# [PATCH] receive-pack: reject invalid refnames 2 messages from 2008-01-02 to 2008-01-03. Participants: Martin Koegler, Junio C Hamano. Thread: https://gitlist.dev/t/11454 ## Martin Koegler, 2008-01-02 21:52 Subject: [PATCH] receive-pack: reject invalid refnames Message-ID: <1199310726946-git-send-email-mkoegler@auto.tuwien.ac.at> URL: https://gitlist.dev/e/1199310726946-git-send-email-mkoegler%40auto.tuwien.ac.at ``` Signed-off-by: Martin Koegler --- receive-pack.c | 7 +++++-- 1 files changed, 5 insertions(+), 2 deletions(-) diff --git a/receive-pack.c b/receive-pack.c index d0a563d..a038a40 100644 --- a/receive-pack.c +++ b/receive-pack.c @@ -165,7 +165,9 @@ static const char *update(struct command *cmd) unsigned char *new_sha1 = cmd->new_sha1; struct ref_lock *lock; - if (!prefixcmp(name, "refs/") && check_ref_format(name + 5)) { + /* only HEAD and refs/... are allowed */ + if (strcmp(name, "HEAD") && + (prefixcmp(name, "refs/") || check_ref_format(name + 5))) { error("refusing to create funny ref '%s' remotely", name); return "funny refname"; } @@ -177,7 +179,8 @@ static const char *update(struct command *cmd) } if (deny_non_fast_forwards && !is_null_sha1(new_sha1) && !is_null_sha1(old_sha1) && - !prefixcmp(name, "refs/heads/")) { + (!prefixcmp(name, "refs/heads/") || + !strcmp(name, "HEAD"))) { struct object *old_object, *new_object; struct commit *old_commit, *new_commit; struct commit_list *bases, *ent; -- 1.4.4.4 ``` ## Junio C Hamano, 2008-01-03 21:40 Subject: Re: [PATCH] receive-pack: reject invalid refnames Message-ID: <7vy7b6oafc.fsf@gitster.siamese.dyndns.org> URL: https://gitlist.dev/e/7vy7b6oafc.fsf%40gitster.siamese.dyndns.org In-Reply-To: <1199310726946-git-send-email-mkoegler@auto.tuwien.ac.at> ``` Martin Koegler writes: > Signed-off-by: Martin Koegler > --- > receive-pack.c | 7 +++++-- > 1 files changed, 5 insertions(+), 2 deletions(-) > > diff --git a/receive-pack.c b/receive-pack.c > index d0a563d..a038a40 100644 > --- a/receive-pack.c > +++ b/receive-pack.c > @@ -165,7 +165,9 @@ static const char *update(struct command *cmd) > unsigned char *new_sha1 = cmd->new_sha1; > struct ref_lock *lock; > > - if (!prefixcmp(name, "refs/") && check_ref_format(name + 5)) { > + /* only HEAD and refs/... are allowed */ > + if (strcmp(name, "HEAD") && > + (prefixcmp(name, "refs/") || check_ref_format(name + 5))) { > error("refusing to create funny ref '%s' remotely", name); > return "funny refname"; > } > @@ -177,7 +179,8 @@ static const char *update(struct command *cmd) > } > if (deny_non_fast_forwards && !is_null_sha1(new_sha1) && > !is_null_sha1(old_sha1) && > - !prefixcmp(name, "refs/heads/")) { > + (!prefixcmp(name, "refs/heads/") || > + !strcmp(name, "HEAD"))) { > struct object *old_object, *new_object; > struct commit *old_commit, *new_commit; > struct commit_list *bases, *ent; Yuck. What I was smoking. Normal client "git push" does not even allow "git push victim foo:HEAD". So if name is "HEAD" that has to be a malicious crafted push. I think if (prefixcmp(name, "refs/") || check_ref_format(name + 5)) error(); is enough and correct. Sorry for my earlier thinko. ```