diff options
| author | Taylor Blau <me@ttaylorr.com> | 2023-01-24 19:43:51 -0500 |
|---|---|---|
| committer | Junio C Hamano <gitster@pobox.com> | 2023-01-24 16:52:16 -0800 |
| commit | bffc762f87ae8d18c6001bf0044a76004245754c (patch) | |
| tree | 94ef671b634c0516c9643aa5e685ca31c0793453 /t/t5604-clone-reference.sh | |
| parent | cf8f6ce02a13f4d1979a53241afbee15a293fce9 (diff) | |
| download | git-bffc762f87ae8d18c6001bf0044a76004245754c.tar.gz | |
dir-iterator: prevent top-level symlinks without FOLLOW_SYMLINKS
When using the dir_iterator API, we first stat(2) the base path, and
then use that as a starting point to enumerate the directory's contents.
If the directory contains symbolic links, we will immediately die() upon
encountering them without the `FOLLOW_SYMLINKS` flag. The same is not
true when resolving the top-level directory, though.
As explained in a previous commit, this oversight in 6f054f9fb3
(builtin/clone.c: disallow `--local` clones with symlinks, 2022-07-28)
can be used as an attack vector to include arbitrary files on a victim's
filesystem from outside of the repository.
Prevent resolving top-level symlinks unless the FOLLOW_SYMLINKS flag is
given, which will cause clones of a repository with a symlink'd
"$GIT_DIR/objects" directory to fail.
Signed-off-by: Taylor Blau <me@ttaylorr.com>
Signed-off-by: Junio C Hamano <gitster@pobox.com>
Diffstat (limited to 't/t5604-clone-reference.sh')
| -rwxr-xr-x | t/t5604-clone-reference.sh | 16 |
1 files changed, 16 insertions, 0 deletions
diff --git a/t/t5604-clone-reference.sh b/t/t5604-clone-reference.sh index 9d32f1c4a4..4ff21d7ccf 100755 --- a/t/t5604-clone-reference.sh +++ b/t/t5604-clone-reference.sh @@ -341,4 +341,20 @@ test_expect_success SYMLINKS 'clone repo with symlinked or unknown files at obje test_must_be_empty T--shared.objects-symlinks.raw ' +test_expect_success SYMLINKS 'clone repo with symlinked objects directory' ' + test_when_finished "rm -fr sensitive malicious" && + + mkdir -p sensitive && + echo "secret" >sensitive/file && + + git init malicious && + rm -fr malicious/.git/objects && + ln -s "$(pwd)/sensitive" ./malicious/.git/objects && + + test_must_fail git clone --local malicious clone 2>err && + + test_path_is_missing clone && + grep "failed to start iterator over" err +' + test_done |