2 #include "object-store.h"
3 #include "repository.h"
17 #include "submodule-config.h"
19 #include "credential.h"
22 static struct oidset gitmodules_found
= OIDSET_INIT
;
23 static struct oidset gitmodules_done
= OIDSET_INIT
;
28 #define FOREACH_MSG_ID(FUNC) \
30 FUNC(NUL_IN_HEADER, FATAL) \
31 FUNC(UNTERMINATED_HEADER, FATAL) \
33 FUNC(BAD_DATE, ERROR) \
34 FUNC(BAD_DATE_OVERFLOW, ERROR) \
35 FUNC(BAD_EMAIL, ERROR) \
36 FUNC(BAD_NAME, ERROR) \
37 FUNC(BAD_OBJECT_SHA1, ERROR) \
38 FUNC(BAD_PARENT_SHA1, ERROR) \
39 FUNC(BAD_TAG_OBJECT, ERROR) \
40 FUNC(BAD_TIMEZONE, ERROR) \
41 FUNC(BAD_TREE, ERROR) \
42 FUNC(BAD_TREE_SHA1, ERROR) \
43 FUNC(BAD_TYPE, ERROR) \
44 FUNC(DUPLICATE_ENTRIES, ERROR) \
45 FUNC(MISSING_AUTHOR, ERROR) \
46 FUNC(MISSING_COMMITTER, ERROR) \
47 FUNC(MISSING_EMAIL, ERROR) \
48 FUNC(MISSING_NAME_BEFORE_EMAIL, ERROR) \
49 FUNC(MISSING_OBJECT, ERROR) \
50 FUNC(MISSING_SPACE_BEFORE_DATE, ERROR) \
51 FUNC(MISSING_SPACE_BEFORE_EMAIL, ERROR) \
52 FUNC(MISSING_TAG, ERROR) \
53 FUNC(MISSING_TAG_ENTRY, ERROR) \
54 FUNC(MISSING_TREE, ERROR) \
55 FUNC(MISSING_TREE_OBJECT, ERROR) \
56 FUNC(MISSING_TYPE, ERROR) \
57 FUNC(MISSING_TYPE_ENTRY, ERROR) \
58 FUNC(MULTIPLE_AUTHORS, ERROR) \
59 FUNC(TREE_NOT_SORTED, ERROR) \
60 FUNC(UNKNOWN_TYPE, ERROR) \
61 FUNC(ZERO_PADDED_DATE, ERROR) \
62 FUNC(GITMODULES_MISSING, ERROR) \
63 FUNC(GITMODULES_BLOB, ERROR) \
64 FUNC(GITMODULES_LARGE, ERROR) \
65 FUNC(GITMODULES_NAME, ERROR) \
66 FUNC(GITMODULES_SYMLINK, ERROR) \
67 FUNC(GITMODULES_URL, ERROR) \
68 FUNC(GITMODULES_PATH, ERROR) \
69 FUNC(GITMODULES_UPDATE, ERROR) \
71 FUNC(BAD_FILEMODE, WARN) \
72 FUNC(EMPTY_NAME, WARN) \
73 FUNC(FULL_PATHNAME, WARN) \
75 FUNC(HAS_DOTDOT, WARN) \
76 FUNC(HAS_DOTGIT, WARN) \
77 FUNC(NULL_SHA1, WARN) \
78 FUNC(ZERO_PADDED_FILEMODE, WARN) \
79 FUNC(NUL_IN_COMMIT, WARN) \
80 /* infos (reported as warnings, but ignored by default) */ \
81 FUNC(GITMODULES_PARSE, INFO) \
82 FUNC(BAD_TAG_NAME, INFO) \
83 FUNC(MISSING_TAGGER_ENTRY, INFO) \
84 /* ignored (elevated when requested) */ \
85 FUNC(EXTRA_HEADER_ENTRY, IGNORE)
87 #define MSG_ID(id, msg_type) FSCK_MSG_##id,
89 FOREACH_MSG_ID(MSG_ID
)
95 #define MSG_ID(id, msg_type) { STR(id), NULL, NULL, FSCK_##msg_type },
97 const char *id_string
;
98 const char *downcased
;
99 const char *camelcased
;
101 } msg_id_info
[FSCK_MSG_MAX
+ 1] = {
102 FOREACH_MSG_ID(MSG_ID
)
103 { NULL
, NULL
, NULL
, -1 }
107 static void prepare_msg_ids(void)
111 if (msg_id_info
[0].downcased
)
114 /* convert id_string to lower case, without underscores. */
115 for (i
= 0; i
< FSCK_MSG_MAX
; i
++) {
116 const char *p
= msg_id_info
[i
].id_string
;
118 char *q
= xmalloc(len
);
120 msg_id_info
[i
].downcased
= q
;
125 *(q
)++ = tolower(*(p
)++);
128 p
= msg_id_info
[i
].id_string
;
130 msg_id_info
[i
].camelcased
= q
;
137 *q
++ = tolower(*p
++);
144 static int parse_msg_id(const char *text
)
150 for (i
= 0; i
< FSCK_MSG_MAX
; i
++)
151 if (!strcmp(text
, msg_id_info
[i
].downcased
))
157 void list_config_fsck_msg_ids(struct string_list
*list
, const char *prefix
)
163 for (i
= 0; i
< FSCK_MSG_MAX
; i
++)
164 list_config_item(list
, prefix
, msg_id_info
[i
].camelcased
);
167 static int fsck_msg_type(enum fsck_msg_id msg_id
