threads / patch / 35035

patchclone: tighten "local paths with colons" check a bit

Subject: [PATCH] clone: tighten "local paths with colons" check a bit

## tl;dr

4 messages between Sep 27, 2013 and Sep 28, 2013. Diffs are folded; open one to read it.

replies: 3people: 4as markdown or json

Nguyễn Thái Ngọc Duy· Sep 27, 2013, 13:48 UTC · lore

commit 6000334 (clone: allow cloning local paths with colons in them - 2013-05-04) is added to make it possible to specify a path that has colons in it without file://, e.g. ../foo:bar/somewhere. But the check is a bit loose.

Consider the url '[foo]:bar', the '[]' unwrapping code will turn the string to 'foo\0:bar'. The effect of this new string is the same as 'foo/:bar' to the expression "path < strchrnul(host, '/')", which mistakes it as a sign of local paths while it's actually not.

Make sure we only check so when no protocol is specified and the url is not started with '['.

Noticed-by: Morten Stenshorne <mstensho@opera.com>
Signed-off-by: Nguyễn Thái Ngọc Duy <pclouds@gmail.com>
---
 I wanted to add a test then realized there were no ssh tests in the
 test suite. So laziness won :p

 connect.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

Show changes to connect.c +1 −1

diff --git a/connect.c b/connect.c
index a0783d4..303f850 100644
--- a/connect.c
+++ b/connect.c
@@ -551,7 +551,7 @@ struct child_process *git_connect(int fd[2], const char *url_orig,
 	path = strchr(end, c);
 	if (path && !has_dos_drive_prefix(end)) {
 		if (c == ':') {
-			if (path < strchrnul(host, '/')) {
+			if (host != url || path < strchrnul(host, '/')) {
 				protocol = PROTO_SSH;
 				*path++ = '\0';
 			} else /* '/' in the host part, assume local path */

-- 
1.8.2.83.gc99314b

Jeff King· Sep 27, 2013, 18:56 UTC · re: Nguyễn Thái Ngọc Duy · lore

Re: [PATCH] clone: tighten "local paths with colons" check a bit

On Fri, Sep 27, 2013 at 08:48:13PM +0700, Nguyen Thai Ngoc Duy wrote:

> ---
>  I wanted to add a test then realized there were no ssh tests in the
>  test suite. So laziness won :p

There is one in t5602, but it's not very reusable. How about squashing in the patch below, which does a basic ssh-works test, and confirms your fix?

---

Show changes to t/t5601-clone.sh +45 −1

diff --git a/t/t5601-clone.sh b/t/t5601-clone.sh
index 0629149..a3e3d48 100755
--- a/t/t5601-clone.sh
+++ b/t/t5601-clone.sh
@@ -280,9 +280,53 @@ test_expect_success NOT_MINGW,NOT_CYGWIN 'clone local path foo:bar' '
 	test_cmp fetch.expected fetch.actual
 '
 
+test_expect_success 'setup ssh wrapper' '
+	write_script "$TRASH_DIRECTORY/ssh-wrapper" <<-\EOF &&
+	echo >>"$TRASH_DIRECTORY/ssh-output" "ssh: $*" &&
+	# throw away all but the last argument, which should be the
+	# command
+	while test $# -gt 1; do shift; done
+	eval "$1"
+	EOF
+
+	GIT_SSH="$TRASH_DIRECTORY/ssh-wrapper" &&
+	export GIT_SSH &&
+	export TRASH_DIRECTORY
+'
+
+clear_ssh () {
+	>"$TRASH_DIRECTORY/ssh-output"
+}
+
+expect_ssh () {
+	{
+		case "$1" in
+		none)
+			;;
+		*)
+			echo "ssh: $1 git-upload-pack '$2'"
+		esac
+	} >"$TRASH_DIRECTORY/ssh-expect" &&
+	(cd "$TRASH_DIRECTORY" && test_cmp ssh-expect ssh-output)
+}
+
+test_expect_success 'cloning myhost:src uses ssh' '
+	clear_ssh &&
+	git clone myhost:src ssh-clone &&
+	expect_ssh myhost src
+'
+
 test_expect_success NOT_MINGW,NOT_CYGWIN 'clone local path foo:bar' '
+	clear_ssh &&
 	cp -R src "foo:bar" &&
-	git clone "./foo:bar" foobar
+	git clone "./foo:bar" foobar &&
+	expect_ssh none
+'
+
+test_expect_success 'bracketed hostnames are still ssh' '
+	clear_ssh &&
+	git clone "[myhost:123]:src" ssh-bracket-clone &&
+	expect_ssh myhost:123 src
 '
 
 test_done

Jonathan Nieder· Sep 27, 2013, 21:56 UTC · re: Nguyễn Thái Ngọc Duy · lore

Re: [PATCH] clone: tighten "local paths with colons" check a bit

Nguyễn Thái Ngọc Duy wrote:

> commit 6000334 (clone: allow cloning local paths with colons in them -
> 2013-05-04) is added to make it possible to specify a path that has
> colons in it without file://, e.g. ../foo:bar/somewhere. But the check
> is a bit loose.

[...]

> Make sure we only check so when no protocol is specified and the url
> is not started with '['.

More precisely, this disables the "'/' before ':'" check when the url has been mangled by '[]' unwrapping (which only happens if the URL starts with '[' and contains an ']' at some point later).

If I try to clone "[foo]bar/baz:qux", after this change it will act as though I specified the remote repository "foo:qux" instead of the local repository "./foo:qux" as before this change. Both are wrong --- that's a bug for another day.

Thanks, both.

Torsten Bögershausen· Sep 28, 2013, 13:14 UTC · re: Jonathan Nieder · lore

Re: [PATCH] clone: tighten "local paths with colons" check a bit

On 2013-09-27 23.56, Jonathan Nieder wrote:

Show 18 quoted lines

> Nguyễn Thái Ngọc Duy wrote:
> 
>> commit 6000334 (clone: allow cloning local paths with colons in them -
>> 2013-05-04) is added to make it possible to specify a path that has
>> colons in it without file://, e.g. ../foo:bar/somewhere. But the check
>> is a bit loose.
> [...]
>> Make sure we only check so when no protocol is specified and the url
>> is not started with '['.
> 
> More precisely, this disables the "'/' before ':'" check when the
> url has been mangled by '[]' unwrapping (which only happens if the
> URL starts with '[' and contains an ']' at some point later).
> 
> If I try to clone "[foo]bar/baz:qux", after this change it will act as
> though I specified the remote repository "foo:qux" instead of the local
> repository "./foo:qux" as before this change.  Both are wrong ---
> that's a bug for another day.

(Loud thinking) Could it make sense to disable the SSH autodection logic whenever the url starts with '.' (like in "../XX.git") or with "/" like in /home/USER/projects/XX.git ?

Show changes to connect.c +2 −1

diff --git a/connect.c b/connect.c
index a80ebd3..b382032 100644
--- a/connect.c
+++ b/connect.c
@@ -550,7 +550,8 @@ struct child_process *git_connect(int fd[2], const char *url_orig,
                end = host;
 
        path = strchr(end, c);
-       if (path && !has_dos_drive_prefix(end)) {
+       if (path && !has_dos_drive_prefix(end) &&
+           url[0] != '/' && url[0] != '.' ) {
                if (c == ':') {
                        if (path < strchrnul(host, '/')) {
                                protocol = PROTO_SSH;