t/t7450-bad-git-dotfiles.sh

   1 #!/bin/sh
   2
   3 test_description='check broken or malicious patterns in .git* files
   4
   5 Such as:
   6
   7   - presence of .. in submodule names;
   8     Exercise the name-checking function on a variety of names, and then give a
   9     real-world setup that confirms we catch this in practice.
  10
  11   - nested submodule names
  12
  13   - symlinked .gitmodules, etc
  14 '
  15 . ./test-lib.sh
  16 . "$TEST_DIRECTORY"/lib-pack.sh
  17
  18 test_expect_success 'setup' '
  19         git config --global protocol.file.allow always
  20 '
  21
  22 test_expect_success 'check names' '
  23         cat >expect <<-\EOF &&
  24         valid
  25         valid/with/paths
  26         EOF
  27
  28         git submodule--helper check-name >actual <<-\EOF &&
  29         valid
  30         valid/with/paths
  31
  32         ../foo
  33         /../foo
  34         ..\foo
  35         \..\foo
  36         foo/..
  37         foo/../
  38         foo\..
  39         foo\..\
  40         foo/../bar
  41         EOF
  42
  43         test_cmp expect actual
  44 '
  45
  46 test_expect_success 'create innocent subrepo' '
  47         git init innocent &&
  48         git -C innocent commit --allow-empty -m foo
  49 '
  50
  51 test_expect_success 'submodule add refuses invalid names' '
  52         test_must_fail \
  53                 git submodule add --name ../../modules/evil "$PWD/innocent" evil
  54 '
  55
  56 test_expect_success 'add evil submodule' '
  57         git submodule add "$PWD/innocent" evil &&
  58
  59         mkdir modules &&
  60         cp -r .git/modules/evil modules &&
  61         write_script modules/evil/hooks/post-checkout <<-\EOF &&
  62         echo >&2 "RUNNING POST CHECKOUT"
  63         EOF
  64
  65         git config -f .gitmodules submodule.evil.update checkout &&
  66         git config -f .gitmodules --rename-section \
  67                 submodule.evil submodule.../../modules/evil &&
  68         git add modules &&
  69         git commit -am evil
  70 '
  71
  72 # This step seems like it shouldn't be necessary, since the payload is
  73 # contained entirely in the evil submodule. But due to the vagaries of the
  74 # submodule code, checking out the evil module will fail unless ".git/modules"
  75 # exists. Adding another submodule (with a name that sorts before "evil") is an
  76 # easy way to make sure this is the case in the victim clone.
  77 test_expect_success 'add other submodule' '
  78         git submodule add "$PWD/innocent" another-module &&
  79         git add another-module &&
  80         git commit -am another
  81 '
  82
  83 test_expect_success 'clone evil superproject' '
  84         git clone --recurse-submodules . victim >output 2>&1 &&
  85         ! grep "RUNNING POST CHECKOUT" output
  86 '
  87
  88 test_expect_success 'fsck detects evil superproject' '
  89         test_must_fail git fsck
  90 '
  91
  92 test_expect_success 'transfer.fsckObjects detects evil superproject (unpack)' '
  93         rm -rf dst.git &&
  94         git init --bare dst.git &&
  95         git -C dst.git config transfer.fsckObjects true &&
  96         test_must_fail git push dst.git HEAD
  97 '
  98
  99 test_expect_success 'transfer.fsckObjects detects evil superproject (index)' '
 100         rm -rf dst.git &&
 101         git init --bare dst.git &&
 102         git -C dst.git config transfer.fsckObjects true &&
 103         git -C dst.git config transfer.unpackLimit 1 &&
 104         test_must_fail git push dst.git HEAD
 105 '
 106
 107 # Normally our packs contain commits followed by trees followed by blobs. This
 108 # reverses the order, which requires backtracking to find the context of a
 109 # blob. We'll start with a fresh gitmodules-only tree to make it simpler.
