git/list[1] front-page[2] threads[3] people[4] search[5] about
 

Re: [PATCH 2/2] test-lib: exhaustively insert non-alnum ASCII into the TRASH_DIRECTORY name

From
JDJoachim Durchholz <jo@durchholz.org>
Date
Apr 10, 2017, 14:59 UTC
Message-ID
<64121361-6f91-5988-b5e2-9278cc84067f@durchholz.org>
In-Reply-To
<20170410133856.qbmcif2it2gc6kdw@sigill.intra.peff.net>
Am 10.04.2017 um 15:38 schrieb Jeff King:
> Are those bugs? Maybe. Certainly they are limitations. But are they ones
> anybody _cares_ about?  I think this may fall under "if it hurts, don't
> do it".
It's not always possible to avoid that.

URLs, for example, may contain "funny characters", including multi-byte characters of which the second byte is 0x0a. If they are guaranteed to always be URL-encoded this isn't a problem, but then we still need to make sure that URL-encoding does happen.

Next source of funny characters that comes to my mind is submodules. They derive their name from the URL by default, and the subdirectory name as well. Again, consider the multibyte name where the second character is 0x0a. Or 0x80: À (uppercase A with accent grave) happens to have that byte in UTF-8 encoding, Ẁ is U+1E80 which would be encoded as 0x80 0x1e on an NTFS filesystem (barring additional coding steps in APIs or webservices, which further complicate the situation but don't usually eliminate the problem, they just shift it around).

 > If there are security bugs where a malicious input can cause us
> to do something bad, that's something to care about. But that's very
> different than asking "do these tests run to completion with a funny
> input".

If the tests do not complete, git is doing something unexpected. That in itself is not a security hole, but there's a pretty good chance that at least one of these ~230 unexpected things can be turned into one, given enough time and motivation. The risk multiplies as this is shell scripting, where the path from "string is misinterpreted" to "string is run as a command" is considerably shorter than in other languages.

Previous: Jeff KingNext: Jeff King
Message 9 of 25 in “test: Detect *lots* of bugs by adding non-alnum to trash dir names”
  1. 0/2 test: Detect *lots* of bugs by adding non-alnum to trash dir namesÆvar Arnfjörð Bjarmason, Apr 9, 2017
  2. 1/2 tests: mark tests that fail when the TEST_DIRECTORY is unusualÆvar Arnfjörð Bjarmason, Apr 9, 2017
  3. 2/2 test-lib: exhaustively insert non-alnum ASCII into the TRASH_DIRECTORY nameÆvar Arnfjörð Bjarmason, Apr 9, 2017
  4. SZEDER GáborApr 10, 2017
  5. Ævar Arnfjörð BjarmasonApr 10, 2017
  6. SZEDER GáborApr 10, 2017
  7. Ævar Arnfjörð BjarmasonApr 10, 2017
  8. Jeff KingApr 10, 2017
  9. Joachim DurchholzApr 10, 2017
  10. Jeff KingApr 10, 2017
  11. Joachim DurchholzApr 10, 2017
  12. Jeff KingApr 10, 2017
  13. SZEDER GáborApr 10, 2017
  14. Ævar Arnfjörð BjarmasonApr 10, 2017
  15. connect.c: handle errors from split_cmdlineJeff King, Apr 11, 2017
  16. Jeff KingApr 11, 2017
  17. Ævar Arnfjörð BjarmasonApr 11, 2017
  18. Jeff KingApr 11, 2017
  19. Ævar Arnfjörð BjarmasonApr 11, 2017
  20. Junio C HamanoApr 17, 2017
  21. Junio C HamanoApr 17, 2017
  22. Ævar Arnfjörð BjarmasonApr 19, 2017
  23. Jeff KingApr 11, 2017
  24. Joachim DurchholzApr 11, 2017
  25. Joachim DurchholzApr 9, 2017

Read the whole thread, see it on lore, or plain text.

$ cat FOOTERMessages come from the public archive at lore.kernel.org/git, fetched every hour. The front page is chosen and written each morning by an AI editor and can be wrong; the threads themselves are the record. About and API. For agents: an MCP server at https://gitlist.dev/mcp, and any thread, story or person page as Markdown by adding .md to its URL (or sending Accept: text/markdown). Details in /llms.txt.