[PATCH 6/6] mailmap: do not respect symlinks for in-tree .mailmap
- From
Jeff King <peff@peff.net>
- Date
- Feb 16, 2021, 14:44 UTC
- Message-ID
- <YCvaVZEUuIwAFWxe@coredump.intra.peff.net>
- In-Reply-To
- <YCvaJg8o882IqNnx@coredump.intra.peff.net>
As with .gitattributes and .gitignore, we would like to make sure that .mailmap files are handled consistently whether read from the a blob (as is the default behavior in a bare repo) or from the filesystem. Likewise, we would like to avoid reading out-of-tree files pointed to by a symlink, which could have security implications in certain setups.
We can cover both by using open_nofollow() when opening the in-tree files. We'll continue to follow links for mailmap.file, as well as when reading .mailmap from the current directory when outside of a repository entirely.
Signed-off-by: Jeff King <peff@peff.net> --- mailmap.c | 22 +++++++++++++++++----- t/t4203-mailmap.sh | 31 +++++++++++++++++++++++++++++++ 2 files changed, 48 insertions(+), 5 deletions(-)
diff --git a/mailmap.c b/mailmap.c index eb77c6e77c..7ac966107e 100644 --- a/mailmap.c +++ b/mailmap.c @@ -157,20 +157,30 @@ static void read_mailmap_line(struct string_list *map, char *buffer) add_mapping(map, name1, email1, name2, email2); } -static int read_mailmap_file(struct string_list *map, const char *filename) +/* Flags for read_mailmap_file() */ +#define MAILMAP_NOFOLLOW (1<<0) + +static int read_mailmap_file(struct string_list *map, const char *filename, + unsigned flags) { char buffer[1024]; FILE *f; + int fd; if (!filename) return 0; - f = fopen(filename, "r"); - if (!f) { + if (flags & MAILMAP_NOFOLLOW) + fd = open_nofollow(filename, O_RDONLY); + else + fd = open(filename, O_RDONLY); + + if (fd < 0) { if (errno == ENOENT) return 0; return error_errno("unable to open mailmap at %s", filename); } + f = xfdopen(fd, "r"); while (fgets(buffer, sizeof(buffer), f) != NULL) read_mailmap_line(map, buffer); @@ -225,10 +235,12 @@ int read_mailmap(struct string_list *map) if (!git_mailmap_blob && is_bare_repository()) git_mailmap_blob = "HEAD:.mailmap"; - err |= read_mailmap_file(map, ".mailmap"); + err |= read_mailmap_file(map, ".mailmap", + startup_info->have_repository ? + MAILMAP_NOFOLLOW : 0); if (startup_info->have_repository) err |= read_mailmap_blob(map, git_mailmap_blob); - err |= read_mailmap_file(map, git_mailmap_file); + err |= read_mailmap_file(map, git_mailmap_file, 0); return err; } diff --git a/t/t4203-mailmap.sh b/t/t4203-mailmap.sh index 621f9962d5..96a4e6132f 100755 --- a/t/t4203-mailmap.sh +++ b/t/t4203-mailmap.sh @@ -889,4 +889,35 @@ test_expect_success 'empty syntax: setup' ' test_cmp expect actual ' +test_expect_success SYMLINKS 'set up symlink tests' ' + git commit --allow-empty -m foo --author="Orig <orig@example.com>" && + echo "New <new@example.com> <orig@example.com>" >map && + rm -f .mailmap +' + +test_expect_success SYMLINKS 'symlinks respected in mailmap.file' ' + test_when_finished "rm symlink" && + ln -s map symlink && + git -c mailmap.file="$(pwd)/symlink" log -1 --format=%aE >actual && + echo "new@example.com" >expect && + test_cmp expect actual +' + +test_expect_success SYMLINKS 'symlinks respected in non-repo shortlog' ' + git log -1 >input && + test_when_finished "nongit rm .mailmap" && + nongit ln -sf "$TRASH_DIRECTORY/map" .mailmap && + nongit git shortlog -s <input >actual && + echo " 1 New" >expect && + test_cmp expect actual +' + +test_expect_success SYMLINKS 'symlinks not respected in-tree' ' + test_when_finished "rm .mailmap" && + ln -s map .mailmap && + git log -1 --format=%aE >actual && + echo "orig@example.com" >expect&& + test_cmp expect actual +' + test_done
-- 2.30.1.986.gd86016a168