git/list[1] front-page[2] threads[3] people[4] search[5] about
 

[PATCH v2 19/19] Guard unallowed access to repository when it's not set up

From
Nguyễn Thái Ngọc Duy <pclouds@gmail.com>
Date
Mar 21, 2010, 10:30 UTC
Message-ID
<1269167446-7799-20-git-send-email-pclouds@gmail.com>
In-Reply-To
<1269167446-7799-1-git-send-email-pclouds@gmail.com>

Many code path will skip repo access if startup_info->have_repository is false. This may be a fault if startup_info->have_repository has not been properly initialized.

So the rule is one of the following commands must be run before any repo access. And none of them can be called twice.

 - setup_git_directory*
 - enter_repo
 - init_db
Signed-off-by: Nguyễn Thái Ngọc Duy <pclouds@gmail.com>
---
 builtin/init-db.c |    1 +
 cache.h           |    1 +
 config.c          |    2 ++
 environment.c     |   13 +++++++++++--
 git.c             |    3 +++
 setup.c           |   13 +++++++++++++
 6 files changed, 31 insertions(+), 2 deletions(-)
diff --git a/builtin/init-db.c b/builtin/init-db.c
index 064b919..d4c415c 100644
--- a/builtin/init-db.c
+++ b/builtin/init-db.c
@@ -302,6 +302,7 @@ int init_db(const char *git_dir, const char *template_dir, unsigned int flags)
 
 	set_git_dir(make_absolute_path(git_dir));
 	startup_info->have_repository = 1;
+	startup_info->have_run_setup_gitdir = 1;
 
 	safe_create_dir(get_git_dir(), 0);
 
diff --git a/cache.h b/cache.h
index b1ed150..417a744 100644
--- a/cache.h
+++ b/cache.h
@@ -1060,6 +1060,7 @@ int split_cmdline(char *cmdline, const char ***argv);
 /* git.c */
 struct startup_info {
 	const char *prefix;
+	int have_run_setup_gitdir;
 	int have_repository;
 	int help;
 };
diff --git a/config.c b/config.c
index 07d854a..9981b09 100644
--- a/config.c
+++ b/config.c
@@ -737,6 +737,8 @@ int git_config(config_fn_t fn, void *data)
 	char *repo_config = NULL;
 	int ret;
 
+	if (startup_info && !startup_info->have_run_setup_gitdir)
+		die("internal error: access to .git/config without repo setup");
 	if (!startup_info || startup_info->have_repository)
 		repo_config = git_pathdup("config");
 	ret = git_config_early(fn, data, repo_config);
diff --git a/environment.c b/environment.c
index 6127025..17f0cbe 100644
--- a/environment.c
+++ b/environment.c
@@ -98,9 +98,18 @@ void unset_git_env(void)
 
 static void setup_git_env(void)
 {
+	if (startup_info && startup_info->have_run_setup_gitdir)
+		die("internal error: setup_git_env can't be called twice");
 	git_dir = getenv(GIT_DIR_ENVIRONMENT);
-	if (!git_dir)
-		git_dir = read_gitfile_gently(DEFAULT_GIT_DIR_ENVIRONMENT);
+	if (!git_dir) {
+		/*
+		 * Repo detection should be done by setup_git_directory*
+		 * or enter_repo, not by this function
+		 */
+		 if (startup_info)
+			 die("internal error: $GIT_DIR is empty");
+		 git_dir = read_gitfile_gently(DEFAULT_GIT_DIR_ENVIRONMENT);
+	}
 	if (!git_dir)
 		git_dir = DEFAULT_GIT_DIR_ENVIRONMENT;
 	git_object_dir = getenv(DB_ENVIRONMENT);
diff --git a/git.c b/git.c
index 88aaf13..5f7f410 100644
--- a/git.c
+++ b/git.c
@@ -260,6 +260,9 @@ static int run_builtin(struct cmd_struct *p, int argc, const char **argv)
 			use_pager = 1;
 		}
 	}
+	else
+		/* Stop git_config() from complaining that no repository found. */
+		startup_info->have_run_setup_gitdir = 1;
 	commit_pager_choice();
 
 	if (!startup_info->help && p->option & NEED_WORK_TREE)
diff --git a/setup.c b/setup.c
index 1808ebe..d9bb616 100644
--- a/setup.c
+++ b/setup.c
@@ -237,7 +237,17 @@ void setup_work_tree(void)
 		git_dir = make_absolute_path(git_dir);
 	if (!work_tree || chdir(work_tree))
 		die("This operation must be run in a work tree");
+
+	/*
+	 * have_run_setup_gitdir is unset in order to avoid die()ing
+	 * inside set_git_env(). We don't actually initialize
+	 * repo twice, we're just relative-izing gitdir
+	 */
+	if (startup_info)
+		startup_info->have_run_setup_gitdir = 0;
 	set_git_dir(make_relative_path(git_dir, work_tree));
+	if (startup_info)
+		startup_info->have_run_setup_gitdir = 1;
 	initialized = 1;
 }
 
