|
 |
776a70 |
From 6d69680505dbbc484178105815ed624fab40b2de Mon Sep 17 00:00:00 2001
|
|
|
776a70 |
From: Petr Stodulka <pstodulk@redhat.com>
|
|
|
776a70 |
Date: Wed, 28 Oct 2015 15:03:01 +0100
|
|
|
776a70 |
Subject: [PATCH 1/5] submodule: allow only certain protocols for submodule
|
|
|
776a70 |
fetches
|
|
|
776a70 |
|
|
|
776a70 |
Some protocols (like git-remote-ext) can execute arbitrary
|
|
|
776a70 |
code found in the URL. The URLs that submodules use may come
|
|
|
776a70 |
from arbitrary sources (e.g., .gitmodules files in a remote
|
|
|
776a70 |
repository). Let's restrict submodules to fetching from a
|
|
|
776a70 |
known-good subset of protocols.
|
|
|
776a70 |
|
|
|
776a70 |
Note that we apply this restriction to all submodule
|
|
|
776a70 |
commands, whether the URL comes from .gitmodules or not.
|
|
|
776a70 |
This is more restrictive than we need to be; for example, in
|
|
|
776a70 |
the tests we run:
|
|
|
776a70 |
|
|
|
776a70 |
git submodule add ext::...
|
|
|
776a70 |
|
|
|
776a70 |
which should be trusted, as the URL comes directly from the
|
|
|
776a70 |
command line provided by the user. But doing it this way is
|
|
|
776a70 |
simpler, and makes it much less likely that we would miss a
|
|
|
776a70 |
case. And since such protocols should be an exception
|
|
|
776a70 |
(especially because nobody who clones from them will be able
|
|
|
776a70 |
to update the submodules!), it's not likely to inconvenience
|
|
|
776a70 |
anyone in practice.
|
|
|
776a70 |
---
|
|
|
776a70 |
git-submodule.sh | 9 +++++++++
|
|
|
776a70 |
t/t5815-submodule-protos-sh | 43 +++++++++++++++++++++++++++++++++++++++++++
|
|
|
776a70 |
2 files changed, 52 insertions(+)
|
|
|
776a70 |
create mode 100644 t/t5815-submodule-protos-sh
|
|
|
776a70 |
|
|
|
776a70 |
diff --git a/git-submodule.sh b/git-submodule.sh
|
|
|
776a70 |
index 79bfaac..bec3362 100755
|
|
|
776a70 |
--- a/git-submodule.sh
|
|
|
776a70 |
+++ b/git-submodule.sh
|
|
|
776a70 |
@@ -19,6 +19,15 @@ OPTIONS_SPEC=
|
|
|
776a70 |
. git-parse-remote
|
|
|
776a70 |
require_work_tree
|
|
|
776a70 |
|
|
|
776a70 |
+# Restrict ourselves to a vanilla subset of protocols; the URLs
|
|
|
776a70 |
+# we get are under control of a remote repository, and we do not
|
|
|
776a70 |
+# want them kicking off arbitrary git-remote-* programs.
|
|
|
776a70 |
+#
|
|
|
776a70 |
+# If the user has already specified a set of allowed protocols,
|
|
|
776a70 |
+# we assume they know what they're doing and use that instead.
|
|
|
776a70 |
+: ${GIT_ALLOW_PROTOCOL=file:git:http:https:ssh}
|
|
|
776a70 |
+export GIT_ALLOW_PROTOCOL
|
|
|
776a70 |
+
|
|
|
776a70 |
command=
|
|
|
776a70 |
branch=
|
|
|
776a70 |
force=
|
|
|
776a70 |
diff --git a/t/t5815-submodule-protos-sh b/t/t5815-submodule-protos-sh
|
|
|
776a70 |
new file mode 100644
|
|
|
776a70 |
index 0000000..06f55a1
|
|
|
776a70 |
--- /dev/null
|
|
|
776a70 |
+++ b/t/t5815-submodule-protos-sh
|
|
|
776a70 |
@@ -0,0 +1,43 @@
|
|
|
776a70 |
+#!/bin/sh
|
|
|
776a70 |
+
|
|
|
776a70 |
+test_description='test protocol whitelisting with submodules'
|
|
|
776a70 |
+. ./test-lib.sh
|
|
|
776a70 |
+. "$TEST_DIRECTORY"/lib-proto-disable.sh
|
|
|
776a70 |
+
|
|
|
776a70 |
+setup_ext_wrapper
|
|
|
776a70 |
+setup_ssh_wrapper
|
|
|
776a70 |
+
|
|
|
776a70 |
+test_expect_success 'setup repository with submodules' '
|
|
|
776a70 |
+ mkdir remote &&
|
|
|
776a70 |
+ git init remote/repo.git &&
|
|
|
776a70 |
+ (cd remote/repo.git && test_commit one) &&
|
|
|
776a70 |
+ # submodule-add should probably trust what we feed it on the cmdline,
|
|
|
776a70 |
+ # but its implementation is overly conservative.
|
|
|
776a70 |
+ GIT_ALLOW_PROTOCOL=ssh git submodule add remote:repo.git ssh-module &&
|
|
|
776a70 |
+ GIT_ALLOW_PROTOCOL=ext git submodule add "ext::fake-remote %S repo.git" ext-module &&
|
|
|
776a70 |
+ git commit -m "add submodules"
|
|
|
776a70 |
+'
|
|
|
776a70 |
+
|
|
|
776a70 |
+test_expect_success 'clone with recurse-submodules fails' '
|
|
|
776a70 |
+ test_must_fail git clone --recurse-submodules . dst
|
|
|
776a70 |
+'
|
|
|
776a70 |
+
|
|
|
776a70 |
+test_expect_success 'setup individual updates' '
|
|
|
776a70 |
+ rm -rf dst &&
|
|
|
776a70 |
+ git clone . dst &&
|
|
|
776a70 |
+ git -C dst submodule init
|
|
|
776a70 |
+'
|
|
|
776a70 |
+
|
|
|
776a70 |
+test_expect_success 'update of ssh allowed' '
|
|
|
776a70 |
+ git -C dst submodule update ssh-module
|
|
|
776a70 |
+'
|
|
|
776a70 |
+
|
|
|
776a70 |
+test_expect_success 'update of ext not allowed' '
|
|
|
776a70 |
+ test_must_fail git -C dst submodule update ext-module
|
|
|
776a70 |
+'
|
|
|
776a70 |
+
|
|
|
776a70 |
+test_expect_success 'user can override whitelist' '
|
|
|
776a70 |
+ GIT_ALLOW_PROTOCOL=ext git -C dst submodule update ext-module
|
|
|
776a70 |
+'
|
|
|
776a70 |
+
|
|
|
776a70 |
+test_done
|
|
|
776a70 |
--
|
|
|
776a70 |
2.1.0
|
|
|
776a70 |
|