Re: [PATCH 0/5] Directory traversal fixes

From: Derrick Stolee <stolee@gmail.com>
Date: May 7, 2021, 16:27 UTC
Message-ID: <f99d7cd9-5e27-b5de-12fc-0a42be2d14ec@gmail.com>
In-Reply-To: <pull.1020.git.git.1620360300.gitgitgadget@gmail.com>

On 5/7/2021 12:04 AM, Elijah Newren via GitGitGadget wrote:

Show 12 quoted lines

> This patchset fixes a few directory traversal issues, where fill_directory()
> would traverse into directories that it shouldn't and not traverse into
> directories that it should. One of these issues was reported recently on
> this list[1], another was found at $DAYJOB.
> 
> The fifth patch might have backward compatibility implications, but is easy
> to review. Even if the logic in dir.c makes your eyes glaze over, at least
> take a look at the fifth patch.
> 
> Also, if anyone has any ideas about a better place to put the "Some
> sidenotes" from the third commit message rather than keeping them in a
> random commit message, that might be helpful too.

As for your patches themselves, I can't claim to understand all the complicated details about how treat_directory() is working, but your patches are well organized and the new tests are the real proof that this is working as intended.

Thanks for the attention to detail here.

-Stolee