2 #include "object-store.h"
3 #include "repository.h"
17 #include "submodule-config.h"
19 #include "credential.h"
23 #define MSG_ID(id, msg_type) { STR(id), NULL, NULL, FSCK_##msg_type },
25 const char *id_string
;
26 const char *downcased
;
27 const char *camelcased
;
28 enum fsck_msg_type msg_type
;
29 } msg_id_info
[FSCK_MSG_MAX
+ 1] = {
30 FOREACH_FSCK_MSG_ID(MSG_ID
)
31 { NULL
, NULL
, NULL
, -1 }
36 static void prepare_msg_ids(void)
40 if (msg_id_info
[0].downcased
)
43 /* convert id_string to lower case, without underscores. */
44 for (i
= 0; i
< FSCK_MSG_MAX
; i
++) {
45 const char *p
= msg_id_info
[i
].id_string
;
47 char *q
= xmalloc(len
);
49 msg_id_info
[i
].downcased
= q
;
54 *(q
)++ = tolower(*(p
)++);
57 p
= msg_id_info
[i
].id_string
;
59 msg_id_info
[i
].camelcased
= q
;
73 static int parse_msg_id(const char *text
)
79 for (i
= 0; i
< FSCK_MSG_MAX
; i
++)
80 if (!strcmp(text
, msg_id_info
[i
].downcased
))
86 void list_config_fsck_msg_ids(struct string_list
*list
, const char *prefix
)
92 for (i
= 0; i
< FSCK_MSG_MAX
; i
++)
93 list_config_item(list
, prefix
, msg_id_info
[i
].camelcased
);
96 static enum fsck_msg_type
fsck_msg_type(enum fsck_msg_id msg_id
,
97 struct fsck_options
*options
)
99 assert(msg_id
>= 0 && msg_id
< FSCK_MSG_MAX
);
101 if (!options
->msg_type
) {
102 enum fsck_msg_type msg_type
= msg_id_info
[msg_id
].msg_type
;
104 if (options
->strict
&& msg_type
== FSCK_WARN
)
105 msg_type
= FSCK_ERROR
;
109 return options
->msg_type
[msg_id
];
112 static enum fsck_msg_type
parse_msg_type(const char *str
)
114 if (!strcmp(str
, "error"))
116 else if (!strcmp(str
, "warn"))
118 else if (!strcmp(str
, "ignore"))
121 die("Unknown fsck message type: '%s'", str
);
124 int is_valid_msg_type(const char *msg_id
, const char *msg_type
)
126 if (parse_msg_id(msg_id
) < 0)
128 parse_msg_type(msg_type
);
132 void fsck_set_msg_type_from_ids(struct fsck_options
*options
,
133 enum fsck_msg_id msg_id
,
134 enum fsck_msg_type msg_type
)
136 if (!options
->msg_type
) {
138 enum fsck_msg_type
*severity
;
139 ALLOC_ARRAY(severity
, FSCK_MSG_MAX
);
140 for (i
= 0; i
< FSCK_MSG_MAX
; i
++)
141 severity
[i
] = fsck_msg_type(i
, options
);
142 options
->msg_type
= severity
;
145 options
->msg_type
[msg_id
] = msg_type
;
148 void fsck_set_msg_type(struct fsck_options
*options
,
149 const char *msg_id_str
, const char *msg_type_str
)
151 int msg_id
= parse_msg_id(msg_id_str
);
152 enum fsck_msg_type msg_type
= parse_msg_type(msg_type_str
);
155 die("Unhandled message id: %s", msg_id_str
);
157 if (msg_type
!= FSCK_ERROR
&& msg_id_info
[msg_id
].msg_type
== FSCK_FATAL
)
158 die("Cannot demote %s to %s", msg_id_str
, msg_type_str
);
160 fsck_set_msg_type_from_ids(options
, msg_id
, msg_type
);
163 void fsck_set_msg_types(struct fsck_options
*options
, const char *values
)
165 char *buf
= xstrdup(values
), *to_free
= buf
;
169 int len
= strcspn(buf
, " ,|"), equal
;
179 equal
< len
&& buf
[equal
] != '=' && buf
[equal
] != ':';
181 buf
[equal
] = tolower(buf
[equal
]);
184 if (!strcmp(buf
, "skiplist")) {
186 die("skiplist requires a path");
187 oidset_parse_file(&options
->skiplist
, buf
+ equal
+ 1);
193 die("Missing '=': '%s'", buf
);
195 fsck_set_msg_type(options
, buf
, buf
+ equal
+ 1);
201 static int object_on_skiplist(struct fsck_options
*opts
,
202 const struct object_id
*oid
)
204 return opts
&& oid
&& oidset_contains(&opts
->skiplist
, oid
);
207 __attribute__((format (printf
, 5, 6)))
208 static int report(struct fsck_options
*options
,
209 const struct object_id
*oid
, enum object_type object_type
,
210 enum fsck_msg_id msg_id
, const char *fmt
, ...)
