# [PATCH] modify the “foo" file path to "$PWD/bad-clone/sub/foo". 8 messages from 2025-07-30 to 2025-08-01. Participants: 陈建虎 via GitGitGadget, Kristoffer Haugsbakk, Junio C Hamano, Justin Tobler, chenjianhu via GitGitGadget. Thread: https://gitlist.dev/t/63877 ## 陈建虎 via GitGitGadget, 2025-07-30 07:25 Subject: [PATCH] modify the “foo" file path to "$PWD/bad-clone/sub/foo". Message-ID: URL: https://gitlist.dev/e/pull.2022.git.git.1753860300588.gitgitgadget%40gmail.com ``` From: =?UTF-8?q?=E9=99=88=E5=BB=BA=E8=99=8E?= In the t7450-bad-git-dotfiles.sh, when post-checkout is executed, the actual path where the foo file is created should be "$PWD/bad-clone/sub/foo". Signed-off-by: chenjianhu --- modify the “foo" file path to "$PWD/bad-clone/sub/foo". Published-As: https://github.com/gitgitgadget/git/releases/tag/pr-git-2022%2Fcjhxmx%2Fcjhxmx-git-test-v1 Fetch-It-Via: git fetch https://github.com/gitgitgadget/git pr-git-2022/cjhxmx/cjhxmx-git-test-v1 Pull-Request: https://github.com/git/git/pull/2022 t/t7450-bad-git-dotfiles.sh | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/t/t7450-bad-git-dotfiles.sh b/t/t7450-bad-git-dotfiles.sh index 14b5743b962..f512eed278c 100755 --- a/t/t7450-bad-git-dotfiles.sh +++ b/t/t7450-bad-git-dotfiles.sh @@ -401,7 +401,7 @@ test_expect_success SYMLINKS,!WINDOWS,!MINGW 'submodule must not checkout into d git -C repo commit -m submodule && git -c protocol.file.allow=always clone --recurse-submodules repo bad-clone && - ! test -f "$PWD/foo" && + ! test -f "$PWD/bad-clone/sub/foo" && test -f $(printf "bad-clone/sub\r/post-checkout") ' base-commit: e813a0200a7121b97fec535f0d0b460b0a33356c -- gitgitgadget ``` ## Kristoffer Haugsbakk, 2025-07-30 07:38 Subject: Re: [PATCH] modify the “foo" file path to "$PWD/bad-clone/sub/foo". Message-ID: <096f8beb-8156-49da-b905-3615bb6116c8@app.fastmail.com> URL: https://gitlist.dev/e/096f8beb-8156-49da-b905-3615bb6116c8%40app.fastmail.com In-Reply-To: ``` On Wed, Jul 30, 2025, at 09:25, On Wed, Jul 30, 2025, at 09:25, 陈建虎 via GitGitGadget wrote: > From: =?UTF-8?q?=E9=99=88=E5=BB=BA=E8=99=8E?= > ... > Signed-off-by: chenjianhu The author name and signoff name should match. Either “陈建虎” or the (I’m guessing) romanization “chenjianhu” for both. -- Kristoffer Haugsbakk ``` ## Junio C Hamano, 2025-07-30 15:09 Subject: Re: [PATCH] modify the “foo" file path to "$PWD/bad-clone/sub/foo". Message-ID: URL: https://gitlist.dev/e/xmqqfredn2b2.fsf%40gitster.g In-Reply-To: <096f8beb-8156-49da-b905-3615bb6116c8@app.fastmail.com> ``` "Kristoffer Haugsbakk" writes: > On Wed, Jul 30, 2025, at 09:25, On Wed, Jul 30, 2025, at 09:25, 陈建虎 via GitGitGadget wrote: >> From: =?UTF-8?q?=E9=99=88=E5=BB=BA=E8=99=8E?= >> ... >> Signed-off-by: chenjianhu > > The author name and signoff name should match. Either “陈建虎” or the > (I’m guessing) romanization “chenjianhu” for both. Yup, either is fine but it would be nicer to non-east-asian friends to use the Anglicized form. The title is what needs more polish than the name though. ``` ## Junio C Hamano, 2025-07-30 15:47 Subject: Re: [PATCH] modify the “foo" file path to "$PWD/bad-clone/sub/foo". Message-ID: URL: https://gitlist.dev/e/xmqq5xf9n0jf.fsf%40gitster.g In-Reply-To: ``` "陈建虎 via GitGitGadget" writes: > From: =?UTF-8?q?=E9=99=88=E5=BB=BA=E8=99=8E?