setup: allow cwd=.git w/ bareRepository=explicit

The safe.bareRepository setting can be set to 'explicit' to disallow
implicit uses of bare repositories, preventing an attack [1] where an
artificial and malicious bare repository is embedded in another git
repository. Unfortunately, some tooling uses myrepo/.git/ as the cwd
when executing commands, and this is blocked when
safe.bareRepository=explicit. Blocking is unnecessary, as git already
prevents nested .git directories.

Teach git to not reject uses of git inside of the .git directory: check
if cwd is .git (or a subdirectory of it) and allow it even if
safe.bareRepository=explicit.

[1] https://github.com/justinsteven/advisories/blob/main/2022_git_buried_bare_repos_and_fsmonitor_various_abuses.md

Signed-off-by: Kyle Lippincott <spectral@google.com>
Signed-off-by: Junio C Hamano <gitster@pobox.com>

diff --git a/setup.c b/setup.c
index fc592dc6dd5bf3f2ac7ac01ca0d72b7ce0129e77..a09b7b87eca09e08f6efff04052f94078e559adc 100644 (file)
--- a/setup.c
+++ b/setup.c
@@ -1359,7 +1359,8 @@ static enum discovery_result setup_git_directory_gently_1(struct strbuf *dir,
 
                if (is_git_directory(dir->buf)) {
                        trace2_data_string("setup", NULL, "implicit-bare-repository", dir->buf);
-                       if (get_allowed_bare_repo() == ALLOWED_BARE_REPO_EXPLICIT)
+                       if (get_allowed_bare_repo() == ALLOWED_BARE_REPO_EXPLICIT &&
+                           !ends_with_path_components(dir->buf, ".git"))
                                return GIT_DIR_DISALLOWED_BARE;
                        if (!ensure_valid_ownership(NULL, NULL, dir->buf, report))
                                return GIT_DIR_INVALID_OWNERSHIP;

diff --git a/t/t0035-safe-bare-repository.sh b/t/t0035-safe-bare-repository.sh
index 038b8b788d7dea688c2efa807e1d1856b8f33c13..804885637954a57ba85e139591e6a0f5a5167034 100755 (executable)
--- a/t/t0035-safe-bare-repository.sh
+++ b/t/t0035-safe-bare-repository.sh
@@ -78,4 +78,12 @@ test_expect_success 'no trace when GIT_DIR is explicitly provided' '
        expect_accepted_explicit "$pwd/outer-repo/bare-repo"
 '
 
+test_expect_success 'no trace when "bare repository" is .git' '
+       expect_accepted_implicit -C outer-repo/.git
+'
+
+test_expect_success 'no trace when "bare repository" is a subdir of .git' '
+       expect_accepted_implicit -C outer-repo/.git/objects
+'
+
 test_done