,
168 struct fsck_options
*options
)
172 assert(msg_id
>= 0 && msg_id
< FSCK_MSG_MAX
);
174 if (options
->msg_type
)
175 msg_type
= options
->msg_type
[msg_id
];
177 msg_type
= msg_id_info
[msg_id
].msg_type
;
178 if (options
->strict
&& msg_type
== FSCK_WARN
)
179 msg_type
= FSCK_ERROR
;
185 static int parse_msg_type(const char *str
)
187 if (!strcmp(str
, "error"))
189 else if (!strcmp(str
, "warn"))
191 else if (!strcmp(str
, "ignore"))
194 die("Unknown fsck message type: '%s'", str
);
197 int is_valid_msg_type(const char *msg_id
, const char *msg_type
)
199 if (parse_msg_id(msg_id
) < 0)
201 parse_msg_type(msg_type
);
205 void fsck_set_msg_type(struct fsck_options
*options
,
206 const char *msg_id_str
, const char *msg_type_str
)
208 int msg_id
= parse_msg_id(msg_id_str
), msg_type
;
211 die("Unhandled message id: %s", msg_id_str
);
212 msg_type
= parse_msg_type(msg_type_str
);
214 if (msg_type
!= FSCK_ERROR
&& msg_id_info
[msg_id
].msg_type
== FSCK_FATAL
)
215 die("Cannot demote %s to %s", msg_id_str
, msg_type_str
);
217 if (!options
->msg_type
) {
220 ALLOC_ARRAY(severity
, FSCK_MSG_MAX
);
221 for (i
= 0; i
< FSCK_MSG_MAX
; i
++)
222 severity
[i
] = fsck_msg_type(i
, options
);
223 options
->msg_type
= severity
;
226 options
->msg_type
[msg_id
] = msg_type
;
229 void fsck_set_msg_types(struct fsck_options
*options
, const char *values
)
231 char *buf
= xstrdup(values
), *to_free
= buf
;
235 int len
= strcspn(buf
, " ,|"), equal
;
245 equal
< len
&& buf
[equal
] != '=' && buf
[equal
] != ':';
247 buf
[equal
] = tolower(buf
[equal
]);
250 if (!strcmp(buf
, "skiplist")) {
252 die("skiplist requires a path");
253 oidset_parse_file(&options
->skiplist
, buf
+ equal
+ 1);
259 die("Missing '=': '%s'", buf
);
261 fsck_set_msg_type(options
, buf
, buf
+ equal
+ 1);
267 static int object_on_skiplist(struct fsck_options
*opts
,
268 const struct object_id
*oid
)
270 return opts
&& oid
&& oidset_contains(&opts
->skiplist
, oid
);
273 __attribute__((format (printf
, 5, 6)))
274 static int report(struct fsck_options
*options
,
275 const struct object_id
*oid
, enum object_type object_type
,
276 enum fsck_msg_id msg_id
, const char *fmt
, ...)
279 struct strbuf sb
= STRBUF_INIT
;
280 int msg_type
= fsck_msg_type(msg_id
, options
), result
;
282 if (msg_type
== FSCK_IGNORE
)
285 if (object_on_skiplist(options
, oid
))
288 if (msg_type
== FSCK_FATAL
)
289 msg_type
= FSCK_ERROR
;
290 else if (msg_type
== FSCK_INFO
)
291 msg_type
= FSCK_WARN
;
294 strbuf_addf(&sb
, "%s: ", msg_id_info
[msg_id
].camelcased
);
297 strbuf_vaddf(&sb
, fmt
, ap
);
298 result
= options
->error_func(options
, oid
, object_type
,
306 void fsck_enable_object_names(struct fsck_options
*options
)
308 if (!options
->object_names
)
309 options
->object_names
= kh_init_oid_map();
312 const char *fsck_get_object_name(struct fsck_options
*options
,
313 const struct object_id
*oid
)
316 if (!options
->object_names
)
318 pos
= kh_get_oid_map(options
->object_names
, *oid
);
319 if (pos
>= kh_end(options
->object_names
))
321 return kh_value(options
->object_names
, pos
);
324 void fsck_put_object_name(struct fsck_options
*options
,
325 const struct object_id
*oid
,
326 const char *fmt
, ...)