213 struct strbuf sb
= STRBUF_INIT
;
214 enum fsck_msg_type msg_type
= fsck_msg_type(msg_id
, options
);
217 if (msg_type
== FSCK_IGNORE
)
220 if (object_on_skiplist(options
, oid
))
223 if (msg_type
== FSCK_FATAL
)
224 msg_type
= FSCK_ERROR
;
225 else if (msg_type
== FSCK_INFO
)
226 msg_type
= FSCK_WARN
;
229 strbuf_addf(&sb
, "%s: ", msg_id_info
[msg_id
].camelcased
);
232 strbuf_vaddf(&sb
, fmt
, ap
);
233 result
= options
->error_func(options
, oid
, object_type
,
234 msg_type
, msg_id
, sb
.buf
);
241 void fsck_enable_object_names(struct fsck_options
*options
)
243 if (!options
->object_names
)
244 options
->object_names
= kh_init_oid_map();
247 const char *fsck_get_object_name(struct fsck_options
*options
,
248 const struct object_id
*oid
)
251 if (!options
->object_names
)
253 pos
= kh_get_oid_map(options
->object_names
, *oid
);
254 if (pos
>= kh_end(options
->object_names
))
256 return kh_value(options
->object_names
, pos
);
259 void fsck_put_object_name(struct fsck_options
*options
,
260 const struct object_id
*oid
,
261 const char *fmt
, ...)
264 struct strbuf buf
= STRBUF_INIT
;
268 if (!options
->object_names
)
271 pos
= kh_put_oid_map(options
->object_names
, *oid
, &hashret
);
275 strbuf_vaddf(&buf
, fmt
, ap
);
276 kh_value(options
->object_names
, pos
) = strbuf_detach(&buf
, NULL
);
280 const char *fsck_describe_object(struct fsck_options
*options
,
281 const struct object_id
*oid
)
283 static struct strbuf bufs
[] = {
284 STRBUF_INIT
, STRBUF_INIT
, STRBUF_INIT
, STRBUF_INIT
288 const char *name
= fsck_get_object_name(options
, oid
);
291 b
= (b
+ 1) % ARRAY_SIZE(bufs
);
293 strbuf_addstr(buf
, oid_to_hex(oid
));
295 strbuf_addf(buf
, " (%s)", name
);
300 static int fsck_walk_tree(struct tree
*tree
, void *data
, struct fsck_options
*options
)
302 struct tree_desc desc
;
303 struct name_entry entry
;
307 if (parse_tree(tree
))
310 name
= fsck_get_object_name(options
, &tree
->object
.oid
);
311 if (init_tree_desc_gently(&desc
, tree
->buffer
, tree
->size
))
313 while (tree_entry_gently(&desc
, &entry
)) {
317 if (S_ISGITLINK(entry
.mode
))
320 if (S_ISDIR(entry
.mode
)) {
321 obj
= (struct object
*)lookup_tree(the_repository
, &entry
.oid
);
323 fsck_put_object_name(options
, &entry
.oid
, "%s%s/",
325 result
= options
->walk(obj
, OBJ_TREE
, data
, options
);
327 else if (S_ISREG(entry
.mode
) || S_ISLNK(entry
.mode
)) {
328 obj
= (struct object
*)lookup_blob(the_repository
, &entry
.oid
);
330 fsck_put_object_name(options
, &entry
.oid
, "%s%s",
332 result
= options
->walk(obj
, OBJ_BLOB
, data
, options
);
335 result
= error("in tree %s: entry %s has bad mode %.6o",
336 fsck_describe_object(options
, &tree
->object
.oid
),
337 entry
.path
, entry
.mode
);
347 static int fsck_walk_commit(struct commit
*commit
, void *data
, struct fsck_options
*options
)
349 int counter
= 0, generation
= 0, name_prefix_len
= 0;
350 struct commit_list
*parents
;
355 if (parse_commit(commit
))
358 name
= fsck_get_object_name(options
, &commit
->object
.oid
);
360 fsck_put_object_name(options
, get_commit_tree_oid(commit
),
363 result
= options
->walk((struct object
*)get_commit_tree(commit
),
364 OBJ_TREE
, data
, options
);
369 parents
= commit
->parents
;
370 if (name
&& parents
) {
371 int len
= strlen(name
), power
;
373 if (len
&& name
[len
- 1] == '^') {
375 name_prefix_len
= len
- 1;
377 else { /* parse ~<generation> suffix */
378 for (generation
= 0, power
= 1;
379 len
&& isdigit(name
[len
- 1]);
381 generation
+= power
* (name
[--len
] - '0');
382 if (power
> 1 && len
&& name
[len
- 1] == '~')
383 name_prefix_len
= len
- 1;
385 /* Maybe a non-first parent, e.g. HEAD^2 */
387 name_prefix_len
= len
;
394 struct object_id
*oid
= &parents
->item
->object
.oid
;
397 fsck_put_object_name(options
, oid
, "%s^%d",
399 else if (generation
> 0)
400 fsck_put_object_name(options
, oid
, "%.*s~%d",
401 name_prefix_len
, name
,
404 fsck_put_object_name(options
, oid
, "%s^", name
);
406 result
= options
->walk((struct object
*)parents
->item
, OBJ_COMMIT
, data
, options
);
411 parents
= parents
