fsck: reject submodule.update = !command in .gitmodules
commit bb92255ebe6bccd76227e023d6d0bc997e318ad0 upstream.
This allows hosting providers to detect whether they are being used
to attack users using malicious 'update = !command' settings in
.gitmodules.
Since ac1fbbda2013 (submodule: do not copy unknown update mode from
.gitmodules, 2013-12-02), in normal cases such settings have been
treated as 'update = none', so forbidding them should not produce any
collateral damage to legitimate uses. A quick search does not reveal
any repositories making use of this construct, either.
Reported-by: Joern Schneeweisz <jschneeweisz@gitlab.com>
Signed-off-by: Jonathan Nieder <jrnieder@gmail.com>
Signed-off-by: Johannes Schindelin <johannes.schindelin@gmx.de>
Signed-off-by: Jonathan Nieder <jrnieder@gmail.com>
diff --git a/fsck.c b/fsck.c
index 135fe8c..3a65a3b 100644
--- a/fsck.c
+++ b/fsck.c
@@ -95,6 +95,7 @@
FUNC(GITMODULES_SYMLINK, ERROR) \
FUNC(GITMODULES_URL, ERROR) \
FUNC(GITMODULES_PATH, ERROR) \
+ FUNC(GITMODULES_UPDATE, ERROR) \
/* warnings */ \
FUNC(BAD_FILEMODE, WARN) \
FUNC(EMPTY_NAME, WARN) \
@@ -998,6 +999,11 @@
FSCK_MSG_GITMODULES_PATH,
"disallowed submodule path: %s",
value);
+ if (!strcmp(key, "update") && value && *value == '!')
+ data->ret |= report(data->options, data->obj,
+ FSCK_MSG_GITMODULES_UPDATE,
+ "disallowed submodule update setting: %s",
+ value);
free(name);
return 0;
diff --git a/t/t7406-submodule-update.sh b/t/t7406-submodule-update.sh
index 3781809..a74e7ea 100755
--- a/t/t7406-submodule-update.sh
+++ b/t/t7406-submodule-update.sh
@@ -397,6 +397,20 @@
git -C super submodule update submodule
'
+test_expect_success 'fsck detects command in .gitmodules' '
+ git init command-in-gitmodules &&
+ (
+ cd command-in-gitmodules &&
+ git submodule add ../submodule submodule &&
+ test_commit adding-submodule &&
+
+ git config -f .gitmodules submodule.submodule.update "!false" &&
+ git add .gitmodules &&
+ test_commit configuring-update &&
+ test_must_fail git fsck
+ )
+'
+
cat << EOF >expect
Execution of 'false $submodulesha1' failed in submodule path 'submodule'
EOF
