Skip to content

Commit 14af7ed

Browse files
dschodscho
committed
Sync with 2.17.3
* maint-2.17: (32 commits) Git 2.17.3 Git 2.16.6 test-drop-caches: use `has_dos_drive_prefix()` Git 2.15.4 Git 2.14.6 mingw: handle `subst`-ed "DOS drives" mingw: refuse to access paths with trailing spaces or periods mingw: refuse to access paths with illegal characters unpack-trees: let merged_entry() pass through do_add_entry()'s errors quote-stress-test: offer to test quoting arguments for MSYS2 sh t6130/t9350: prepare for stringent Win32 path validation quote-stress-test: allow skipping some trials quote-stress-test: accept arguments to test via the command-line tests: add a helper to stress test argument quoting mingw: fix quoting of arguments Disallow dubiously-nested submodule git directories protect_ntfs: turn on NTFS protection by default path: also guard `.gitmodules` against NTFS Alternate Data Streams is_ntfs_dotgit(): speed it up mingw: disallow backslash characters in tree objects' file names ...
2 parents 268fbcd + a5ab8d0 commit 14af7ed

38 files changed

+898
-83
lines changed

‎Documentation/RelNotes/2.14.6.txt‎

Lines changed: 54 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,54 @@
1+
Git v2.14.6 Release Notes
2+
=========================
3+
4+
This release addresses the security issues CVE-2019-1348,
5+
CVE-2019-1349, CVE-2019-1350, CVE-2019-1351, CVE-2019-1352,
6+
CVE-2019-1353, CVE-2019-1354, and CVE-2019-1387.
7+
8+
Fixes since v2.14.5
9+
-------------------
10+
11+
* CVE-2019-1348:
12+
The --export-marks option of git fast-import is exposed also via
13+
the in-stream command feature export-marks=... and it allows
14+
overwriting arbitrary paths.
15+
16+
* CVE-2019-1349:
17+
When submodules are cloned recursively, under certain circumstances
18+
Git could be fooled into using the same Git directory twice. We now
19+
require the directory to be empty.
20+
21+
* CVE-2019-1350:
22+
Incorrect quoting of command-line arguments allowed remote code
23+
execution during a recursive clone in conjunction with SSH URLs.
24+
25+
* CVE-2019-1351:
26+
While the only permitted drive letters for physical drives on
27+
Windows are letters of the US-English alphabet, this restriction
28+
does not apply to virtual drives assigned via subst <letter>:
29+
<path>. Git mistook such paths for relative paths, allowing writing
30+
outside of the worktree while cloning.
31+
32+
* CVE-2019-1352:
33+
Git was unaware of NTFS Alternate Data Streams, allowing files
34+
inside the .git/ directory to be overwritten during a clone.
35+
36+
* CVE-2019-1353:
37+
When running Git in the Windows Subsystem for Linux (also known as
38+
"WSL") while accessing a working directory on a regular Windows
39+
drive, none of the NTFS protections were active.
40+
41+
* CVE-2019-1354:
42+
Filenames on Linux/Unix can contain backslashes. On Windows,
43+
backslashes are directory separators. Git did not use to refuse to
44+
write out tracked files with such filenames.
45+
46+
* CVE-2019-1387:
47+
Recursive clones are currently affected by a vulnerability that is
48+
caused by too-lax validation of submodule names, allowing very
49+
targeted attacks via remote code execution in recursive clones.
50+
51+
Credit for finding these vulnerabilities goes to Microsoft Security
52+
Response Center, in particular to Nicolas Joly. The `fast-import`
53+
fixes were provided by Jeff King, the other fixes by Johannes
54+
Schindelin with help from Garima Singh.

‎Documentation/RelNotes/2.15.4.txt‎

Lines changed: 11 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,11 @@
1+
Git v2.15.4 Release Notes
2+
=========================
3+
4+
This release merges up the fixes that appear in v2.14.6 to address
5+
the security issues CVE-2019-1348, CVE-2019-1349, CVE-2019-1350,
6+
CVE-2019-1351, CVE-2019-1352, CVE-2019-1353, CVE-2019-1354, and
7+
CVE-2019-1387; see the release notes for that version for details.
8+
9+
In conjunction with a vulnerability that was fixed in v2.20.2,
10+
`.gitmodules` is no longer allowed to contain entries of the form
11+
`submodule.<name>.update=!command`.

‎Documentation/RelNotes/2.16.6.txt‎

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,8 @@
1+
Git v2.16.6 Release Notes
2+
=========================
3+
4+
This release merges up the fixes that appear in v2.14.6 and in
5+
v2.15.4 addressing the security issues CVE-2019-1348, CVE-2019-1349,
6+
CVE-2019-1350, CVE-2019-1351, CVE-2019-1352, CVE-2019-1353,
7+
CVE-2019-1354, and CVE-2019-1387; see the release notes for those
8+
versions for details.

