diff options
| author | Johannes Schindelin <johannes.schindelin@gmx.de> | 2024-10-30 00:27:52 +0100 |
|---|---|---|
| committer | Johannes Schindelin <johannes.schindelin@gmx.de> | 2024-11-26 22:14:57 +0100 |
| commit | 676cddebf94fab8defe704b2f58c5b59912bb40c (patch) | |
| tree | 7c2cc30d8966d5bcd618b977a624f4aaa2bf3555 /Documentation | |
| parent | 0dc9cad22d5c878d2ce6ee7b5cfffb034e34b2a0 (diff) | |
| parent | 54a3711a9dd968a04249beef157393d64b579d64 (diff) | |
| download | git-676cddebf94fab8defe704b2f58c5b59912bb40c.tar.gz | |
Sync with 2.40.4
* maint-2.40:
Git 2.40.4
credential: disallow Carriage Returns in the protocol by default
credential: sanitize the user prompt
credential_format(): also encode <host>[:<port>]
t7300: work around platform-specific behaviour with long paths on MinGW
compat/regex: fix argument order to calloc(3)
mingw: drop bogus (and unneeded) declaration of `_pgmptr`
ci: remove 'Upload failed tests' directories' step from linux32 jobs
Diffstat (limited to 'Documentation')
| -rw-r--r-- | Documentation/RelNotes/2.40.4.txt | 5 | ||||
| -rw-r--r-- | Documentation/config/credential.txt | 11 |
2 files changed, 16 insertions, 0 deletions
diff --git a/Documentation/RelNotes/2.40.4.txt b/Documentation/RelNotes/2.40.4.txt new file mode 100644 index 0000000000..0ff29f3cfc --- /dev/null +++ b/Documentation/RelNotes/2.40.4.txt @@ -0,0 +1,5 @@ +Git v2.40.4 Release Notes +========================= + +This release lets Git refuse to accept URLs that contain control +sequences. This addresses CVE-2024-50349 and CVE-2024-52006. diff --git a/Documentation/config/credential.txt b/Documentation/config/credential.txt index 512f31876e..9cadca7f73 100644 --- a/Documentation/config/credential.txt +++ b/Documentation/config/credential.txt @@ -14,6 +14,17 @@ credential.useHttpPath:: or https URL to be important. Defaults to false. See linkgit:gitcredentials[7] for more information. +credential.sanitizePrompt:: + By default, user names and hosts that are shown as part of the + password prompt are not allowed to contain control characters (they + will be URL-encoded by default). Configure this setting to `false` to + override that behavior. + +credential.protectProtocol:: + By default, Carriage Return characters are not allowed in the protocol + that is used when Git talks to a credential helper. This setting allows + users to override this default. + credential.username:: If no username is set for a network authentication, use this username by default. See credential.<context>.* below, and |