From: しらいしななこ <nanako3@bluebottle.com>
Date: Tue, 29 Jan 2008 21:53:48 GMT
Subject: Re: [RFH/PATCH] prefix_path(): disallow absolute paths
Message-ID: <200801292158.m0TLwA7u019321@mi0.bluebottle.com>
In-Reply-To: <7vwspts9vj.fsf@gitster.siamese.dyndns.org>

Quoting Junio C Hamano <gitster@pobox.com>:

> Currently, we:
>
>  - Remove "." path component (i.e. the directory leading part
>    specified) from the input;
>
>  - Remove ".." path component and strip one level of the prefix;
>
> only from the beginning.  So if you give nonsense pathspec from
> the command line, you can end up calling prefix_path() with things
> like "/README", "/absolute/path/to//repository/tracked/file", and
> "fo//o/../o".
>
> And not passing such ambiguous path like "fo//o" to the core
> level but sanitizing matters.  Then core level can always do
> memcmp() with "fo/o" to see they are talking about the same
> path.

I may be mistaken but I think "fo//o" and "fo//o/" are returned as two different strings "fo/o" and "fo/o/" from your patch. Shouldn't you clean-up the second one to "fo/o", too?

-- 
Nanako Shiraishi
http://ivory.ap.teacup.com/nanako3/

----------------------------------------------------------------------
Free pop3 email with a spam filter.
http://www.bluebottle.com/tag/5