‎Documentation/RelNotes/2.17.3.txt‎

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,12 @@
1+
Git v2.17.3 Release Notes
2+
=========================
3+
4+
This release merges up the fixes that appear in v2.14.6 and in
5+
v2.15.4 addressing the security issues CVE-2019-1348, CVE-2019-1349,
6+
CVE-2019-1350, CVE-2019-1351, CVE-2019-1352, CVE-2019-1353,
7+
CVE-2019-1354, and CVE-2019-1387; see the release notes for those
8+
versions for details.
9+
10+
In addition, `git fsck` was taught to identify `.gitmodules` entries
11+
of the form `submodule.<name>.update=!command`, which have been
12+
disallowed in v2.15.4.

‎Documentation/git-fast-import.txt‎

Lines changed: 15 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -50,6 +50,21 @@ OPTIONS
5050
memory used by fast-import during this run. Showing this output
5151
is currently the default, but can be disabled with --quiet.
5252

53+
--allow-unsafe-features::
54+
Many command-line options can be provided as part of the
55+
fast-import stream itself by using the `feature` or `option`
56+
commands. However, some of these options are unsafe (e.g.,
57+
allowing fast-import to access the filesystem outside of the
58+
repository). These options are disabled by default, but can be
59+
allowed by providing this option on the command line. This
60+
currently impacts only the `export-marks`, `import-marks`, and
61+
`import-marks-if-exists` feature commands.
62+
+
63+
Only enable this option if you trust the program generating the
64+
fast-import stream! This option is enabled automatically for
65+
remote-helpers that use the `import` capability, as they are
66+
already trusted to run their own code.
67+
5368
Options for Frontends
5469
~~~~~~~~~~~~~~~~~~~~~
5570

‎Documentation/gitmodules.txt‎

Lines changed: 2 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -44,9 +44,8 @@ submodule.<name>.update::
4444
submodule init` to initialize the configuration variable of
4545
the same name. Allowed values here are 'checkout', 'rebase',
4646
'merge' or 'none'. See description of 'update' command in
47-
linkgit:git-submodule[1] for their meaning. Note that the
48-
'!command' form is intentionally ignored here for security
49-
reasons.
47+
linkgit:git-submodule[1] for their meaning. For security
48+
reasons, the '!command' form is not accepted here.
5049

5150
submodule.<name>.branch::
5251
A remote branch name for tracking updates in the upstream submodule.

‎builtin/clone.c‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -765,7 +765,7 @@ static int checkout(int submodule_progress)
765765

766766
if (!err && (option_recurse_submodules.nr > 0)) {
767767
struct argv_array args = ARGV_ARRAY_INIT;
768-
argv_array_pushl(&args, "submodule", "update", "--init", "--recursive", NULL);
768+
argv_array_pushl(&args, "submodule", "update", "--require-init", "--recursive", NULL);
769769

770770
if (option_shallow_submodules == 1)
771771
argv_array_push(&args, "--depth=1");

‎builtin/submodule--helper.c‎

Lines changed: 16 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -18,6 +18,7 @@
1818
#include "diffcore.h"
1919
#include "diff.h"
2020
#include "object-store.h"
21+
#include "dir.h"
2122

2223
#define OPT_QUIET (1 << 0)
2324
#define OPT_CACHED (1 << 1)
@@ -1203,7 +1204,7 @@ static int module_clone(int argc, const char **argv, const char *prefix)
12031204
char *p, *path = NULL, *sm_gitdir;
12041205
struct strbuf sb = STRBUF_INIT;
12051206
struct string_list reference = STRING_LIST_INIT_NODUP;
1206-
int dissociate = 0;
1207+
int dissociate = 0, require_init = 0;
12071208
char *sm_alternate = NULL, *error_strategy = NULL;
12081209

12091210
struct option module_clone_options[] = {
@@ -1230,6 +1231,8 @@ static int module_clone(int argc, const char **argv, const char *prefix)
12301231
OPT__QUIET(&quiet, "Suppress output for cloning a submodule"),
12311232
OPT_BOOL(0, "progress", &progress,
