Re: [PATCH] fast-import: disallow "." and ".." path components
- From
Eric Sunshine <sunshine@sunshineco.com>
- Date
- Nov 25, 2024, 18:15 UTC
- Message-ID
- <CAPig+cReWbkomYYNAY_Q+6ezukSt8sZ+Q0MP=45DY4XeS3M==w@mail.gmail.com>
- In-Reply-To
- <pull.1831.git.1732557520428.gitgitgadget@gmail.com>
On Mon, Nov 25, 2024 at 12:58 PM Elijah Newren via GitGitGadget <gitgitgadget@gmail.com> wrote:
Show 18 quoted lines
> If a user specified e.g.
> M 100644 :1 ../some-file
> then fast-import previously would happily create a git history where
> there is a tree in the top-level directory named "..", and with a file
> inside that directory named "some-file". The top-level ".." directory
> causes problems. While git checkout will die with errors and fsck will
> report hasDotdot problems, the user is going to have problems trying to
> remove the problematic file. Simply avoid creating this bad history in
> the first place.
>
> Signed-off-by: Elijah Newren <newren@gmail.com>
> ---
> diff --git a/builtin/fast-import.c b/builtin/fast-import.c
> @@ -1466,6 +1466,9 @@ static int tree_content_set(
> e->name = to_atom(p, n);
> + if (!strcmp(e->name->str_dat, ".") || !strcmp(e->name->str_dat, "..")) {
> + die("path %s contains invalid component", p);
> + }Probably not worth a reroll, but is_dot_or_dotdot() might be usable here.
(And -- style nit -- the braces could be dropped.)