[PATCH 1/2] archive: don't allow negation of --remote-request
- From
Jeff King <peff@peff.net>
- Date
- Nov 15, 2011, 21:43 UTC
- Message-ID
- <20111115214317.GA20624@sigill.intra.peff.net>
- In-Reply-To
- <20111115214159.GA20457@sigill.intra.peff.net>
The remote-request flag is a security feature, telling the spawned git-archive that certain formats should be turned off. We always place it at the front of the command line when serving a remote request. Of course, this doesn't do us any good if the client can simply ask us politely to turn it off.
This bug was introduced in c09cd77 (upload-archive: use start_command instead of fork, 2011-10-24), but hasn't yet been released.
Signed-off-by: Jeff King <peff@peff.net> --- The other option would be recognizing and disallowing this when reading arguments from the remote.
builtin/archive.c | 2 +- t/t5000-tar-tree.sh | 12 ++++++++++++ 2 files changed, 13 insertions(+), 1 deletions(-)
diff --git a/builtin/archive.c b/builtin/archive.c index e405566..fce20a1 100644 --- a/builtin/archive.c +++ b/builtin/archive.c @@ -97,7 +97,7 @@ int cmd_archive(int argc, const char **argv, const char *prefix) "path to the remote git-upload-archive command"), { OPTION_BOOLEAN, 0, "remote-request", &is_remote, NULL, "indicate we are serving a remote request", - PARSE_OPT_NOARG | PARSE_OPT_HIDDEN }, + PARSE_OPT_NOARG | PARSE_OPT_HIDDEN | PARSE_OPT_NONEG }, OPT_END() }; diff --git a/t/t5000-tar-tree.sh b/t/t5000-tar-tree.sh index 889842e..723b54e 100755 --- a/t/t5000-tar-tree.sh +++ b/t/t5000-tar-tree.sh @@ -305,6 +305,18 @@ test_expect_success 'only enabled filters are available remotely' ' test_cmp remote.bar config.bar ' +# We have to hand-craft this, since the local "git archive" will +# eat our "--no-remote-request" argument otherwise. +test_expect_success 'malicious clients cannot un-remote themselves' ' + { + echo "0021argument --no-remote-request" && + echo "001eargument --format=tar.foo" && + echo "0012argument HEAD" && + printf "0000" + } >evil-request && + test_must_fail git upload-archive . <evil-request >remote.tar.foo +' + if $GZIP --version >/dev/null 2>&1; then test_set_prereq GZIP else
-- 1.7.7.3.8.g38efa