git/list[1] front-page[2] threads[3] people[4] search[5] about
 

Re: [PATCH] use lock token in non-URI form in start_put

From
Johannes Schindelin <johannes.schindelin@gmx.de>
Date
Feb 7, 2009, 20:20 UTC
Message-ID
<alpine.DEB.1.00.0902072114360.10279@pacific.mpi-cbg.de>
In-Reply-To
<498DE0B9.6080603@gmail.com>
Hi,
On Sun, 8 Feb 2009, Tay Ray Chuan wrote:
Show 10 quoted lines
> After 753bc91 ("Remove the requirement opaquelocktoken uri scheme"),
> lock tokens are in the URI forms in which they are received from the
> server, eg. 'opaquelocktoken:', 'uuid:'
>
> However, "start_put" (and consequently "start_move"), which attempts to
> create a unique temporary file using the UUID of the lock token,
> inadvertently uses the lock token in its URI form. These file
> operations on the server may not be successful (specifically, in
> Windows), due to the colon ':' character from the URI form of the lock
> token in the file path.

If it is a prefix that happens to be part of the URI, but must not be used by the client code as a lock token, would it not be better to store the token in lock->token to begin with?

Show 26 quoted lines
> To do this, the "start_put" gets the position of ':', which is used to
> separate the URI scheme from the part, eg. "<scheme>:". In addition,
> start_put uses the last position of ':', since URIs with component
> URIs are possible, eg. "urn:uuid:" One can be sure that the lock token
> will always contain the UUID and be in URI form, due to RFC 2518, or
> its successor RFC 4918 (see
> http://www.webdav.org/specs/rfc4918.html#ELEMENT_locktoken).
> 
> Signed-off-by: Tay Ray Chuan <rctay89@gmail.com>
> 
> Signed-off-by: Tay Ray Chuan <rctay89@gmail.com>
> ---
>  http-push.c          |    2 +-
>  t/t5540-http-push.sh |    7 +++++++
>  2 files changed, 8 insertions(+), 1 deletions(-)
> 
> diff --git a/http-push.c b/http-push.c
> index eefd64c..bd8f372 100644
> --- a/http-push.c
> +++ b/http-push.c
> @@ -558,7 +558,7 @@ static void start_put(struct transfer_request *request)
> 
>  	append_remote_object_url(&buf, remote->url, hex, 0);
>  	strbuf_addstr(&buf, "_");
> -	strbuf_addstr(&buf, request->lock->token);
> +	strbuf_addstr(&buf, strrchr(request->lock->token, ':') + 1);

This is unsafe. What if lock->token does not contain a colon? Even if it happens to be the case now, in your setup, it might change, or there might be mistakes in the server code. We should always play it safe if we cannot control the other side's code.

Ciao, Dscho

Previous: Tay Ray ChuanNext: Junio C Hamano
Message 2 of 7 in “use lock token in non-URI form in start_put”
  1. use lock token in non-URI form in start_putTay Ray Chuan, Feb 7, 2009
  2. Johannes SchindelinFeb 7, 2009
  3. Junio C HamanoFeb 7, 2009
  4. Tay Ray ChuanFeb 8, 2009
  5. Junio C HamanoFeb 8, 2009
  6. Tay Ray ChuanFeb 8, 2009
  7. Tay Ray ChuanFeb 8, 2009

Read the whole thread, see it on lore, or plain text.

$ cat FOOTERMessages come from the public archive at lore.kernel.org/git, fetched every hour. The front page is chosen and written each morning by an AI editor and can be wrong; the threads themselves are the record. About and API. For agents: an MCP server at https://gitlist.dev/mcp, and any thread, story or person page as Markdown by adding .md to its URL (or sending Accept: text/markdown). Details in /llms.txt.