git/list[1] front-page[2] threads[3] people[4] search[5] about
 

Re: [PATCH 0/7] Restrict the usage of config_from_gitmodules()

From
BWBrandon Williams <bmwill@google.com>
Date
Jun 22, 2018, 17:13 UTC
Message-ID
<20180622171310.GE244185@google.com>
In-Reply-To
<20180622162656.19338-1-ao2@ao2.it>
On 06/22, Antonio Ospite wrote:
Show 46 quoted lines
> Hi,
> 
> when I tried to reuse and extend 'config_from_gitmodules' in
> https://public-inbox.org/git/20180514105823.8378-2-ao2@ao2.it/ it was
> pointed out to me that special care is needed to make sure that this
> function does not get abused to bring in arbitrary configuration stored
> in the .gitmodules file, as the latter is meant only for submodule
> specific configuration.
> 
> So I thought that the function could be made private to better
> communicate that.
> 
> This is what this series is about.
> 
> Patch 1 moves 'config_from_gitmodules' to submodule-config.c
> 
> Patches 2 and 3 add helpers to handle special cases and avoid calling
> 'config_from_gitmodules' directly, which might set a bad example for
> future code.
> 
> Patch 4 makes the symbol private to discourage its use in code not
> related to submodules.
> 
> Patches 5 and 6 enable reusing 'config_from_gitmodules' when it's safe
> to do so.
> 
> Patches 7 is just a cleanup and I am not even sure it is worth it, so we
> might as well just drop it.
> 
> The series can be seen as a continuation of the changes from
> https://public-inbox.org/git/20170802194923.88239-1-bmwill@google.com/
> 
> Even though the helper functions may be less elegant than what was done
> back then, they should better protect from misuse of
> config_from_gitmodules.
> 
> A further change could be to print warning messages when the backward
> compatibility helpers find configuration in .gitmodules that should not
> belong there, but I'll leave that to someone else.
> 
> Thanks,
>    Antonio
> 
> P.S. I added Jeff King to CC as he has done some work related to
> .gitmodules recently, and I removed the vcsh poeple on this one.
> 

Thanks for working on this. I think its a good approach and the end result makes it much harder for arbitrary config to sneak back in to the .gitmodules file. And after this series it looks like you should be in a good place to read the .gitmodules file from other places (not just in the worktree).

As you've mentioned here I also agree we could do without the last patch but I'll leave that up to you. Other than a couple typos I found I think this series looks good! Thanks again for revisiting this.

-- 
Brandon Williams
Previous: Brandon WilliamsNext: Antonio Ospite
Message 13 of 15 in “Restrict the usage of config_from_gitmodules()”
  1. 0/7 Restrict the usage of config_from_gitmodules()Antonio Ospite, Jun 22, 2018
  2. 5/7 submodule-config: pass repository as argument to config_from_gitmodulesAntonio Ospite, Jun 22, 2018
  3. 2/7 submodule-config: add helper function to get 'fetch' config from .gitmodulesAntonio Ospite, Jun 22, 2018
  4. Brandon WilliamsJun 22, 2018
  5. 1/7 config: move config_from_gitmodules to submodule-config.cAntonio Ospite, Jun 22, 2018
  6. 7/7 submodule-config: cleanup backward compatibility helpersAntonio Ospite, Jun 22, 2018
  7. Brandon WilliamsJun 22, 2018
  8. 4/7 submodule-config: make 'config_from_gitmodules' privateAntonio Ospite, Jun 22, 2018
  9. 3/7 submodule-config: add helper to get 'update-clone' config from .gitmodulesAntonio Ospite, Jun 22, 2018
  10. Brandon WilliamsJun 22, 2018
  11. 6/7 submodule-config: reuse config_from_gitmodules in repo_read_gitmodulesAntonio Ospite, Jun 22, 2018
  12. Brandon WilliamsJun 22, 2018
  13. Brandon WilliamsJun 22, 2018
  14. Antonio OspiteJun 22, 2018
  15. Brandon WilliamsJun 22, 2018

Read the whole thread, see it on lore, or plain text.

$ cat FOOTERMessages come from the public archive at lore.kernel.org/git, fetched every hour. The front page is chosen and written each morning by an AI editor and can be wrong; the threads themselves are the record. About and API. For agents: an MCP server at https://gitlist.dev/mcp, and any thread, story or person page as Markdown by adding .md to its URL (or sending Accept: text/markdown). Details in /llms.txt.