 110 test_expect_success 'create oddly ordered pack' '
 111         git checkout --orphan odd &&
 112         git rm -rf --cached . &&
 113         git add .gitmodules &&
 114         git commit -m odd &&
 115         {
 116                 pack_header 3 &&
 117                 pack_obj $(git rev-parse HEAD:.gitmodules) &&
 118                 pack_obj $(git rev-parse HEAD^{tree}) &&
 119                 pack_obj $(git rev-parse HEAD)
 120         } >odd.pack &&
 121         pack_trailer odd.pack
 122 '
 123
 124 test_expect_success 'transfer.fsckObjects handles odd pack (unpack)' '
 125         rm -rf dst.git &&
 126         git init --bare dst.git &&
 127         test_must_fail git -C dst.git unpack-objects --strict <odd.pack
 128 '
 129
 130 test_expect_success 'transfer.fsckObjects handles odd pack (index)' '
 131         rm -rf dst.git &&
 132         git init --bare dst.git &&
 133         test_must_fail git -C dst.git index-pack --strict --stdin <odd.pack
 134 '
 135
 136 test_expect_success 'index-pack --strict works for non-repo pack' '
 137         rm -rf dst.git &&
 138         git init --bare dst.git &&
 139         cp odd.pack dst.git &&
 140         test_must_fail git -C dst.git index-pack --strict odd.pack 2>output &&
 141         # Make sure we fail due to bad gitmodules content, not because we
 142         # could not read the blob in the first place.
 143         grep gitmodulesName output
 144 '
 145
 146 check_dotx_symlink () {
 147         fsck_must_fail=test_must_fail
 148         fsck_prefix=error
 149         refuse_index=t
 150         case "$1" in
 151         --warning)
 152                 fsck_must_fail=
 153                 fsck_prefix=warning
 154                 refuse_index=
 155                 shift
 156                 ;;
 157         esac
 158
 159         name=$1
 160         type=$2
 161         path=$3
 162         dir=symlink-$name-$type
 163
 164         test_expect_success "set up repo with symlinked $name ($type)" '
 165                 git init $dir &&
 166                 (
 167                         cd $dir &&
 168
 169                         # Make the tree directly to avoid index restrictions.
 170                         #
 171                         # Because symlinks store the target as a blob, choose
 172                         # a pathname that could be parsed as a .gitmodules file
 173                         # to trick naive non-symlink-aware checking.
 174                         tricky="[foo]bar=true" &&
 175                         content=$(git hash-object -w ../.gitmodules) &&
 176                         target=$(printf "$tricky" | git hash-object -w --stdin) &&
 177                         {
 178                                 printf "100644 blob $content\t$tricky\n" &&
 179                                 printf "120000 blob $target\t$path\n"
 180                         } >bad-tree
 181                 ) &&
 182                 tree=$(git -C $dir mktree <$dir/bad-tree)
 183         '
 184
 185         test_expect_success "fsck detects symlinked $name ($type)" '
 186                 (
 187                         cd $dir &&
 188
 189                         # Check not only that we fail, but that it is due to the
 190                         # symlink detector
 191                         $fsck_must_fail git fsck 2>output &&
 192                         grep "$fsck_prefix.*tree $tree: ${name}Symlink" output
 193                 )
 194         '
 195
 196         test -n "$refuse_index" &&
 197         test_expect_success "refuse to load symlinked $name into index ($type)" '
 198                 test_must_fail \
 199                         git -C $dir \
 200                             -c core.protectntfs \
 201                             -c core.protecthfs \
 202                             read-tree $tree 2>err &&
 203                 grep "invalid path.*$name" err &&
 204                 git -C $dir ls-files -s >out &&
 205                 test_must_be_empty out
 206         '
 207 }
 208
 209 check_dotx_symlink gitmodules vanilla .gitmodules
 210 check_dotx_symlink gitmodules ntfs ".gitmodules ."
 211 check_dotx_symlink gitmodules hfs ".${u200c}gitmodules"
 212
 213 check_dotx_symlink --warning gitattributes vanilla .gitattributes
 214 check_dotx_symlink --warning gitattributes ntfs ".gitattributes ."
 215 check_dotx_symlink --warning gitattributes hfs ".${u200c}gitattributes"
 216
 217 check_dotx_symlink --warning gitignore vanilla .gitignore
 218 check_dotx_symlink --warning gitignore ntfs ".gitignore ."