@@ -340,6 +350,7 @@ void unset_git_directory(const char *prefix)
 			unset_git_env();
 		startup_info->prefix = NULL;
 		startup_info->have_repository = 0;
+		startup_info->have_run_setup_gitdir = 0;
 	}
 
 	/* Initialized in setup_git_directory_gently_1() */
@@ -506,6 +517,7 @@ const char *setup_git_directory_gently(int *nongit_ok)
 	prefix = setup_git_directory_gently_1(nongit_ok);
 	if (startup_info) {
 		startup_info->prefix = prefix;
+		startup_info->have_run_setup_gitdir = 1;
 		startup_info->have_repository = !nongit_ok || !*nongit_ok;
 	}
 	return prefix;
@@ -600,6 +612,7 @@ char *enter_repo(char *path, int strict)
 		set_git_dir(".");
 		if (startup_info) {
 			startup_info->prefix = NULL;
+			startup_info->have_run_setup_gitdir = 1;
 			startup_info->have_repository = 1;
 		}
 		return path;

-- 
1.7.0.2.425.gb99f1
Previous: Nguyễn Thái Ngọc Duy
Message 20 of 20 in “nd/setup part two, second round”
  1. 00/19 nd/setup part two, second roundNguyễn Thái Ngọc Duy, Mar 21, 2010
  2. 01/19 Move enter_repo() to setup.cNguyễn Thái Ngọc Duy, Mar 21, 2010
  3. 02/19 enter_repo(): initialize other variables as setup_git_directory_gently() doesNguyễn Thái Ngọc Duy, Mar 21, 2010
  4. 03/19 rev-parse --git-dir: print relative gitdir correctlyNguyễn Thái Ngọc Duy, Mar 21, 2010
  5. 04/19 worktree setup: call set_git_dir explicitlyNguyễn Thái Ngọc Duy, Mar 21, 2010
  6. 05/19 Add git_config_early()Nguyễn Thái Ngọc Duy, Mar 21, 2010
  7. 06/19 Use git_config_early() instead of git_config() during repo setupNguyễn Thái Ngọc Duy, Mar 21, 2010
  8. 07/19 worktree setup: restore original state when things go wrongNguyễn Thái Ngọc Duy, Mar 21, 2010
  9. 08/19 init/clone: turn on startup->have_repository properlyNguyễn Thái Ngọc Duy, Mar 21, 2010
  10. 09/19 git_config(): do not read .git/config if there is no repositoryNguyễn Thái Ngọc Duy, Mar 21, 2010
  11. 10/19 Do not read .git/info/exclude if there is no repositoryNguyễn Thái Ngọc Duy, Mar 21, 2010
  12. 11/19 Do not read .git/info/attributes if there is no repositoryNguyễn Thái Ngọc Duy, Mar 21, 2010
  13. 12/19 apply: do not check sha1 when repository has not been foundNguyễn Thái Ngọc Duy, Mar 21, 2010
  14. 13/19 config: do not read .git/config if there is no repositoryNguyễn Thái Ngọc Duy, Mar 21, 2010
  15. 14/19 run_builtin(): save "-h" detection result for later useNguyễn Thái Ngọc Duy, Mar 21, 2010
  16. 15/19 builtins: utilize startup_info->help where possibleNguyễn Thái Ngọc Duy, Mar 21, 2010
  17. 16/19 builtins: check for startup_info->help, print and exit earlyNguyễn Thái Ngọc Duy, Mar 21, 2010
  18. 17/19 Allow to undo setup_git_directory_gently() gracefully (and fix alias code)Nguyễn Thái Ngọc Duy, Mar 21, 2010
  19. 18/19 alias: keep repository found while collecting aliases as long as possibleNguyễn Thái Ngọc Duy, Mar 21, 2010
  20. 19/19 Guard unallowed access to repository when it's not set upNguyễn Thái Ngọc Duy, Mar 21, 2010

Read the whole thread, see it on lore, or plain text.

$ cat FOOTERMessages come from the public archive at lore.kernel.org/git, fetched every hour. The front page is chosen and written each morning by an AI editor and can be wrong; the threads themselves are the record. About and API. For agents: an MCP server at https://gitlist.dev/mcp, and any thread, story or person page as Markdown by adding .md to its URL (or sending Accept: text/markdown). Details in /llms.txt.