Re: [PATCH] fetch-pack: fix unadvertised requests validation

From: Gabriel Souza Franco <gabrielfrancosouza@gmail.com>
Date: Feb 27, 2016, 20:28 UTC
Message-ID: <CABaesJ+yNJ6_z=sFc+bDEPqDDsw9fkB5bYgxJaAkAMVqHNWwrQ@mail.gmail.com>
In-Reply-To: <20160227191943.GD12822@sigill.intra.peff.net>

On Sat, Feb 27, 2016 at 4:19 PM, Jeff King <peff@peff.net> wrote:

Show 9 quoted lines

> On Sat, Feb 27, 2016 at 02:07:12PM -0500, Jeff King wrote:
>
>> We expect whoever creates the "sought" list to fill in the name and sha1
>> as appropriate. If that is not happening in some code path, then yeah,
>> filter_refs() will not work as intended. But I think the solution there
>> would be to fix the caller to set up the "struct ref" more completely.
>>
>> Gabriel, did this come from a bug you noticed in practice, or was it
>> just an intended cleanup?

I was experimenting with uploadpack.hiderefs and uploadpack.allowTipSHA1InWant and couldn't get

        git fetch-pack $remote <sha1>

to work, and I traced the failure until that check. Reading more, I now see that currently it requires

       git fetch-pack $remote "<sha1> <sha1>"

to do what I want.

Show 12 quoted lines

>
> I double-checked that the code for git-fetch does so. It's in
> get_fetch_map()
>
>     if (refspec->exact_sha1) {
>             ref_map = alloc_ref(name);
>             get_oid_hex(name, &ref_map->old_oid);
>     } else ...
>
> So we should always have old_oid filled in already, and there is no need
> to do so in filter_refs() (and in fact it is wrong, for the degenerate
> example I gave earlier).

git fetch-pack doesn't use these code paths. I'll send a new patch shortly to allow bare sha1's in fetch-pack.

>
> -Peff