git/list[1] front-page[2] threads[3] people[4] search[5] about
 

Re: [PATCH] fast-import: disallow more path components

From
Junio C Hamano <gitster@pobox.com>
Date
Nov 28, 2024, 00:22 UTC
Message-ID
<xmqqldx4qkaf.fsf@gitster.g>
In-Reply-To
<pull.1832.git.1732740464398.gitgitgadget@gmail.com>
"Elijah Newren via GitGitGadget" <gitgitgadget@gmail.com> writes:
Show 30 quoted lines
> From: Elijah Newren <newren@gmail.com>
>
> Instead of just disallowing '.' and '..', make use of verify_path() to
> ensure that fast-import will disallow anything we wouldn't allow into
> the index, such as anything under .git/, .gitmodules as a symlink, or
> a dos drive prefix on Windows.
>
> Since a few fast-export and fast-import tests that tried to stress-test
> the correct handling of quoting relied on filenames that fail
> is_valid_win32_path(), such as spaces or periods at the end of filenames
> or backslashes within the filename, turn off core.protectNTFS for those
> tests to ensure they keep passing.
>
> Signed-off-by: Elijah Newren <newren@gmail.com>
> ---
>     Disallow verify_path() failures from fast-import
>     
>     Since en/fast-import-path-sanitize has already made it to next, this
>     commit is based on that. (See
>     https://lore.kernel.org/git/pull.1831.v2.git.1732561248717.gitgitgadget@gmail.com/
>     for discussion of that series.)
>     
>     Changes relative to that commit: this fixes up the error message as
>     suggested by Kristoffer, and makes the checks more encompassing as
>     suggested by Patrick and Peff -- in particular, using verify_path() as
>     suggested by Peff.
>
> Published-As: https://github.com/gitgitgadget/git/releases/tag/pr-1832%2Fnewren%2Fdisallow-verify-path-fast-import-v1
> Fetch-It-Via: git fetch https://github.com/gitgitgadget/git pr-1832/newren/disallow-verify-path-fast-import-v1
> Pull-Request: https://github.com/gitgitgadget/git/pull/1832
Thanks, all.  Looking good to me.
Will queue.
Previous: Elijah Newren via GitGitGadgetNext: Jeff King
Message 2 of 11 in “fast-import: disallow more path components”
  1. fast-import: disallow more path componentsElijah Newren via GitGitGadget, Nov 27, 2024
  2. Junio C HamanoNov 28, 2024
  3. Jeff KingNov 28, 2024
  4. fast-import: disallow more path componentsElijah Newren via GitGitGadget, Nov 30, 2024
  5. Jeff KingDec 1, 2024
  6. Elijah NewrenDec 3, 2024
  7. 2/1 t9300: test verification of renamed pathsJeff King, Dec 3, 2024
  8. Elijah NewrenDec 3, 2024
  9. Junio C HamanoDec 4, 2024
  10. Junio C HamanoDec 3, 2024
  11. Junio C HamanoDec 2, 2024

Read the whole thread, see it on lore, or plain text.

$ cat FOOTERMessages come from the public archive at lore.kernel.org/git, fetched every hour. The front page is chosen and written each morning by an AI editor and can be wrong; the threads themselves are the record. About and API. For agents: an MCP server at https://gitlist.dev/mcp, and any thread, story or person page as Markdown by adding .md to its URL (or sending Accept: text/markdown). Details in /llms.txt.