12321233
N_("force cloning progress")),
1234+
OPT_BOOL(0, "require-init", &require_init,
1235+
N_("disallow cloning into non-empty directory")),
12331236
OPT_END()
12341237
};
12351238

@@ -1257,6 +1260,10 @@ static int module_clone(int argc, const char **argv, const char *prefix)
12571260
} else
12581261
path = xstrdup(path);
12591262

1263+
if (validate_submodule_git_dir(sm_gitdir, name) < 0)
1264+
die(_("refusing to create/use '%s' in another submodule's "
1265+
"git dir"), sm_gitdir);
1266+
12601267
if (!file_exists(sm_gitdir)) {
12611268
if (safe_create_leading_directories_const(sm_gitdir) < 0)
12621269
die(_("could not create directory '%s'"), sm_gitdir);
@@ -1268,6 +1275,8 @@ static int module_clone(int argc, const char **argv, const char *prefix)
12681275
die(_("clone of '%s' into submodule path '%s' failed"),
12691276
url, path);
12701277
} else {
1278+
if (require_init && !access(path, X_OK) && !is_empty_dir(path))
1279+
die(_("directory not empty: '%s'"), path);
12711280
if (safe_create_leading_directories_const(path) < 0)
12721281
die(_("could not create directory '%s'"), path);
12731282
strbuf_addf(&sb, "%s/index", sm_gitdir);
@@ -1316,6 +1325,7 @@ struct submodule_update_clone {
13161325
int recommend_shallow;
13171326
struct string_list references;
13181327
int dissociate;
1328+
unsigned require_init;
13191329
const char *depth;
13201330
const char *recursive_prefix;
13211331
const char *prefix;
@@ -1331,7 +1341,7 @@ struct submodule_update_clone {
13311341
int failed_clones_nr, failed_clones_alloc;
13321342
};
13331343
#define SUBMODULE_UPDATE_CLONE_INIT {0, MODULE_LIST_INIT, 0, \
1334-
SUBMODULE_UPDATE_STRATEGY_INIT, 0, 0, -1, STRING_LIST_INIT_DUP, 0, \
1344+
SUBMODULE_UPDATE_STRATEGY_INIT, 0, 0, -1, STRING_LIST_INIT_DUP, 0, 0, \
13351345
NULL, NULL, NULL, \
13361346
STRING_LIST_INIT_DUP, 0, NULL, 0, 0}
13371347

@@ -1450,6 +1460,8 @@ static int prepare_to_clone_next_submodule(const struct cache_entry *ce,
14501460
argv_array_pushl(&child->args, "--prefix", suc->prefix, NULL);
14511461
if (suc->recommend_shallow && sub->recommend_shallow == 1)
14521462
argv_array_push(&child->args, "--depth=1");
1463+
if (suc->require_init)
1464+
argv_array_push(&child->args, "--require-init");
14531465
argv_array_pushl(&child->args, "--path", sub->path, NULL);
14541466
argv_array_pushl(&child->args, "--name", sub->name, NULL);
14551467
argv_array_pushl(&child->args, "--url", url, NULL);
@@ -1605,6 +1617,8 @@ static int update_clone(int argc, const char **argv, const char *prefix)
16051617
OPT__QUIET(&suc.quiet, N_("don't print cloning progress")),
16061618
OPT_BOOL(0, "progress", &suc.progress,
16071619
N_("force cloning progress")),
1620+
OPT_BOOL(0, "require-init", &suc.require_init,
1621+
N_("disallow cloning into non-empty directory")),
16081622
OPT_END()
16091623
};
16101624

‎compat/mingw.c‎

Lines changed: 96 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -333,6 +333,12 @@ int mingw_mkdir(const char *path, int mode)
333333
{
334334
int ret;
335335
wchar_t wpath[MAX_PATH];
336+
337+
if (!is_valid_win32_path(path)) {
338+
errno = EINVAL;
339+
return -1;
340+
}
341+
336342
if (xutftowcs_path(wpath, path) < 0)
337343
return -1;
338344
ret = _wmkdir(wpath);
@@ -345,13 +351,18 @@ int mingw_open (const char *filename, int oflags, ...)
345351
{
346352
va_list args;
347353
unsigned mode;
348-
int fd;
354+
int fd, create = (oflags & (O_CREAT | O_EXCL)) == (O_CREAT | O_EXCL);
349355
wchar_t wfilename[MAX_PATH];
350356

351357
va_start(args, oflags);
352358
mode = va_arg(args, int);
353359
va_end(args);
354360

361+
if (!is_valid_win32_path(filename)) {
362+
errno = create ? EINVAL : ENOENT;
363+
return -1;
364+
}
365+
355366
if (filename && !strcmp(filename, "/dev/null"))
356367
filename = "nul";
357368

@@ -413,6 +424,11 @@ FILE *mingw_fopen (const char *filename, const char *otype)
413424
int hide = needs_hiding(filename);
