash-path 2>stderr &&
+       ! grep ^ssh: stderr
+'
+
+test_expect_success 'full paths still work' '
+       git clone "remote:$PWD/remote/-repo.git" dash-path
+'
+
 test_done