mirrors/git
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Allow cloning from repositories owned by another user

Browse Source 
Historically, Git has allowed users to clone from an untrusted
repository, and we have documented that this is safe to do so:

    `upload-pack` tries to avoid any dangerous configuration options or
    hooks from the repository it's serving, making it safe to clone an
    untrusted directory and run commands on the resulting clone.

However, this was broken by f4aa8c8bb1 ("fetch/clone: detect dubious
ownership of local repositories", 2024-04-10) in an attempt to make
things more secure.  That change resulted in a variety of problems when
cloning locally and over SSH, but it did not change the stated security
boundary.  Because the security boundary has not changed, it is safe to
adjust part of the code that patch introduced.

To do that and restore the previous functionality, adjust enter_repo to
take two flags instead of one.

The two bits are

 - ENTER_REPO_STRICT: callers that require exact paths (as opposed
   to allowing known suffixes like ".git", ".git/.git" to be
   omitted) can set this bit.  Corresponds to the "strict" parameter
   that the flags word replaces.

 - ENTER_REPO_ANY_OWNER_OK: callers that are willing to run without
   ownership check can set this bit.

The former is --strict-paths option of "git daemon".  The latter is
set only by upload-pack, which honors the claimed security boundary.

Note that local clones across ownership boundaries require --no-local so
that upload-pack is used.  Document this fact in the manual page and
provide an example.

This patch was based on one written by Junio C Hamano.

Signed-off-by: Junio C Hamano <gitster@pobox.com>
This commit is contained in:
brian m. carlson
2024-11-15 00:54:04 +00:00
committed by Junio C Hamano
parent 46698a8ea1
commit 0ffb5a6bf1
7 changed files with 49 additions and 11 deletions
Download Patch File Download Diff File Expand all files Collapse all files

6
daemon.c
View File

@ -149,6 +149,7 @@ static const char *path_ok(const char *directory, struct hostinfo *hi)
size_t rlen;
const char *path;
const char *dir;
unsigned enter_repo_flags;
dir = directory;
@ -239,14 +240,15 @@ static const char *path_ok(const char *directory, struct hostinfo *hi)
dir = rpath;
}
path = enter_repo(dir, strict_paths);
enter_repo_flags = strict_paths ? ENTER_REPO_STRICT : 0;
path = enter_repo(dir, enter_repo_flags);
if (!path && base_path && base_path_relaxed) {
/*
* if we fail and base_path_relaxed is enabled, try without
* prefixing the base path
*/
dir = directory;
path = enter_repo(dir, strict_paths);
path = enter_repo(dir, enter_repo_flags);
}
if (!path) {