Re: [PATCH 2/2] hooks: fix a TOCTOU in "did we run a hook?" heuristic
- From
Taylor Blau <me@ttaylorr.com>
- Date
- Feb 19, 2022, 04:08 UTC
- Message-ID
- <YhBtI6PY5s/nC8og@nand.local>
- In-Reply-To
- <patch-2.2-d01d088073b-20220218T203834Z-avarab@gmail.com>
On Fri, Feb 18, 2022 at 09:43:52PM +0100, Ævar Arnfjörð Bjarmason wrote:
Show 33 quoted lines
> diff --git a/builtin/commit.c b/builtin/commit.c
> index b9ed0374e30..bc5d34bc31f 100644
> --- a/builtin/commit.c
> +++ b/builtin/commit.c
> @@ -725,11 +725,13 @@ static int prepare_to_commit(const char *index_file, const char *prefix,
> int clean_message_contents = (cleanup_mode != COMMIT_MSG_CLEANUP_NONE);
> int old_display_comment_prefix;
> int merge_contains_scissors = 0;
> + int invoked_hook;
>
> /* This checks and barfs if author is badly specified */
> determine_author_info(author_ident);
>
> - if (!no_verify && run_commit_hook(use_editor, index_file, "pre-commit", NULL))
> + if (!no_verify && run_commit_hook(use_editor, index_file, &invoked_hook,
> + "pre-commit", NULL))
> return 0;
>
> if (squash_message) {
> @@ -1052,10 +1054,10 @@ static int prepare_to_commit(const char *index_file, const char *prefix,
> return 0;
> }
>
> - if (!no_verify && hook_exists("pre-commit")) {
> + if (!no_verify && invoked_hook) {
> /*
> - * Re-read the index as pre-commit hook could have updated it,
> - * and write it out as a tree. We must do this before we invoke
> + * Re-read the index as the pre-commit-commit hook was invoked
> + * and could have updated it. We must do this before we invoke
> * the editor and after we invoke run_status above.
> */
> discard_cache();Sanity checking my own understating of this race: if we ran the pre-commit hook and it modified the index, but hook_exists() returns false later on (e.g., because the hook itself went away, the directory became unreadable, etc.), then we won't call discard_cache() when we should have?
If so, OK. This definitely seems like a pretty niche race, but independent of that I think the change here is an improvement in readability, and makes it clearer that calling discard_cache() depends on whether or not we *ran* the pre-commit hook, not whether we (still) *have* a pre-commit hook.
Thanks, Taylor