c8f64781c8
As part of the protections added in Git v2.45.1 and friends, repository-local `core.hooksPath` settings are no longer allowed, as a defense-in-depth mechanism to prevent future Git vulnerabilities to raise to critical level if those vulnerabilities inadvertently allow the repository-local config to be written. What the added protection did not anticipate is that such a repository-local `core.hooksPath` can not only be used to point to maliciously-placed scripts in the current worktree, but also to _prevent_ hooks from being called altogether. We just reverted the `core.hooksPath` protections, based on the Git maintainer's recommendation in https://lore.kernel.org/git/xmqq4jaxvm8z.fsf@gitster.g/ to address this concern as well as related ones. Let's make sure that we won't regress while trying to protect the clone operation further. Reported-by: Brooke Kuhlmann <brooke@alchemists.io> Signed-off-by: Johannes Schindelin <johannes.schindelin@gmx.de> Signed-off-by: Junio C Hamano <gitster@pobox.com>
52 lines
1.4 KiB
Bash
Executable File
52 lines
1.4 KiB
Bash
Executable File
#!/bin/sh
|
|
|
|
test_description='Test the core.hooksPath configuration variable'
|
|
|
|
. ./test-lib.sh
|
|
|
|
test_expect_success 'set up a pre-commit hook in core.hooksPath' '
|
|
>actual &&
|
|
mkdir -p .git/custom-hooks &&
|
|
write_script .git/custom-hooks/pre-commit <<-\EOF &&
|
|
echo CUSTOM >>actual
|
|
EOF
|
|
test_hook --setup pre-commit <<-\EOF
|
|
echo NORMAL >>actual
|
|
EOF
|
|
'
|
|
|
|
test_expect_success 'Check that various forms of specifying core.hooksPath work' '
|
|
test_commit no_custom_hook &&
|
|
git config core.hooksPath .git/custom-hooks &&
|
|
test_commit have_custom_hook &&
|
|
git config core.hooksPath .git/custom-hooks/ &&
|
|
test_commit have_custom_hook_trailing_slash &&
|
|
git config core.hooksPath "$PWD/.git/custom-hooks" &&
|
|
test_commit have_custom_hook_abs_path &&
|
|
git config core.hooksPath "$PWD/.git/custom-hooks/" &&
|
|
test_commit have_custom_hook_abs_path_trailing_slash &&
|
|
cat >expect <<-\EOF &&
|
|
NORMAL
|
|
CUSTOM
|
|
CUSTOM
|
|
CUSTOM
|
|
CUSTOM
|
|
EOF
|
|
test_cmp expect actual
|
|
'
|
|
|
|
test_expect_success 'git rev-parse --git-path hooks' '
|
|
git config core.hooksPath .git/custom-hooks &&
|
|
git rev-parse --git-path hooks/abc >actual &&
|
|
test .git/custom-hooks/abc = "$(cat actual)"
|
|
'
|
|
|
|
test_expect_success 'core.hooksPath=/dev/null' '
|
|
git clone -c core.hooksPath=/dev/null . no-templates &&
|
|
value="$(git -C no-templates config --local core.hooksPath)" &&
|
|
# The Bash used by Git for Windows rewrites `/dev/null` to `nul`
|
|
{ test /dev/null = "$value" || test nul = "$value"; }
|
|
'
|
|
|
|
test_done
|