git/list[1] front-page[2] threads[3] people[4] search[5] about
 

Re: [PATCH v2 0/4] Strengthen fsck checks for submodule URLs

From
Junio C Hamano <gitster@pobox.com>
Date
Jan 18, 2024, 18:24 UTC
Message-ID
<xmqqmst2sdn0.fsf@gitster.g>
In-Reply-To
<pull.1635.v2.git.1705542918.gitgitgadget@gmail.com>
"Victoria Dye via GitGitGadget" <gitgitgadget@gmail.com> writes:
Show 23 quoted lines
> While testing 'git fsck' checks on .gitmodules URLs, I noticed that some
> invalid URLs were passing the checks. Digging into it a bit more, the issue
> turned out to be that 'credential_from_url_gently()' parses certain URLs
> (like "http://example.com:something/deeper/path") incorrectly, in a way that
> appeared to return a valid result.
>
> Fortunately, these URLs are rejected in fetches/clones/pushes anyway because
> 'url_normalize()' (called in 'validate_remote_url()') correctly identifies
> them as invalid. So, to bring 'git fsck' in line with other (stronger)
> validation done on remote URLs, this series replaces the
> 'credential_from_url_gently()' check with one that uses 'url_normalize()'.
>
>  * Patch 1 moves 'check_submodule_url()' to a public location so that it can
>    be used outside of 'fsck.c'.
>  * Patch 2 removes the obsolete/never-used code in 'test-tool submodule
>    check-name' handling names provided on the command line.
>  * Patch 3 adds a 'check-url' mode to 'test-tool submodule', calling the
>    now-public 'check_submodule_url()' method on a given URL, and adds new
>    tests checking valid and invalid submodule URLs.
>  * Patch 4 replaces the 'credential_from_url_gently()' check with
>    'url_normalize()' followed by 'url_decode()' and an explicit check for
>    newlines (to preserve the newline handling added in 07259e74ec1 (fsck:
>    detect gitmodules URLs with embedded newlines, 2020-03-11)).

Nicely done. I'll wait for a few days to see if anybody else has reaction but after reading the patches myself, my inclination is to suggest merging it to 'next'.

Thanks.
Previous: Victoria Dye via GitGitGadgetNext: Jeff King
Message 30 of 31 in “Strengthen fsck checks for submodule URLs”
  1. 0/3 Strengthen fsck checks for submodule URLsVictoria Dye via GitGitGadget, Jan 9, 2024
  2. 1/3 submodule-config.h: move check_submodule_urlVictoria Dye via GitGitGadget, Jan 9, 2024
  3. 2/3 t7450: test submodule urlsVictoria Dye via GitGitGadget, Jan 9, 2024
  4. Junio C HamanoJan 9, 2024
  5. Victoria DyeJan 11, 2024
  6. Jeff KingJan 10, 2024
  7. Victoria DyeJan 11, 2024
  8. Jeff KingJan 12, 2024
  9. 3/3 submodule-config.c: strengthen URL fsck checkVictoria Dye via GitGitGadget, Jan 9, 2024
  10. Junio C HamanoJan 9, 2024
  11. Patrick SteinhardtJan 10, 2024
  12. Victoria DyeJan 17, 2024
  13. Jeff KingJan 10, 2024
  14. Neil MayhewNov 13, 2024
  15. Neil MayhewNov 13, 2024
  16. Junio C HamanoNov 13, 2024
  17. Jeff KingNov 14, 2024
  18. Neil MayhewNov 14, 2024
  19. Junio C HamanoNov 14, 2024
  20. Neil MayhewNov 14, 2024
  21. Neil MayhewNov 14, 2024
  22. 0/4 Strengthen fsck checks for submodule URLsVictoria Dye via GitGitGadget, Jan 18, 2024
  23. 1/4 submodule-config.h: move check_submodule_urlVictoria Dye via GitGitGadget, Jan 18, 2024
  24. 2/4 test-submodule: remove command line handling for check-nameVictoria Dye via GitGitGadget, Jan 18, 2024
  25. Junio C HamanoJan 18, 2024
  26. 3/4 t7450: test submodule urlsVictoria Dye via GitGitGadget, Jan 18, 2024
  27. Patrick SteinhardtJan 19, 2024
  28. Junio C HamanoJan 19, 2024
  29. 4/4 submodule-config.c: strengthen URL fsck checkVictoria Dye via GitGitGadget, Jan 18, 2024
  30. Junio C HamanoJan 18, 2024
  31. Jeff KingJan 20, 2024

Read the whole thread, see it on lore, or plain text.

$ cat FOOTERMessages come from the public archive at lore.kernel.org/git, fetched every hour. The front page is chosen and written each morning by an AI editor and can be wrong; the threads themselves are the record. About and API. For agents: an MCP server at https://gitlist.dev/mcp, and any thread, story or person page as Markdown by adding .md to its URL (or sending Accept: text/markdown). Details in /llms.txt.