git/list[1] front-page[2] threads[3] people[4] search[5] about
 

Re: [PATCH] fast-import: disallow "." and ".." path components

From
Eric Sunshine <sunshine@sunshineco.com>
Date
Nov 25, 2024, 18:15 UTC
Message-ID
<CAPig+cReWbkomYYNAY_Q+6ezukSt8sZ+Q0MP=45DY4XeS3M==w@mail.gmail.com>
In-Reply-To
<pull.1831.git.1732557520428.gitgitgadget@gmail.com>

On Mon, Nov 25, 2024 at 12:58 PM Elijah Newren via GitGitGadget <gitgitgadget@gmail.com> wrote:

Show 18 quoted lines
> If a user specified e.g.
>    M 100644 :1 ../some-file
> then fast-import previously would happily create a git history where
> there is a tree in the top-level directory named "..", and with a file
> inside that directory named "some-file".  The top-level ".." directory
> causes problems.  While git checkout will die with errors and fsck will
> report hasDotdot problems, the user is going to have problems trying to
> remove the problematic file.  Simply avoid creating this bad history in
> the first place.
>
> Signed-off-by: Elijah Newren <newren@gmail.com>
> ---
> diff --git a/builtin/fast-import.c b/builtin/fast-import.c
> @@ -1466,6 +1466,9 @@ static int tree_content_set(
>         e->name = to_atom(p, n);
> +       if (!strcmp(e->name->str_dat, ".") || !strcmp(e->name->str_dat, "..")) {
> +               die("path %s contains invalid component", p);
> +       }
Probably not worth a reroll, but is_dot_or_dotdot() might be usable here.
(And -- style nit -- the braces could be dropped.)
Previous: Elijah Newren via GitGitGadgetNext: Elijah Newren
Message 2 of 14 in “fast-import: disallow "." and ".." path components”
  1. fast-import: disallow "." and ".." path componentsElijah Newren via GitGitGadget, Nov 25, 2024
  2. Eric SunshineNov 25, 2024
  3. Elijah NewrenNov 25, 2024
  4. fast-import: disallow "." and ".." path componentsElijah Newren via GitGitGadget, Nov 25, 2024
  5. Patrick SteinhardtNov 26, 2024
  6. Jeff KingNov 27, 2024
  7. Junio C HamanoNov 27, 2024
  8. Kristoffer HaugsbakkNov 27, 2024
  9. Re* [PATCH v2] fast-import: disallow "." and ".." path componentsJunio C Hamano, Nov 27, 2024
  10. Eric SunshineNov 27, 2024
  11. CodingGuidelines: a handful of error message guidelinesJunio C Hamano, Nov 28, 2024
  12. Eric SunshineNov 28, 2024
  13. Junio C HamanoNov 28, 2024
  14. Eric SunshineNov 28, 2024

Read the whole thread, see it on lore, or plain text.

$ cat FOOTERMessages come from the public archive at lore.kernel.org/git, fetched every hour. The front page is chosen and written each morning by an AI editor and can be wrong; the threads themselves are the record. About and API. For agents: an MCP server at https://gitlist.dev/mcp, and any thread, story or person page as Markdown by adding .md to its URL (or sending Accept: text/markdown). Details in /llms.txt.