git/list[1] front-page[2] threads[3] people[4] search[5] about
 

Re: [PATCH v2 4/4] apply: do not touch a file beyond a symbolic link

From
Junio C Hamano <gitster@pobox.com>
Date
Feb 3, 2015, 21:01 UTC
Message-ID
<xmqqy4oepv59.fsf@gitster.dls.corp.google.com>
In-Reply-To
<20150203011139.GC31946@peff.net>
Jeff King <peff@peff.net> writes:
> Here's the test addition I came up with, because it didn't look like we
> were covering this case. 
Thanks.
Show 9 quoted lines
> diff --git a/t/t4122-apply-symlink-inside.sh b/t/t4122-apply-symlink-inside.sh
> index 942c5cb..fbba8dd 100755
> --- a/t/t4122-apply-symlink-inside.sh
> +++ b/t/t4122-apply-symlink-inside.sh
> @@ -89,6 +89,7 @@ test_expect_success SYMLINKS 'do not follow symbolic link (setup)' '
>  	rm -fr arch/x86_64/dir &&
>  
>  	cat add_symlink.patch add_file.patch >patch &&
> +	cat add_symlink.patch del_file.patch >tricky_del &&
This new patch
 (1) creates a symlink arch/x86_64/dir pointing at ../i386/dir
 (2) deletes arch/x86_64/dir/file

It can be a valid patch to be applied to a tree where arch/x86_64/dir/file is in the index (either as a regular file, a symlink, or even a submodule) and nothing else is in arch/x86_64/dir directory.

Show 7 quoted lines
> @@ -112,6 +113,20 @@ test_expect_success SYMLINKS 'do not follow symbolic link (same input)' '
>  	test_i18ngrep "beyond a symbolic link" error-ct &&
>  	test_must_fail git ls-files --error-unmatch arch/x86_64/dir &&
>  	test_must_fail git ls-files --error-unmatch arch/i386/dir
> +
> +	>arch/i386/dir/file &&
> +	git add arch/i386/dir/file &&
At this point, the target of the patch application has:
	arch/i386/boot/Makefile
	arch/i386/dir/file
	arch/x86_64/boot/Makefile

all of which are regular files. The index and the working tree match.

> +	test_must_fail git apply tricky_del &&

The reason why this does not apply has nothing to do with the topic of this series, I think. It wants to delete arch/x86_64/dir/file, which does not exist in the target, and the patch is rejected.

It is a good test to make sure that we do not "incrementally" apply and get fooled by arch/x86_64/dir that will become a symbolic link, making arch/x86_64/dir/file to appear as arch/i386/dir/file that does exist in the preimage.

> +	test_path_is_file arch/i386/dir/file &&

When we reject the entire patch, we do so without touching the outside world, of course ;-), which is good.

Show 9 quoted lines
> +	test_must_fail git apply --index tricky_del &&
> +	test_path_is_file arch/i386/dir/file &&
> +	test_must_fail git ls-files --error-unmatch arch/x86_64/dir &&
> +	git ls-files --error-unmatch arch/i386/dir &&
> +
> +	test_must_fail git apply --cached tricky_del &&
> +	test_must_fail git ls-files --error-unmatch arch/x86_64/dir &&
> +	git ls-files --error-unmatch arch/i386/dir
>  '

In both of the above, "git apply" rejects its input for the same reason. The file it wants to remove does not exist in the target.

Show 6 quoted lines
>  test_expect_success SYMLINKS 'do not follow symbolic link (existing)' '
> @@ -125,6 +140,7 @@ test_expect_success SYMLINKS 'do not follow symbolic link (existing)' '
>  	test_i18ngrep "beyond a symbolic link" error-wt-add &&
>  	test_path_is_missing arch/i386/dir/file &&
>  
> +	mkdir arch/i386/dir &&
Thanks for spotting this one ;-)
>  	>arch/i386/dir/file &&
>  	test_must_fail git apply del_file.patch 2>error-wt-del &&

del_file.patch wants to remove arch/x86_64/dir/file, and arch/x86_64/dir is a symbolic link to ../i386/dir in the target at this point, so it is trying to delete beyond the symbolic link, which gets rejected by this series. Good.

>  	test_i18ngrep "beyond a symbolic link" error-wt-del &&
Previous: Jeff KingNext: Eric Sunshine
Message 23 of 34 in “"git apply" safety”
  1. 0/4 "git apply" safetyJunio C Hamano, Feb 2, 2015
  2. 1/4 apply: reject input that touches outside $cwdJunio C Hamano, Feb 2, 2015
  3. Jeff KingFeb 3, 2015
  4. Jeff KingFeb 3, 2015
  5. Junio C HamanoFeb 3, 2015
  6. Jeff KingFeb 3, 2015
  7. Junio C HamanoFeb 3, 2015
  8. Jeff KingFeb 3, 2015
  9. Junio C HamanoFeb 3, 2015
  10. Jeff KingFeb 3, 2015
  11. Junio C HamanoFeb 3, 2015
  12. Torsten BögershausenFeb 3, 2015
  13. 2/4 apply: do not read from the filesystem under --indexJunio C Hamano, Feb 2, 2015
  14. 3/4 apply: do not read from beyond a symbolic linkJunio C Hamano, Feb 2, 2015
  15. Stefan BellerFeb 3, 2015
  16. Junio C HamanoFeb 3, 2015
  17. Stefan BellerFeb 3, 2015
  18. Junio C HamanoFeb 3, 2015
  19. 4/4 apply: do not touch a file beyond a symbolic linkJunio C Hamano, Feb 2, 2015
  20. Jeff KingFeb 3, 2015
  21. Junio C HamanoFeb 3, 2015
  22. Jeff KingFeb 3, 2015
  23. Junio C HamanoFeb 3, 2015
  24. Eric SunshineFeb 3, 2015
  25. 0/4 "git apply" safetyJunio C Hamano, Feb 4, 2015
  26. 1/4 apply: reject input that touches outside the working areaJunio C Hamano, Feb 4, 2015
  27. 2/4 apply: do not read from the filesystem under --indexJunio C Hamano, Feb 4, 2015
  28. 3/4 apply: do not read from beyond a symbolic linkJunio C Hamano, Feb 4, 2015
  29. 4/4 apply: do not touch a file beyond a symbolic linkJunio C Hamano, Feb 4, 2015
  30. 0/4 "git apply" safetyJunio C Hamano, Feb 10, 2015
  31. 1/4 apply: reject input that touches outside the working areaJunio C Hamano, Feb 10, 2015
  32. 2/4 apply: do not read from the filesystem under --indexJunio C Hamano, Feb 10, 2015
  33. 3/4 apply: do not read from beyond a symbolic linkJunio C Hamano, Feb 10, 2015
  34. 4/4 apply: do not touch a file beyond a symbolic linkJunio C Hamano, Feb 10, 2015

Read the whole thread, see it on lore, or plain text.

$ cat FOOTERMessages come from the public archive at lore.kernel.org/git, fetched every hour. The front page is chosen and written each morning by an AI editor and can be wrong; the threads themselves are the record. About and API. For agents: an MCP server at https://gitlist.dev/mcp, and any thread, story or person page as Markdown by adding .md to its URL (or sending Accept: text/markdown). Details in /llms.txt.