329 struct strbuf buf
= STRBUF_INIT
;
333 if (!options
->object_names
)
336 pos
= kh_put_oid_map(options
->object_names
, *oid
, &hashret
);
340 strbuf_vaddf(&buf
, fmt
, ap
);
341 kh_value(options
->object_names
, pos
) = strbuf_detach(&buf
, NULL
);
345 const char *fsck_describe_object(struct fsck_options
*options
,
346 const struct object_id
*oid
)
348 static struct strbuf bufs
[] = {
349 STRBUF_INIT
, STRBUF_INIT
, STRBUF_INIT
, STRBUF_INIT
353 const char *name
= fsck_get_object_name(options
, oid
);
356 b
= (b
+ 1) % ARRAY_SIZE(bufs
);
358 strbuf_addstr(buf
, oid_to_hex(oid
));
360 strbuf_addf(buf
, " (%s)", name
);
365 static int fsck_walk_tree(struct tree
*tree
, void *data
, struct fsck_options
*options
)
367 struct tree_desc desc
;
368 struct name_entry entry
;
372 if (parse_tree(tree
))
375 name
= fsck_get_object_name(options
, &tree
->object
.oid
);
376 if (init_tree_desc_gently(&desc
, tree
->buffer
, tree
->size
))
378 while (tree_entry_gently(&desc
, &entry
)) {
382 if (S_ISGITLINK(entry
.mode
))
385 if (S_ISDIR(entry
.mode
)) {
386 obj
= (struct object
*)lookup_tree(the_repository
, &entry
.oid
);
388 fsck_put_object_name(options
, &entry
.oid
, "%s%s/",
390 result
= options
->walk(obj
, OBJ_TREE
, data
, options
);
392 else if (S_ISREG(entry
.mode
) || S_ISLNK(entry
.mode
)) {
393 obj
= (struct object
*)lookup_blob(the_repository
, &entry
.oid
);
395 fsck_put_object_name(options
, &entry
.oid
, "%s%s",
397 result
= options
->walk(obj
, OBJ_BLOB
, data
, options
);
400 result
= error("in tree %s: entry %s has bad mode %.6o",
401 fsck_describe_object(options
, &tree
->object
.oid
),
402 entry
.path
, entry
.mode
);
412 static int fsck_walk_commit(struct commit
*commit
, void *data
, struct fsck_options
*options
)
414 int counter
= 0, generation
= 0, name_prefix_len
= 0;
415 struct commit_list
*parents
;
420 if (parse_commit(commit
))
423 name
= fsck_get_object_name(options
, &commit
->object
.oid
);
425 fsck_put_object_name(options
, get_commit_tree_oid(commit
),
428 result
= options
->walk((struct object
*)get_commit_tree(commit
),
429 OBJ_TREE
, data
, options
);
434 parents
= commit
->parents
;
435 if (name
&& parents
) {
436 int len
= strlen(name
), power
;
438 if (len
&& name
[len
- 1] == '^') {
440 name_prefix_len
= len
- 1;
442 else { /* parse ~<generation> suffix */
443 for (generation
= 0, power
= 1;
444 len
&& isdigit(name
[len
- 1]);
446 generation
+= power
* (name
[--len
] - '0');
447 if (power
> 1 && len
&& name
[len
- 1] == '~')
448 name_prefix_len
= len
- 1;
450 /* Maybe a non-first parent, e.g. HEAD^2 */
452 name_prefix_len
= len
;
459 struct object_id
*oid
= &parents
->item
->object
.oid
;
462 fsck_put_object_name(options
, oid
, "%s^%d",
464 else if (generation
> 0)
465 fsck_put_object_name(options
, oid
, "%.*s~%d",
466 name_prefix_len
, name
,
469 fsck_put_object_name(options
, oid
, "%s^", name
);
471 result
= options
->walk((struct object
*)parents
->item
, OBJ_COMMIT
, data
, options
);
476 parents
= parents
->next
;
481 static int fsck_walk_tag(struct tag
*tag
, void *data
, struct fsck_options
*options
)
483 const char *name
= fsck_get_object_name(options
, &tag
->object
.oid
);
488 fsck_put_object_name(options
, &tag
->tagged
->oid
, "%s", name
);
489 return options
->walk(tag
->tagged
, OBJ_ANY
, data
, options
);
492 int fsck_walk(struct object
*obj
, void *data
, struct fsck_options
*options
)
497 if (obj
->type
== OBJ_NONE
)
498 parse_object(the_repository
, &obj
->oid
);
504 return fsck_walk_tree((struct tree
*)obj
, data
, options
);
506 return fsck_walk_commit((struct commit
*)obj
, data
, options
);
508 return fsck_walk_tag((struct tag
*)obj
, data
, options
);
510 error("Unknown object type for %s",
511 fsck_describe_object(options
, &obj
->oid
));
521 static void name_stack_push(struct name_stack
*stack
, const char *name
)
523 ALLOC_GROW(stack
->names
, stack
->nr
+ 1, stack
->alloc
);
524 stack
->names
[stack
->nr
++] = name
;
527 static const char *name_stack_pop(struct name_stack
*stack
)
529 return stack
->nr
? stack
->names
[--stack
->nr
] : NULL
;
532 static void name_stack_clear(struct name_stack
*stack
)
534 FREE_AND_NULL(stack
->names
);
535 stack
->nr
= stack
->alloc
= 0;
539 * The entries in a tree are ordered in the _path_ order,
540 * which means that a directory entry is ordered by adding
541 * a slash to the end of it.
