From: Jeff King <peff@peff.net>
Date: Tue, 03 Feb 2015 00:50:05 GMT
Subject: Re: [PATCH v2 1/4] apply: reject input that touches outside $cwd
Message-ID: <20150203005005.GB31946@peff.net>
In-Reply-To: <1422919650-13346-2-git-send-email-gitster@pobox.com>

On Mon, Feb 02, 2015 at 03:27:27PM -0800, Junio C Hamano wrote:

> +test_expect_failure 'symlink escape via ..' '
> +	{
> +		mkpatch_symlink tmp .. &&
> +		mkpatch_add tmp/foo ../foo
> +	} >patch &&
> +	test_must_fail git apply patch &&
> +	test_path_is_missing ../foo
> +'

By the way, does this patch (and the other symlink-escape ones) need to
be marked with the SYMLINKS prereq? For a pure-index application, it
should work anywhere, but I have a feeling that this "git apply patch"
may try to write the symlink to the filesystem, fail, and report failure
for the wrong reason.  I don't have a SYMLINK-challenged filesystem to
test on, though.

-Peff