= > > In the t7450-bad-git-dotfiles.sh, when post-checkout > is executed, the actual path where the foo file > is created should be "$PWD/bad-clone/sub/foo". "is created" is a bit iffy thing to say, as the test actually expects the path _not_ to exist. Also, pay special attention to what you say on your Subject: line. Can I tell what area the change touches by only looking at the Subject: line, especially when it is mixed with dozens of other patch e-mails? is the question any author of a patch e-mail should be asking. $ git log --no-merges --format=%s -100 | sort may give us some inspirations. For this one, perhaps I would have written Subject: t7450: inspect the correct path a broken code would write to Prior to 05e9cd64 (config: quote values containing CR character, 2025-05-19), a repository can trick "clone --recurse-submodules" into running a post-checkout hook shipped with the project. The test was written to make sure the trick would no longer run the hook with the fix in the commit. However, the test did not check for the path the hook would create; correct the path to the expected one if the bug were still with us. or something like that. Justin, who wrote the test originally, Cc'ed for comments. Thanks. > diff --git a/t/t7450-bad-git-dotfiles.sh b/t/t7450-bad-git-dotfiles.sh > index 14b5743b962..f512eed278c 100755 > --- a/t/t7450-bad-git-dotfiles.sh > +++ b/t/t7450-bad-git-dotfiles.sh > @@ -401,7 +401,7 @@ test_expect_success SYMLINKS,!WINDOWS,!MINGW 'submodule must not checkout into d > git -C repo commit -m submodule && > > git -c protocol.file.allow=always clone --recurse-submodules repo bad-clone && > - ! test -f "$PWD/foo" && > + ! test -f "$PWD/bad-clone/sub/foo" && > test -f $(printf "bad-clone/sub\r/post-checkout") > ' ``` ## Justin Tobler, 2025-07-30 18:08 Subject: Re: [PATCH] modify the “foo" file path to "$PWD/bad-clone/sub/foo". Message-ID: URL: https://gitlist.dev/e/r3q4uyx6725ryuxnvnpidyaglptytro25pw4l53tg4vypkdruh%40fmsgo5c6r4qd In-Reply-To: ``` On 25/07/30 08:47AM, Junio C Hamano wrote: > "陈建虎 via GitGitGadget" writes: > > From: =?UTF-8?q?=E9=99=88=E5=BB=BA=E8=99=8E?= > > Justin, who wrote the test originally, Cc'ed for comments. > > > diff --git a/t/t7450-bad-git-dotfiles.sh b/t/t7450-bad-git-dotfiles.sh > > index 14b5743b962..f512eed278c 100755 > > --- a/t/t7450-bad-git-dotfiles.sh > > +++ b/t/t7450-bad-git-dotfiles.sh > > @@ -401,7 +401,7 @@ test_expect_success SYMLINKS,!WINDOWS,!MINGW 'submodule must not checkout into d > > git -C repo commit -m submodule && > > > > git -c protocol.file.allow=always clone --recurse-submodules repo bad-clone && > > - ! test -f "$PWD/foo" && > > + ! test -f "$PWD/bad-clone/sub/foo" && This assertion is supposed to validate that the post-checkout hook did not execute. The path here is incorrect indeed. I've tested the fix here and it works as expected. Thanks > > test -f $(printf "bad-clone/sub\r/post-checkout") The second assertion here still demonstrates that a file was not checked out into an arbitrary location, which is the root of the problem, and likely why I missed this. Apologies. -Justin ``` ## chenjianhu via GitGitGadget, 2025-07-31 03:49 Subject: [PATCH v2] t7450: inspect the correct path a broken code would write to Message-ID: URL: https://gitlist.dev/e/pull.2022.v2.git.git.1753933780883.gitgitgadget%40gmail.com In-Reply-To: ``` From: chenjianhu Prior to 05e9cd64 (config: quote values containing CR character, 2025-05-19), a repository can trick "clone --recurse-submodules" into running a post-checkout hook shipped with the project. The test was written to make sure the trick would no longer