543 * So a directory called "a" is ordered _after_ a file
544 * called "a.c", because "a/" sorts after "a.c".
546 #define TREE_UNORDERED (-1)
547 #define TREE_HAS_DUPS (-2)
549 static int is_less_than_slash(unsigned char c
)
551 return '\0' < c
&& c
< '/';
554 static int verify_ordered(unsigned mode1
, const char *name1
,
555 unsigned mode2
, const char *name2
,
556 struct name_stack
*candidates
)
558 int len1
= strlen(name1
);
559 int len2
= strlen(name2
);
560 int len
= len1
< len2
? len1
: len2
;
561 unsigned char c1
, c2
;
564 cmp
= memcmp(name1
, name2
, len
);
568 return TREE_UNORDERED
;
571 * Ok, the first <len> characters are the same.
572 * Now we need to order the next one, but turn
573 * a '\0' into a '/' for a directory entry.
579 * git-write-tree used to write out a nonsense tree that has
580 * entries with the same name, one blob and one tree. Make
581 * sure we do not have duplicate entries.
583 return TREE_HAS_DUPS
;
584 if (!c1
&& S_ISDIR(mode1
))
586 if (!c2
&& S_ISDIR(mode2
))
590 * There can be non-consecutive duplicates due to the implicitly
599 * Record non-directory candidates (like "foo" and "foo.bar" in
600 * the example) on a stack and check directory candidates (like
601 * foo/" and "foo.bar/") against that stack.
603 if (!c1
&& is_less_than_slash(c2
)) {
604 name_stack_push(candidates
, name1
);
605 } else if (c2
== '/' && is_less_than_slash(c1
)) {
608 const char *f_name
= name_stack_pop(candidates
);
612 if (!skip_prefix(name2
, f_name
, &p
))
615 return TREE_HAS_DUPS
;
616 if (is_less_than_slash(*p
)) {
617 name_stack_push(candidates
, f_name
);
623 return c1
< c2
? 0 : TREE_UNORDERED
;
626 static int fsck_tree(const struct object_id
*oid
,
627 const char *buffer
, unsigned long size
,
628 struct fsck_options
*options
)
631 int has_null_sha1
= 0;
632 int has_full_path
= 0;
633 int has_empty_name
= 0;
637 int has_zero_pad
= 0;
638 int has_bad_modes
= 0;
639 int has_dup_entries
= 0;
640 int not_properly_sorted
= 0;
641 struct tree_desc desc
;
644 struct name_stack df_dup_candidates
= { NULL
};
646 if (init_tree_desc_gently(&desc
, buffer
, size
)) {
647 retval
+= report(options
, oid
, OBJ_TREE
, FSCK_MSG_BAD_TREE
, "cannot be parsed as a tree");
656 const char *name
, *backslash
;
657 const struct object_id
*oid
;
659 oid
= tree_entry_extract(&desc
, &name
, &mode
);
661 has_null_sha1
|= is_null_oid(oid
);
662 has_full_path
|= !!strchr(name
, '/');
663 has_empty_name
|= !*name
;
664 has_dot
|= !strcmp(name
, ".");
665 has_dotdot
|= !strcmp(name
, "..");
666 has_dotgit
|= is_hfs_dotgit(name
) || is_ntfs_dotgit(name
);
667 has_zero_pad
|= *(char *)desc
.buffer
== '0';
669 if (is_hfs_dotgitmodules(name
) || is_ntfs_dotgitmodules(name
)) {
671 oidset_insert(&gitmodules_found
, oid
);
673 retval
+= report(options
,
675 FSCK_MSG_GITMODULES_SYMLINK
,
676 ".gitmodules is a symbolic link");
679 if ((backslash
= strchr(name
, '\\'))) {
682 has_dotgit
|= is_ntfs_dotgit(backslash
);
683 if (is_ntfs_dotgitmodules(backslash
)) {
685 oidset_insert(&gitmodules_found
, oid
);
687 retval
+= report(options
, oid
, OBJ_TREE
,
688 FSCK_MSG_GITMODULES_SYMLINK
,
689 ".gitmodules is a symbolic link");
691 backslash
= strchr(backslash
, '\\');
695 if (update_tree_entry_gently(&desc
)) {
696 retval
+= report(options
, oid
, OBJ_TREE
, FSCK_MSG_BAD_TREE
, "cannot be parsed as a tree");
711 * This is nonstandard, but we had a few of these
712 * early on when we honored the full set of mode
716 if (!options
->strict
)
724 switch (verify_ordered(o_mode
, o_name
, mode
, name
,
725 &df_dup_candidates
)) {
727 not_properly_sorted
= 1;
741 name_stack_clear(&df_dup_candidates
);
744 retval
+= report(options
, oid
, OBJ_TREE
, FSCK_MSG_NULL_SHA1
, "contains entries pointing to null sha1");
746 retval
