git/list[1] front-page[2] threads[3] people[4] search[5] about
 

[PATCH 0/5] Directory traversal fixes

From
Elijah Newren via GitGitGadget <gitgitgadget@gmail.com>
Date
May 7, 2021, 04:04 UTC
Message-ID
<pull.1020.git.git.1620360300.gitgitgadget@gmail.com>

This patchset fixes a few directory traversal issues, where fill_directory() would traverse into directories that it shouldn't and not traverse into directories that it should. One of these issues was reported recently on this list[1], another was found at $DAYJOB.

The fifth patch might have backward compatibility implications, but is easy to review. Even if the logic in dir.c makes your eyes glaze over, at least take a look at the fifth patch.

Also, if anyone has any ideas about a better place to put the "Some sidenotes" from the third commit message rather than keeping them in a random commit message, that might be helpful too.

[1] See https://lore.kernel.org/git/DM6PR00MB06829EC5B85E0C5AC595004E894E9@DM6PR00MB0682.namprd00.prod.outlook.com/ or alternatively https://github.com/git-for-windows/git/issues/2732.

Elijah Newren (5):
  t7300: add testcase showing unnecessary traversal into ignored
    directory
  t3001, t7300: add testcase showcasing missed directory traversal
  dir: avoid unnecessary traversal into ignored directory
  dir: traverse into untracked directories if they may have ignored
    subfiles
  [RFC] ls-files: error out on -i unless -o or -c are specified
 builtin/ls-files.c                 |  3 ++
 dir.c                              | 50 ++++++++++++++++---------
 t/t1306-xdg-files.sh               |  2 +-
 t/t3001-ls-files-others-exclude.sh |  5 +++
 t/t3003-ls-files-exclude.sh        |  4 +-
 t/t7300-clean.sh                   | 59 ++++++++++++++++++++++++++++++
 6 files changed, 103 insertions(+), 20 deletions(-)
base-commit: 311531c9de557d25ac087c1637818bd2aad6eb3a
Published-As: https://github.com/gitgitgadget/git/releases/tag/pr-git-1020%2Fnewren%2Fdirectory-traversal-fixes-v1
Fetch-It-Via: git fetch https://github.com/gitgitgadget/git pr-git-1020/newren/directory-traversal-fixes-v1
Pull-Request: https://github.com/git/git/pull/1020
-- 
gitgitgadget
Next: Elijah Newren via GitGitGadget
Message 1 of 90 in “Directory traversal fixes”
  1. 0/5 Directory traversal fixesElijah Newren via GitGitGadget, May 7, 2021
  2. 1/5 t7300: add testcase showing unnecessary traversal into ignored directoryElijah Newren via GitGitGadget, May 7, 2021
  3. Eric SunshineMay 7, 2021
  4. Elijah NewrenMay 7, 2021
  5. Eric SunshineMay 7, 2021
  6. Elijah NewrenMay 7, 2021
  7. Eric SunshineMay 7, 2021
  8. Jeff KingMay 7, 2021
  9. Eric SunshineMay 7, 2021
  10. Elijah NewrenMay 8, 2021
  11. Eric SunshineMay 8, 2021
  12. Elijah NewrenMay 8, 2021
  13. Philip OakleyMay 8, 2021
  14. Elijah NewrenMay 8, 2021
  15. 2/5 t3001, t7300: add testcase showcasing missed directory traversalElijah Newren via GitGitGadget, May 7, 2021
  16. 3/5 dir: avoid unnecessary traversal into ignored directoryElijah Newren via GitGitGadget, May 7, 2021
  17. 4/5 dir: traverse into untracked directories if they may have ignored subfilesElijah Newren via GitGitGadget, May 7, 2021
  18. 5/5 [RFC] ls-files: error out on -i unless -o or -c are specifiedElijah Newren via GitGitGadget, May 7, 2021
  19. 6/5 dir: update stale description of treat_directory()Derrick Stolee, May 7, 2021
  20. Elijah NewrenMay 7, 2021
  21. Derrick StoleeMay 7, 2021
  22. 0/8 Directory traversal fixesElijah Newren via GitGitGadget, May 8, 2021
  23. 1/8 t7300: add testcase showing unnecessary traversal into ignored directoryElijah Newren via GitGitGadget, May 8, 2021
  24. Junio C HamanoMay 8, 2021
  25. Elijah NewrenMay 8, 2021
  26. Junio C HamanoMay 8, 2021
  27. Elijah NewrenMay 8, 2021
  28. 3/8 dir: avoid unnecessary traversal into ignored directoryElijah Newren via GitGitGadget, May 8, 2021
  29. 2/8 t3001, t7300: add testcase showcasing missed directory traversalElijah Newren via GitGitGadget, May 8, 2021
  30. 4/8 dir: traverse into untracked directories if they may have ignored subfilesElijah Newren via GitGitGadget, May 8, 2021
  31. 5/8 [RFC] ls-files: error out on -i unless -o or -c are specifiedElijah Newren via GitGitGadget, May 8, 2021
  32. 6/8 dir: update stale description of treat_directory()Derrick Stolee via GitGitGadget, May 8, 2021
  33. 7/8 [RFC] dir: convert trace calls to trace2 equivalentsElijah Newren via GitGitGadget, May 8, 2021
  34. 8/8 [RFC] dir: reported number of visited directories and paths with trace2Elijah Newren via GitGitGadget, May 8, 2021
