diff options
| author | Johannes Schindelin <johannes.schindelin@gmx.de> | 2019-09-16 13:26:40 +0200 |
|---|---|---|
| committer | Johannes Schindelin <johannes.schindelin@gmx.de> | 2019-12-05 15:37:08 +0100 |
| commit | 5532ebdeb7ac56d952addb94ea9741d3c8f5b6f6 (patch) | |
| tree | ecabfba07ded9ef567af1545e686b71f30cfbee0 /t/t7416-submodule-dash-url.sh | |
| parent | Merge branch 'dubiously-nested-submodules' (diff) | |
| parent | quote-stress-test: offer to test quoting arguments for MSYS2 sh (diff) | |
| download | git-5532ebdeb7ac56d952addb94ea9741d3c8f5b6f6.tar.xz git-5532ebdeb7ac56d952addb94ea9741d3c8f5b6f6.zip | |
Merge branch 'fix-mingw-quoting-bug'
This patch fixes a vulnerability in the Windows-specific code where a
submodule names ending in a backslash were quoted incorrectly, and that
bug could be abused to insert command-line parameters e.g. to `ssh` in a
recursive clone.
Note: this bug is Windows-only, as we have to construct a command line
for the process-to-spawn, unlike Linux/macOS, where `execv()` accepts an
already-split command line.
While at it, other quoting issues are fixed as well.
Signed-off-by: Johannes Schindelin <johannes.schindelin@gmx.de>
Diffstat (limited to 't/t7416-submodule-dash-url.sh')
| -rwxr-xr-x | t/t7416-submodule-dash-url.sh | 14 |
1 files changed, 14 insertions, 0 deletions
diff --git a/t/t7416-submodule-dash-url.sh b/t/t7416-submodule-dash-url.sh index 459193c976..2966e93071 100755 --- a/t/t7416-submodule-dash-url.sh +++ b/t/t7416-submodule-dash-url.sh @@ -31,4 +31,18 @@ test_expect_success 'clone rejects unprotected dash' ' test_i18ngrep ignoring err ' +test_expect_success 'trailing backslash is handled correctly' ' + git init testmodule && + test_commit -C testmodule c && + git submodule add ./testmodule && + : ensure that the name ends in a double backslash && + sed -e "s|\\(submodule \"testmodule\\)\"|\\1\\\\\\\\\"|" \ + -e "s|url = .*|url = \" --should-not-be-an-option\"|" \ + <.gitmodules >.new && + mv .new .gitmodules && + git commit -am "Add testmodule" && + test_must_fail git clone --verbose --recurse-submodules . dolly 2>err && + test_i18ngrep ! "unknown option" err +' + test_done |