+= report(options
, oid
, OBJ_TREE
, FSCK_MSG_FULL_PATHNAME
, "contains full pathnames");
748 retval
+= report(options
, oid
, OBJ_TREE
, FSCK_MSG_EMPTY_NAME
, "contains empty pathname");
750 retval
+= report(options
, oid
, OBJ_TREE
, FSCK_MSG_HAS_DOT
, "contains '.'");
752 retval
+= report(options
, oid
, OBJ_TREE
, FSCK_MSG_HAS_DOTDOT
, "contains '..'");
754 retval
+= report(options
, oid
, OBJ_TREE
, FSCK_MSG_HAS_DOTGIT
, "contains '.git'");
756 retval
+= report(options
, oid
, OBJ_TREE
, FSCK_MSG_ZERO_PADDED_FILEMODE
, "contains zero-padded file modes");
758 retval
+= report(options
, oid
, OBJ_TREE
, FSCK_MSG_BAD_FILEMODE
, "contains bad file modes");
760 retval
+= report(options
, oid
, OBJ_TREE
, FSCK_MSG_DUPLICATE_ENTRIES
, "contains duplicate file entries");
761 if (not_properly_sorted
)
762 retval
+= report(options
, oid
, OBJ_TREE
, FSCK_MSG_TREE_NOT_SORTED
, "not properly sorted");
766 static int verify_headers(const void *data
, unsigned long size
,
767 const struct object_id
*oid
, enum object_type type
,
768 struct fsck_options
*options
)
770 const char *buffer
= (const char *)data
;
773 for (i
= 0; i
< size
; i
++) {
776 return report(options
, oid
, type
,
777 FSCK_MSG_NUL_IN_HEADER
,
778 "unterminated header: NUL at offset %ld", i
);
780 if (i
+ 1 < size
&& buffer
[i
+ 1] == '\n')
786 * We did not find double-LF that separates the header
787 * and the body. Not having a body is not a crime but
788 * we do want to see the terminating LF for the last header
791 if (size
&& buffer
[size
- 1] == '\n')
794 return report(options
, oid
, type
,
795 FSCK_MSG_UNTERMINATED_HEADER
, "unterminated header");
798 static int fsck_ident(const char **ident
,
799 const struct object_id
*oid
, enum object_type type
,
800 struct fsck_options
*options
)
802 const char *p
= *ident
;
805 *ident
= strchrnul(*ident
, '\n');
810 return report(options
, oid
, type
, FSCK_MSG_MISSING_NAME_BEFORE_EMAIL
, "invalid author/committer line - missing space before email");
811 p
+= strcspn(p
, "<>\n");
813 return report(options
, oid
, type
, FSCK_MSG_BAD_NAME
, "invalid author/committer line - bad name");
815 return report(options
, oid
, type
, FSCK_MSG_MISSING_EMAIL
, "invalid author/committer line - missing email");
817 return report(options
, oid
, type
, FSCK_MSG_MISSING_SPACE_BEFORE_EMAIL
, "invalid author/committer line - missing space before email");
819 p
+= strcspn(p
, "<>\n");
821 return report(options
, oid
, type
, FSCK_MSG_BAD_EMAIL
, "invalid author/committer line - bad email");
824 return report(options
, oid
, type
, FSCK_MSG_MISSING_SPACE_BEFORE_DATE
, "invalid author/committer line - missing space before date");
826 if (*p
== '0' && p
[1] != ' ')
827 return report(options
, oid
, type
, FSCK_MSG_ZERO_PADDED_DATE
, "invalid author/committer line - zero-padded date");
828 if (date_overflows(parse_timestamp(p
, &end
, 10)))
829 return report(options
, oid
, type
, FSCK_MSG_BAD_DATE_OVERFLOW
, "invalid author/committer line - date causes integer overflow");
830 if ((end
== p
|| *end
!= ' '))
831 return report(options
, oid
, type
, FSCK_MSG_BAD_DATE
, "invalid author/committer line - bad date");
833 if ((*p
!= '+' && *p
!= '-') ||
839 return report(options
, oid
, type
, FSCK_MSG_BAD_TIMEZONE
, "invalid author/committer line - bad time zone");
844 static int fsck_commit(const struct object_id
*oid
,
845 const char *buffer
, unsigned long size
,
846 struct fsck_options
*options
)
848 struct object_id tree_oid
, parent_oid
;
849 unsigned author_count
;
851 const char *buffer_begin
= buffer
;
854 if (verify_headers(buffer
, size
, oid
, OBJ_COMMIT
, options
))
857 if (!skip_prefix(buffer
, "tree ", &buffer
))
858 return report(options
, oid
, OBJ_COMMIT
, FSCK_MSG_MISSING_TREE
