mirrors/git
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

submodule-config.c: strengthen URL fsck check

Browse Source 
Update the validation of "curl URL" submodule URLs (i.e. those that specify
an "http[s]" or "ftp[s]" protocol) in 'check_submodule_url()' to catch more
invalid URLs. The existing validation using 'credential_from_url_gently()'
parses certain URLs incorrectly, leading to invalid submodule URLs passing
'git fsck' checks. Conversely, 'url_normalize()' - used to validate remote
URLs in 'remote_get()' - correctly identifies the invalid URLs missed by
'credential_from_url_gently()'.

To catch more invalid cases, replace 'credential_from_url_gently()' with
'url_normalize()' followed by a 'url_decode()' and a check for newlines
(mirroring 'check_url_component()' in the 'credential_from_url_gently()'
validation).

Signed-off-by: Victoria Dye <vdye@github.com>
Signed-off-by: Junio C Hamano <gitster@pobox.com>
This commit is contained in:
Victoria Dye
2024-01-18 01:55:18 +00:00
committed by Junio C Hamano
parent 7e2fc39d8c
commit 8430b438f6
2 changed files with 12 additions and 15 deletions
Download Patch File Download Diff File Expand all files Collapse all files

11
t/t7450-bad-git-dotfiles.sh
View File

@ -63,6 +63,7 @@ test_expect_success 'check urls' '
./%0ahost=example.com/foo.git
https://one.example.com/evil?%0ahost=two.example.com
https:///example.com/foo.git
http://example.com:test/foo.git
https::example.com/foo.git
http:::example.com/foo.git
EOF
@ -70,16 +71,6 @@ test_expect_success 'check urls' '
test_cmp expect actual
'
# NEEDSWORK: the URL checked here is not valid (and will not work as a remote if
# a user attempts to clone it), but the fsck check passes.
test_expect_failure 'url check misses invalid cases' '
test-tool submodule check-url >actual <<-\EOF &&
http://example.com:test/foo.git
EOF
test_must_be_empty actual
'
test_expect_success 'create innocent subrepo' '
git init innocent &&
git -C innocent commit --allow-empty -m foo