 219 check_dotx_symlink --warning gitignore hfs ".${u200c}gitignore"
 220
 221 check_dotx_symlink --warning mailmap vanilla .mailmap
 222 check_dotx_symlink --warning mailmap ntfs ".mailmap ."
 223 check_dotx_symlink --warning mailmap hfs ".${u200c}mailmap"
 224
 225 test_expect_success 'fsck detects non-blob .gitmodules' '
 226         git init non-blob &&
 227         (
 228                 cd non-blob &&
 229
 230                 # As above, make the funny tree directly to avoid index
 231                 # restrictions.
 232                 mkdir subdir &&
 233                 cp ../.gitmodules subdir/file &&
 234                 git add subdir/file &&
 235                 git commit -m ok &&
 236                 git ls-tree HEAD | sed s/subdir/.gitmodules/ | git mktree &&
 237
 238                 test_must_fail git fsck 2>output &&
 239                 test_i18ngrep gitmodulesBlob output
 240         )
 241 '
 242
 243 test_expect_success 'fsck detects corrupt .gitmodules' '
 244         git init corrupt &&
 245         (
 246                 cd corrupt &&
 247
 248                 echo "[broken" >.gitmodules &&
 249                 git add .gitmodules &&
 250                 git commit -m "broken gitmodules" &&
 251
 252                 git fsck 2>output &&
 253                 test_i18ngrep gitmodulesParse output &&
 254                 test_i18ngrep ! "bad config" output
 255         )
 256 '
 257
 258 test_expect_success WINDOWS 'prevent git~1 squatting on Windows' '
 259         git init squatting &&
 260         (
 261                 cd squatting &&
 262                 mkdir a &&
 263                 touch a/..git &&
 264                 git add a/..git &&
 265                 test_tick &&
 266                 git commit -m initial &&
 267
 268                 modules="$(test_write_lines \
 269                         "[submodule \"b.\"]" "url = ." "path = c" \
 270                         "[submodule \"b\"]" "url = ." "path = d\\\\a" |
 271                         git hash-object -w --stdin)" &&
 272                 rev="$(git rev-parse --verify HEAD)" &&
 273                 hash="$(echo x | git hash-object -w --stdin)" &&
 274                 test_must_fail git update-index --add \
 275                         --cacheinfo 160000,$rev,d\\a 2>err &&
 276                 test_i18ngrep "Invalid path" err &&
 277                 git -c core.protectNTFS=false update-index --add \
 278                         --cacheinfo 100644,$modules,.gitmodules \
 279                         --cacheinfo 160000,$rev,c \
 280                         --cacheinfo 160000,$rev,d\\a \
 281                         --cacheinfo 100644,$hash,d./a/x \
 282                         --cacheinfo 100644,$hash,d./a/..git &&
 283                 test_tick &&
 284                 git -c core.protectNTFS=false commit -m "module"
 285         ) &&
 286         if test_have_prereq MINGW
 287         then
 288                 test_must_fail git -c core.protectNTFS=false \
 289                         clone --recurse-submodules squatting squatting-clone 2>err &&
 290                 test_i18ngrep -e "directory not empty" -e "not an empty directory" err &&
 291                 ! grep gitdir squatting-clone/d/a/git~2
 292         fi
 293 '
 294
 295 test_expect_success 'git dirs of sibling submodules must not be nested' '
 296         git init nested &&
 297         test_commit -C nested nested &&
 298         (
 299                 cd nested &&
 300                 cat >.gitmodules <<-EOF &&
 301                 [submodule "hippo"]
 302                         url = .
 303                         path = thing1
 304                 [submodule "hippo/hooks"]
 305                         url = .
 306                         path = thing2
 307                 EOF
 308                 git clone . thing1 &&
 309                 git clone . thing2 &&
 310                 git add .gitmodules thing1 thing2 &&
 311                 test_tick &&
 312                 git commit -m nested
 313         ) &&
 314         test_must_fail git clone --recurse-submodules nested clone 2>err &&
 315         test_i18ngrep "is inside git dir" err
 316 '
 317
 318 test_done