, "invalid format - expected 'tree' line");
859 if (parse_oid_hex(buffer
, &tree_oid
, &p
) || *p
!= '\n') {
860 err
= report(options
, oid
, OBJ_COMMIT
, FSCK_MSG_BAD_TREE_SHA1
, "invalid 'tree' line format - bad sha1");
865 while (skip_prefix(buffer
, "parent ", &buffer
)) {
866 if (parse_oid_hex(buffer
, &parent_oid
, &p
) || *p
!= '\n') {
867 err
= report(options
, oid
, OBJ_COMMIT
, FSCK_MSG_BAD_PARENT_SHA1
, "invalid 'parent' line format - bad sha1");
874 while (skip_prefix(buffer
, "author ", &buffer
)) {
876 err
= fsck_ident(&buffer
, oid
, OBJ_COMMIT
, options
);
880 if (author_count
< 1)
881 err
= report(options
, oid
, OBJ_COMMIT
, FSCK_MSG_MISSING_AUTHOR
, "invalid format - expected 'author' line");
882 else if (author_count
> 1)
883 err
= report(options
, oid
, OBJ_COMMIT
, FSCK_MSG_MULTIPLE_AUTHORS
, "invalid format - multiple 'author' lines");
886 if (!skip_prefix(buffer
, "committer ", &buffer
))
887 return report(options
, oid
, OBJ_COMMIT
, FSCK_MSG_MISSING_COMMITTER
, "invalid format - expected 'committer' line");
888 err
= fsck_ident(&buffer
, oid
, OBJ_COMMIT
, options
);
891 if (memchr(buffer_begin
, '\0', size
)) {
892 err
= report(options
, oid
, OBJ_COMMIT
, FSCK_MSG_NUL_IN_COMMIT
,
893 "NUL byte in the commit object body");
900 static int fsck_tag(const struct object_id
*oid
, const char *buffer
,
901 unsigned long size
, struct fsck_options
*options
)
903 struct object_id tagged_oid
;
905 return fsck_tag_standalone(oid
, buffer
, size
, options
, &tagged_oid
,
909 int fsck_tag_standalone(const struct object_id
*oid
, const char *buffer
,
910 unsigned long size
, struct fsck_options
*options
,
911 struct object_id
*tagged_oid
,
916 struct strbuf sb
= STRBUF_INIT
;
919 ret
= verify_headers(buffer
, size
, oid
, OBJ_TAG
, options
);
923 if (!skip_prefix(buffer
, "object ", &buffer
)) {
924 ret
= report(options
, oid
, OBJ_TAG
, FSCK_MSG_MISSING_OBJECT
, "invalid format - expected 'object' line");
927 if (parse_oid_hex(buffer
, tagged_oid
, &p
) || *p
!= '\n') {
928 ret
= report(options
, oid
, OBJ_TAG
, FSCK_MSG_BAD_OBJECT_SHA1
, "invalid 'object' line format - bad sha1");
934 if (!skip_prefix(buffer
, "type ", &buffer
)) {
935 ret
= report(options
, oid
, OBJ_TAG
, FSCK_MSG_MISSING_TYPE_ENTRY
, "invalid format - expected 'type' line");
938 eol
= strchr(buffer
, '\n');
940 ret
= report(options
, oid
, OBJ_TAG
, FSCK_MSG_MISSING_TYPE
, "invalid format - unexpected end after 'type' line");
943 *tagged_type
= type_from_string_gently(buffer
, eol
- buffer
, 1);
944 if (*tagged_type
< 0)
945 ret
= report(options
, oid
, OBJ_TAG
, FSCK_MSG_BAD_TYPE
, "invalid 'type' value");
950 if (!skip_prefix(buffer
, "tag ", &buffer
)) {
951 ret
= report(options
, oid
, OBJ_TAG
, FSCK_MSG_MISSING_TAG_ENTRY
, "invalid format - expected 'tag' line");
954 eol
= strchr(buffer
, '\n');
956 ret
= report(options
, oid
, OBJ_TAG
, FSCK_MSG_MISSING_TAG
, "invalid format - unexpected end after 'type' line");
959 strbuf_addf(&sb
, "refs/tags/%.*s", (int)(eol
- buffer
), buffer
);
960 if (check_refname_format(sb
.buf
, 0)) {
961 ret
= report(options
, oid
, OBJ_TAG
,
962 FSCK_MSG_BAD_TAG_NAME
,
963 "invalid 'tag' name: %.*s",
964 (int)(eol
- buffer
), buffer
);
970 if (!skip_prefix(buffer
, "tagger ", &buffer
)) {
971 /* early tags do not contain 'tagger' lines; warn only */
972 ret
= report(options
, oid
, OBJ_TAG
, FSCK_MSG_MISSING_TAGGER_ENTRY
, "invalid format - expected 'tagger' line");
977 ret
= fsck_ident(&buffer
, oid
, OBJ_TAG
, options
);
981 if (!starts_with(buffer
, "\n")) {
983 * The verify_headers() check will allow
984 * e.g. "[...]tagger <tagger>\nsome
985 * garbage\n\nmessage" to pass, thinking "some
986 * garbage" could be a custom header. E.g. "mktag"
987 * doesn't want any unknown headers.