  35. 0/8 Directory traversal fixesElijah Newren via GitGitGadget, May 8, 2021
  36. 1/8 [RFC] dir: convert trace calls to trace2 equivalentsElijah Newren via GitGitGadget, May 8, 2021
  37. Junio C HamanoMay 10, 2021
  38. Elijah NewrenMay 11, 2021
  39. Jeff HostetlerMay 11, 2021
  40. Elijah NewrenMay 11, 2021
  41. 2/8 [RFC] dir: report number of visited directories and paths with trace2Elijah Newren via GitGitGadget, May 8, 2021
  42. Junio C HamanoMay 10, 2021
  43. 3/8 [RFC] ls-files: error out on -i unless -o or -c are specifiedElijah Newren via GitGitGadget, May 8, 2021
  44. Junio C HamanoMay 10, 2021
  45. Elijah NewrenMay 11, 2021
  46. Junio C HamanoMay 11, 2021
  47. 4/8 t7300: add testcase showing unnecessary traversal into ignored directoryElijah Newren via GitGitGadget, May 8, 2021
  48. Junio C HamanoMay 10, 2021
  49. Elijah NewrenMay 11, 2021
  50. Junio C HamanoMay 11, 2021
  51. Elijah NewrenMay 12, 2021
  52. Junio C HamanoMay 12, 2021
  53. 5/8 t3001, t7300: add testcase showcasing missed directory traversalElijah Newren via GitGitGadget, May 8, 2021
  54. 6/8 dir: avoid unnecessary traversal into ignored directoryElijah Newren via GitGitGadget, May 8, 2021
  55. Junio C HamanoMay 10, 2021
  56. Elijah NewrenMay 11, 2021
  57. 7/8 dir: traverse into untracked directories if they may have ignored subfilesElijah Newren via GitGitGadget, May 8, 2021
  58. 8/8 dir: update stale description of treat_directory()Derrick Stolee via GitGitGadget, May 8, 2021
  59. 0/8 Directory traversal fixesElijah Newren via GitGitGadget, May 11, 2021
  60. 1/8 dir: convert trace calls to trace2 equivalentsElijah Newren via GitGitGadget, May 11, 2021
  61. Jeff HostetlerMay 11, 2021
  62. Elijah NewrenMay 11, 2021
  63. Jeff HostetlerMay 11, 2021
  64. Elijah NewrenMay 12, 2021
  65. Jeff HostetlerMay 12, 2021
  66. Elijah NewrenMay 12, 2021
  67. 3/8 ls-files: error out on -i unless -o or -c are specifiedElijah Newren via GitGitGadget, May 11, 2021
  68. 2/8 dir: report number of visited directories and paths with trace2Elijah Newren via GitGitGadget, May 11, 2021
  69. 4/8 t7300: add testcase showing unnecessary traversal into ignored directoryElijah Newren via GitGitGadget, May 11, 2021
  70. 5/8 t3001, t7300: add testcase showcasing missed directory traversalElijah Newren via GitGitGadget, May 11, 2021
  71. 7/8 dir: traverse into untracked directories if they may have ignored subfilesElijah Newren via GitGitGadget, May 11, 2021
  72. 6/8 dir: avoid unnecessary traversal into ignored directoryElijah Newren via GitGitGadget, May 11, 2021
  73. 8/8 dir: update stale description of treat_directory()Derrick Stolee via GitGitGadget, May 11, 2021
  74. 0/9 Directory traversal fixesElijah Newren via GitGitGadget, May 12, 2021
  75. 1/9 dir: convert trace calls to trace2 equivalentsElijah Newren via GitGitGadget, May 12, 2021
  76. 2/9 dir: report number of visited directories and paths with trace2Elijah Newren via GitGitGadget, May 12, 2021
  77. 4/9 t7300: add testcase showing unnecessary traversal into ignored directoryElijah Newren via GitGitGadget, May 12, 2021
  78. 6/9 dir: avoid unnecessary traversal into ignored directoryElijah Newren via GitGitGadget, May 12, 2021
  79. 8/9 dir: update stale description of treat_directory()Derrick Stolee via GitGitGadget, May 12, 2021
  80. Derrick StoleeMay 17, 2021
  81. Junio C HamanoMay 17, 2021
  82. Elijah NewrenMay 18, 2021
  83. Junio C HamanoMay 19, 2021
  84. 7/9 dir: traverse into untracked directories if they may have ignored subfilesElijah Newren via GitGitGadget, May 12, 2021
  85. 3/9 ls-files: error out on -i unless -o or -c are specifiedElijah Newren via GitGitGadget, May 12, 2021
  86. 5/9 t3001, t7300: add testcase showcasing missed directory traversalElijah Newren via GitGitGadget, May 12, 2021
  87. 9/9 dir: introduce readdir_skip_dot_and_dotdot() helperElijah Newren via GitGitGadget, May 12, 2021
  88. Derrick StoleeMay 17, 2021
  89. Elijah NewrenMay 18, 2021
  90. Derrick StoleeMay 17, 2021

Read the whole thread, see it on lore, or plain text.

$ cat FOOTERMessages come from the public archive at lore.kernel.org/git, fetched every hour. The front page is chosen and written each morning by an AI editor and can be wrong; the threads themselves are the record. About and API. For agents: an MCP server at https://gitlist.dev/mcp, and any thread, story or person page as Markdown by adding .md to its URL (or sending Accept: text/markdown). Details in /llms.txt.