414425
FILE *file;
415426
wchar_t wfilename[MAX_PATH], wotype[4];
427+
if (!is_valid_win32_path(filename)) {
428+
int create = otype && strchr(otype, 'w');
429+
errno = create ? EINVAL : ENOENT;
430+
return NULL;
431+
}
416432
if (filename && !strcmp(filename, "/dev/null"))
417433
filename = "nul";
418434
if (xutftowcs_path(wfilename, filename) < 0 ||
@@ -435,6 +451,11 @@ FILE *mingw_freopen (const char *filename, const char *otype, FILE *stream)
435451
int hide = needs_hiding(filename);
436452
FILE *file;
437453
wchar_t wfilename[MAX_PATH], wotype[4];
454+
if (!is_valid_win32_path(filename)) {
455+
int create = otype && strchr(otype, 'w');
456+
errno = create ? EINVAL : ENOENT;
457+
return NULL;
458+
}
438459
if (filename && !strcmp(filename, "/dev/null"))
439460
filename = "nul";
440461
if (xutftowcs_path(wfilename, filename) < 0 ||
@@ -883,7 +904,7 @@ static const char *quote_arg(const char *arg)
883904
p++;
884905
len++;
885906
}
886-
if (*p == '"')
907+
if (*p == '"' || !*p)
887908
n += count*2 + 1;
888909
continue;
889910
}
@@ -905,16 +926,19 @@ static const char *quote_arg(const char *arg)
905926
count++;
906927
*d++ = *arg++;
907928
}
908-
if (*arg == '"') {
929+
if (*arg == '"' || !*arg) {
909930
while (count-- > 0)
910931
*d++ = '\\';
932+
/* don't escape the surrounding end quote */
933+
if (!*arg)
934+
break;
911935
*d++ = '\\';
912936
}
913937
}
914938
*d++ = *arg++;
915939
}
916940
*d++ = '"';
917-
*d++ = 0;
941+
*d++ = '\0';
918942
return q;
919943
}
920944

@@ -1976,6 +2000,30 @@ pid_t waitpid(pid_t pid, int *status, int options)
19762000
return -1;
19772001
}
19782002

2003+
int mingw_has_dos_drive_prefix(const char *path)
2004+
{
2005+
int i;
2006+
2007+
/*
2008+
* Does it start with an ASCII letter (i.e. highest bit not set),
2009+
* followed by a colon?
2010+
*/
2011+
if (!(0x80 & (unsigned char)*path))
2012+
return *path && path[1] == ':' ? 2 : 0;
2013+
2014+
/*
2015+
* While drive letters must be letters of the English alphabet, it is
2016+
* possible to assign virtually _any_ Unicode character via `subst` as
2017+
* a drive letter to "virtual drives". Even `1`, or `ä`. Or fun stuff
2018+
* like this:
2019+
*
2020+
* subst ֍: %USERPROFILE%\Desktop
2021+
*/
2022+
for (i = 1; i < 4 && (0x80 & (unsigned char)path[i]); i++)
2023+
; /* skip first UTF-8 character */
2024+
return path[i] == ':' ? i + 1 : 0;
2025+
}
2026+
19792027
int mingw_skip_dos_drive_prefix(char **path)
19802028
{
19812029
int ret = has_dos_drive_prefix(*path);
@@ -2117,6 +2165,50 @@ static void setup_windows_environment(void)
21172165
setenv("TERM", "cygwin", 1);
21182166
}
21192167

2168+
int is_valid_win32_path(const char *path)
2169+
{
2170+
int preceding_space_or_period = 0, i = 0, periods = 0;
2171+
2172+
if (!protect_ntfs)
2173+
return 1;
2174+
2175+
skip_dos_drive_prefix((char **)&path);
2176+
2177+
for (;;) {
2178+
char c = *(path++);
2179+
switch (c) {
2180+
case '\0':
2181+
case '/': case '\\':
2182+
/* cannot end in ` ` or `.`, except for `.` and `..` */
2183+
if (preceding_space_or_period &&
2184+
(i != periods || periods > 2))
2185+
return 0;
2186+
if (!c)
2187+
return 1;
2188+
2189+
i = periods = preceding_space_or_period = 0;
2190+
continue;
2191+
case '.':
2192+
periods++;
2193+
/* fallthru */
2194+
case ' ':
2195+
preceding_space_or_period = 1;
2196+
i++;
2197+
continue;
2198+
case ':': /* DOS drive prefix was already skipped */
2199+
case '<': case '>': case '"': case '|': case '?': case '*':
2200+
/* illegal character */
2201+
return 0;
2202+
default:
2203+
if (c > '\0' && c < '\x20')
2204+
/* illegal character */
2205+
return 0;
2206+
}
2207+
preceding_space_or_period = 0;
2208+
i++;
2209+
}
2210+
}
2211+
21202212
/*
21212213
* Disable MSVCRT command line wildcard expansion (__getmainargs called from
21222214
* mingw startup code, see init.c in mingw runtime).

0 commit comments

Comments
 (0)