989 ret
= report(options
, oid
, OBJ_TAG
, FSCK_MSG_EXTRA_HEADER_ENTRY
, "invalid format - extra header(s) after 'tagger'");
1000 * Like builtin/submodule--helper.c's starts_with_dot_slash, but without
1001 * relying on the platform-dependent is_dir_sep helper.
1003 * This is for use in checking whether a submodule URL is interpreted as
1004 * relative to the current directory on any platform, since \ is a
1005 * directory separator on Windows but not on other platforms.
1007 static int starts_with_dot_slash(const char *str
)
1009 return str
[0] == '.' && (str
[1] == '/' || str
[1] == '\\');
1013 * Like starts_with_dot_slash, this is a variant of submodule--helper's
1014 * helper of the same name with the twist that it accepts backslash as a
1015 * directory separator even on non-Windows platforms.
1017 static int starts_with_dot_dot_slash(const char *str
)
1019 return str
[0] == '.' && starts_with_dot_slash(str
+ 1);
1022 static int submodule_url_is_relative(const char *url
)
1024 return starts_with_dot_slash(url
) || starts_with_dot_dot_slash(url
);
1028 * Count directory components that a relative submodule URL should chop
1029 * from the remote_url it is to be resolved against.
1031 * In other words, this counts "../" components at the start of a
1034 * Returns the number of directory components to chop and writes a
1035 * pointer to the next character of url after all leading "./" and
1036 * "../" components to out.
1038 static int count_leading_dotdots(const char *url
, const char **out
)
1042 if (starts_with_dot_dot_slash(url
)) {
1044 url
+= strlen("../");
1047 if (starts_with_dot_slash(url
)) {
1048 url
+= strlen("./");
1056 * Check whether a transport is implemented by git-remote-curl.
1058 * If it is, returns 1 and writes the URL that would be passed to
1059 * git-remote-curl to the "out" parameter.
1061 * Otherwise, returns 0 and leaves "out" untouched.
1064 * http::https://example.com/repo.git -> 1, https://example.com/repo.git
1065 * https://example.com/repo.git -> 1, https://example.com/repo.git
1066 * git://example.com/repo.git -> 0
1068 * This is for use in checking for previously exploitable bugs that
1069 * required a submodule URL to be passed to git-remote-curl.
1071 static int url_to_curl_url(const char *url
, const char **out
)
1074 * We don't need to check for case-aliases, "http.exe", and so
1075 * on because in the default configuration, is_transport_allowed
1076 * prevents URLs with those schemes from being cloned
1079 if (skip_prefix(url
, "http::", out
) ||
1080 skip_prefix(url
, "https::", out
) ||
1081 skip_prefix(url
, "ftp::", out
) ||
1082 skip_prefix(url
, "ftps::", out
))
1084 if (starts_with(url
, "http://") ||
1085 starts_with(url
, "https://") ||
1086 starts_with(url
, "ftp://") ||
1087 starts_with(url
, "ftps://")) {
1094 static int check_submodule_url(const char *url
)
1096 const char *curl_url
;
1098 if (looks_like_command_line_option(url
))
1101 if (submodule_url_is_relative(url
) || starts_with(url
, "git://")) {
1107 * This could be appended to an http URL and url-decoded;
1108 * check for malicious characters.
1110 decoded
= url_decode(url
);
1111 has_nl
= !!strchr(decoded
, '\n');
1118 * URLs which escape their root via "../" can overwrite
1119 * the host field and previous components, resolving to
1120 * URLs like https::example.com/submodule.git and
1121 * https:///example.com/submodule.git that were
1122 * susceptible to CVE-2020-11008.
1124 if (count_leading_dotdots(url
, &next
) > 0 &&
1125 (*next
== ':' || *next
== '/'))
1129 else if (url_to_curl_url(url
, &curl_url
)) {
1130 struct credential c
= CREDENTIAL_INIT
;
1132 if (credential_from_url_gently(&c
, curl_url
, 1) ||
1135 credential_clear(&c
);
1142 struct fsck_gitmodules_data
{
1143 const struct object_id
*oid
;
1144 struct fsck_options
*options
;
1148 static int fsck_gitmodules_fn(const char *var
, const char *value
, void *vdata
)
1150 struct fsck_gitmodules_data
*data
= vdata
;
1151 const char *subsection
, *key
;
1152 size_t subsection_len
;
1155 if (parse_config_key(var
, "submodule", &subsection
, &subsection_len
, &key
) < 0 ||
1159 name
= xmemdupz(subsection
, subsection_len
);
1160 if (check_submodule_name(name
) < 0)
1161 data
->ret