run the hook with the fix in the commit. However, the test did not check for the path the hook would create; correct the path to the expected one if the bug were still with us. Signed-off-by: chenjianhu --- modify the “foo" file path to "$PWD/bad-clone/sub/foo". cc: "Kristoffer Haugsbakk" kristofferhaugsbakk@fastmail.com cc: Justin Tobler jltobler@gmail.com Published-As: https://github.com/gitgitgadget/git/releases/tag/pr-git-2022%2Fcjhxmx%2Fcjhxmx-git-test-v2 Fetch-It-Via: git fetch https://github.com/gitgitgadget/git pr-git-2022/cjhxmx/cjhxmx-git-test-v2 Pull-Request: https://github.com/git/git/pull/2022 Range-diff vs v1: 1: c2d1d8fe884 ! 1: 6434587a075 modify the “foo" file path to "$PWD/bad-clone/sub/foo". @@ ## Metadata ## -Author: 陈建虎 +Author: chenjianhu ## Commit message ## - modify the “foo" file path to "$PWD/bad-clone/sub/foo". + t7450: inspect the correct path a broken code would write to - In the t7450-bad-git-dotfiles.sh, when post-checkout - is executed, the actual path where the foo file - is created should be "$PWD/bad-clone/sub/foo". + Prior to 05e9cd64 (config: quote values containing CR character, + 2025-05-19), a repository can trick "clone --recurse-submodules" + into running a post-checkout hook shipped with the project. The + test was written to make sure the trick would no longer run the + hook with the fix in the commit. + + However, the test did not check for the path the hook would + create; correct the path to the expected one if the bug were + still with us. Signed-off-by: chenjianhu t/t7450-bad-git-dotfiles.sh | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/t/t7450-bad-git-dotfiles.sh b/t/t7450-bad-git-dotfiles.sh index 14b5743b962..f512eed278c 100755 --- a/t/t7450-bad-git-dotfiles.sh +++ b/t/t7450-bad-git-dotfiles.sh @@ -401,7 +401,7 @@ test_expect_success SYMLINKS,!WINDOWS,!MINGW 'submodule must not checkout into d git -C repo commit -m submodule && git -c protocol.file.allow=always clone --recurse-submodules repo bad-clone && - ! test -f "$PWD/foo" && + ! test -f "$PWD/bad-clone/sub/foo" && test -f $(printf "bad-clone/sub\r/post-checkout") ' base-commit: e813a0200a7121b97fec535f0d0b460b0a33356c -- gitgitgadget ``` ## Junio C Hamano, 2025-07-31 18:45 Subject: Re: [PATCH v2] t7450: inspect the correct path a broken code would write to Message-ID: URL: https://gitlist.dev/e/xmqqtt2sqjw6.fsf%40gitster.g In-Reply-To: ``` "chenjianhu via GitGitGadget" writes: Somehow Justin and Kristoffer are missing from the Cc list. > From: chenjianhu > > Prior to 05e9cd64 (config: quote values containing CR character, > 2025-05-19), a repository can trick "clone --recurse-submodules" > into running a post-checkout hook shipped with the project. The > test was written to make sure the trick would no longer run the > hook with the fix in the commit. > > However, the test did not check for the path the hook would > create; correct the path to the expected one if the bug were > still with us. > > Signed-off-by: chenjianhu > --- > modify the “foo" file path to "$PWD/bad-clone/sub/foo". > > cc: "Kristoffer Haugsbakk" kristofferhaugsbakk@fastmail.com cc: Justin > Tobler jltobler@gmail.com > > Published-As: https://github.com/gitgitgadget/git/releases/tag/pr-git-2022%2Fcjhxmx%2Fcjhxmx-git-test-v2 > Fetch-It-Via: git fetch https://github.com/gitgitgadget/git pr-git-2022/cjhxmx/cjhxmx-git-test-v2 > Pull-Request: https://github.com/git/git/pull/2022 > > Range-diff vs v1: > > 1: c2d1d8fe884 ! 