|= report(data
->options
,
1162 data
->oid
, OBJ_BLOB
,
1163 FSCK_MSG_GITMODULES_NAME
,
1164 "disallowed submodule name: %s",
1166 if (!strcmp(key
, "url") && value
&&
1167 check_submodule_url(value
) < 0)
1168 data
->ret
|= report(data
->options
,
1169 data
->oid
, OBJ_BLOB
,
1170 FSCK_MSG_GITMODULES_URL
,
1171 "disallowed submodule url: %s",
1173 if (!strcmp(key
, "path") && value
&&
1174 looks_like_command_line_option(value
))
1175 data
->ret
|= report(data
->options
,
1176 data
->oid
, OBJ_BLOB
,
1177 FSCK_MSG_GITMODULES_PATH
,
1178 "disallowed submodule path: %s",
1180 if (!strcmp(key
, "update") && value
&&
1181 parse_submodule_update_type(value
) == SM_UPDATE_COMMAND
)
1182 data
->ret
|= report(data
->options
, data
->oid
, OBJ_BLOB
,
1183 FSCK_MSG_GITMODULES_UPDATE
,
1184 "disallowed submodule update setting: %s",
1191 static int fsck_blob(const struct object_id
*oid
, const char *buf
,
1192 unsigned long size
, struct fsck_options
*options
)
1194 struct fsck_gitmodules_data data
;
1195 struct config_options config_opts
= { 0 };
1197 if (!oidset_contains(&gitmodules_found
, oid
))
1199 oidset_insert(&gitmodules_done
, oid
);
1201 if (object_on_skiplist(options
, oid
))
1206 * A missing buffer here is a sign that the caller found the
1207 * blob too gigantic to load into memory. Let's just consider
1210 return report(options
, oid
, OBJ_BLOB
,
1211 FSCK_MSG_GITMODULES_LARGE
,
1212 ".gitmodules too large to parse");
1216 data
.options
= options
;
1218 config_opts
.error_action
= CONFIG_ERROR_SILENT
;
1219 if (git_config_from_mem(fsck_gitmodules_fn
, CONFIG_ORIGIN_BLOB
,
1220 ".gitmodules", buf
, size
, &data
, &config_opts
))
1221 data
.ret
|= report(options
, oid
, OBJ_BLOB
,
1222 FSCK_MSG_GITMODULES_PARSE
,
1223 "could not parse gitmodules blob");
1228 int fsck_object(struct object
*obj
, void *data
, unsigned long size
,
1229 struct fsck_options
*options
)
1232 return report(options
, NULL
, OBJ_NONE
, FSCK_MSG_BAD_OBJECT_SHA1
, "no valid object to fsck");
1234 if (obj
->type
== OBJ_BLOB
)
1235 return fsck_blob(&obj
->oid
, data
, size
, options
);
1236 if (obj
->type
== OBJ_TREE
)
1237 return fsck_tree(&obj
->oid
, data
, size
, options
);
1238 if (obj
->type
== OBJ_COMMIT
)
1239 return fsck_commit(&obj
->oid
, data
, size
, options
);
1240 if (obj
->type
== OBJ_TAG
)
1241 return fsck_tag(&obj
->oid
, data
, size
, options
);
1243 return report(options
, &obj
->oid
, obj
->type
,
1244 FSCK_MSG_UNKNOWN_TYPE
,
1245 "unknown type '%d' (internal fsck error)",
1249 int fsck_error_function(struct fsck_options
*o
,
1250 const struct object_id
*oid
,
1251 enum object_type object_type
,
1252 int msg_type
, const char *message
)
1254 if (msg_type
== FSCK_WARN
) {
1255 warning("object %s: %s", fsck_describe_object(o
, oid
), message
);
1258 error("object %s: %s", fsck_describe_object(o
, oid
), message
);
1262 void register_found_gitmodules(const struct object_id
*oid
)
1264 oidset_insert(&gitmodules_found
, oid
);
1267 int fsck_finish(struct fsck_options
*options
)
1270 struct oidset_iter iter
;
1271 const struct object_id
*oid
;
1273 oidset_iter_init(&gitmodules_found
, &iter
);
1274 while ((oid
= oidset_iter_next(&iter
))) {
1275 enum object_type type
;
1279 if (oidset_contains(&gitmodules_done
, oid
))
1282 buf
= read_object_file(oid
, &type
, &size
);
1284 if (is_promisor_object(oid
))
1286 ret
|= report(options
,
1288 FSCK_MSG_GITMODULES_MISSING
,
1289 "unable to read .gitmodules blob");
1293 if (type
== OBJ_BLOB
)
1294 ret
|= fsck_blob(oid
, buf
, size
, options
);
1296 ret
|= report(options
,
1298 FSCK_MSG_GITMODULES_BLOB
,
1299 "non-blob found at .gitmodules");
1304 oidset_clear(&gitmodules_found
);
1305 oidset_clear(&gitmodules_done
);
1309 int git_fsck_config(const char *var
, const char *value
, void *cb
)
1311 struct fsck_options
*options
= cb
;
1312 if (strcmp(var
, "fsck.skiplist") == 0) {
1314 struct strbuf sb
= STRBUF_INIT
;
1316 if (git_config_pathname(&path
, var
, value
))
1318 strbuf_addf(&sb
, "skiplist=%s", path
);
1320 fsck_set_msg_types(options
, sb
.buf
);
1321 strbuf_release(&sb
);
1325 if (skip_prefix(var
, "fsck.", &var
)) {
1326 fsck_set_msg_type(options
, var
, value
);
1330 return git_default_config(var
, value
, cb
);