1: 6434587a075 modify the “foo" file path to "$PWD/bad-clone/sub/foo". > @@ > ## Metadata ## > -Author: 陈建虎 > +Author: chenjianhu > > ## Commit message ## > - modify the “foo" file path to "$PWD/bad-clone/sub/foo". > + t7450: inspect the correct path a broken code would write to > > - In the t7450-bad-git-dotfiles.sh, when post-checkout > - is executed, the actual path where the foo file > - is created should be "$PWD/bad-clone/sub/foo". > + Prior to 05e9cd64 (config: quote values containing CR character, > + 2025-05-19), a repository can trick "clone --recurse-submodules" > + into running a post-checkout hook shipped with the project. The > + test was written to make sure the trick would no longer run the > + hook with the fix in the commit. > + > + However, the test did not check for the path the hook would > + create; correct the path to the expected one if the bug were > + still with us. > > Signed-off-by: chenjianhu > > > > t/t7450-bad-git-dotfiles.sh | 2 +- > 1 file changed, 1 insertion(+), 1 deletion(-) > > diff --git a/t/t7450-bad-git-dotfiles.sh b/t/t7450-bad-git-dotfiles.sh > index 14b5743b962..f512eed278c 100755 > --- a/t/t7450-bad-git-dotfiles.sh > +++ b/t/t7450-bad-git-dotfiles.sh > @@ -401,7 +401,7 @@ test_expect_success SYMLINKS,!WINDOWS,!MINGW 'submodule must not checkout into d > git -C repo commit -m submodule && > > git -c protocol.file.allow=always clone --recurse-submodules repo bad-clone && > - ! test -f "$PWD/foo" && > + ! test -f "$PWD/bad-clone/sub/foo" && > test -f $(printf "bad-clone/sub\r/post-checkout") > ' > > > base-commit: e813a0200a7121b97fec535f0d0b460b0a33356c ``` ## Justin Tobler, 2025-08-01 16:48 Subject: Re: [PATCH v2] t7450: inspect the correct path a broken code would write to Message-ID: <5hdj64ha2b5ewydtrra2rbzofgzaqnu2rt5enlarqs6u4grjsg@pkdsa6plxsuw> URL: https://gitlist.dev/e/5hdj64ha2b5ewydtrra2rbzofgzaqnu2rt5enlarqs6u4grjsg%40pkdsa6plxsuw In-Reply-To: ``` On 25/07/31 03:49AM, chenjianhu via GitGitGadget wrote: > From: chenjianhu > > Prior to 05e9cd64 (config: quote values containing CR character, > 2025-05-19), a repository can trick "clone --recurse-submodules" > into running a post-checkout hook shipped with the project. The > test was written to make sure the trick would no longer run the > hook with the fix in the commit. Yep the first assertion in the test exists to ensure that the post-checkout hook in the submodule is not executed. The test also validates via its second assertion that the sumodule cannot be tricked into being checked-out into a symlinked directory. > However, the test did not check for the path the hook would > create; correct the path to the expected one if the bug were > still with us. > > Signed-off-by: chenjianhu > --- [snip] > diff --git a/t/t7450-bad-git-dotfiles.sh b/t/t7450-bad-git-dotfiles.sh > index 14b5743b962..f512eed278c 100755 > --- a/t/t7450-bad-git-dotfiles.sh > +++ b/t/t7450-bad-git-dotfiles.sh > @@ -401,7 +401,7 @@ test_expect_success SYMLINKS,!WINDOWS,!MINGW 'submodule must not checkout into d > git -C repo commit -m submodule && > > git -c protocol.file.allow=always clone --recurse-submodules repo bad-clone && > - ! test -f "$PWD/foo" && > + ! test -f "$PWD/bad-clone/sub/foo" && Yep, this is the correct path now. This patch looks good to me. Thanks for fixing :) -Justin > test -f $(printf "bad-clone/sub\r/post-checkout") > ' > > > base-commit: e813a0200a7121b97fec535f0d0b460b0a33356c > -- > gitgitgadget > ```