->next
;
416 static int fsck_walk_tag(struct tag
*tag
, void *data
, struct fsck_options
*options
)
418 const char *name
= fsck_get_object_name(options
, &tag
->object
.oid
);
423 fsck_put_object_name(options
, &tag
->tagged
->oid
, "%s", name
);
424 return options
->walk(tag
->tagged
, OBJ_ANY
, data
, options
);
427 int fsck_walk(struct object
*obj
, void *data
, struct fsck_options
*options
)
432 if (obj
->type
== OBJ_NONE
)
433 parse_object(the_repository
, &obj
->oid
);
439 return fsck_walk_tree((struct tree
*)obj
, data
, options
);
441 return fsck_walk_commit((struct commit
*)obj
, data
, options
);
443 return fsck_walk_tag((struct tag
*)obj
, data
, options
);
445 error("Unknown object type for %s",
446 fsck_describe_object(options
, &obj
->oid
));
456 static void name_stack_push(struct name_stack
*stack
, const char *name
)
458 ALLOC_GROW(stack
->names
, stack
->nr
+ 1, stack
->alloc
);
459 stack
->names
[stack
->nr
++] = name
;
462 static const char *name_stack_pop(struct name_stack
*stack
)
464 return stack
->nr
? stack
->names
[--stack
->nr
] : NULL
;
467 static void name_stack_clear(struct name_stack
*stack
)
469 FREE_AND_NULL(stack
->names
);
470 stack
->nr
= stack
->alloc
= 0;
474 * The entries in a tree are ordered in the _path_ order,
475 * which means that a directory entry is ordered by adding
476 * a slash to the end of it.
478 * So a directory called "a" is ordered _after_ a file
479 * called "a.c", because "a/" sorts after "a.c".
481 #define TREE_UNORDERED (-1)
482 #define TREE_HAS_DUPS (-2)
484 static int is_less_than_slash(unsigned char c
)
486 return '\0' < c
&& c
< '/';
489 static int verify_ordered(unsigned mode1
, const char *name1
,
490 unsigned mode2
, const char *name2
,
491 struct name_stack
*candidates
)
493 int len1
= strlen(name1
);
494 int len2
= strlen(name2
);
495 int len
= len1
< len2
? len1
: len2
;
496 unsigned char c1
, c2
;
499 cmp
= memcmp(name1
, name2
, len
);
503 return TREE_UNORDERED
;
506 * Ok, the first <len> characters are the same.
507 * Now we need to order the next one, but turn
508 * a '\0' into a '/' for a directory entry.
514 * git-write-tree used to write out a nonsense tree that has
515 * entries with the same name, one blob and one tree. Make
516 * sure we do not have duplicate entries.
518 return TREE_HAS_DUPS
;
519 if (!c1
&& S_ISDIR(mode1
))
521 if (!c2
&& S_ISDIR(mode2
))
525 * There can be non-consecutive duplicates due to the implicitly
534 * Record non-directory candidates (like "foo" and "foo.bar" in
535 * the example) on a stack and check directory candidates (like
536 * foo/" and "foo.bar/") against that stack.
538 if (!c1
&& is_less_than_slash(c2
)) {
539 name_stack_push(candidates
, name1
);
540 } else if (c2
== '/' && is_less_than_slash(c1
)) {
543 const char *f_name
= name_stack_pop(candidates
);
547 if (!skip_prefix(name2
, f_name
, &p
))
550 return TREE_HAS_DUPS
;
551 if (is_less_than_slash(*p
)) {
552 name_stack_push(candidates
, f_name
);
558 return c1
< c2
? 0 : TREE_UNORDERED
;
561 static int fsck_tree(const struct object_id
*tree_oid
,
562 const char *buffer
, unsigned long size
,
563 struct fsck_options
*options
)
566 int has_null_sha1
= 0;
567 int has_full_path
= 0;
568 int has_empty_name
= 0;
572 int has_zero_pad
= 0;
573 int has_bad_modes
= 0;
574 int has_dup_entries
= 0;
575 int not_properly_sorted
= 0;
576 struct tree_desc desc
;
579 struct name_stack df_dup_candidates
= { NULL
};
581 if (init_tree_desc_gently(&desc
, buffer
, size
)) {
582 retval
+= report(options
, tree_oid
, OBJ_TREE
,
584 "cannot be parsed as a tree");
593 const char *name
, *backslash
;
594 const struct object_id
*entry_oid
;
596 entry_oid
= tree_entry_extract(&desc
, &name
, &mode
);
598 has_null_sha1
|= is_null_oid(entry_oid
);
599 has_full_path
|= !!strchr(name
, '/');
600 has_empty_name
|= !*name
;
601 has_dot
|= !strcmp(name
, ".");
602 has_dotdot
|= !strcmp(name
, "..");
603 has_dotgit
|= is_hfs_dotgit(name
) || is_ntfs_dotgit(name
);
604 has_zero_pad
|= *(char *)desc
.buffer
== '0';
606 if (is_hfs_dotgitmodules(name
) || is_ntfs_dotgitmodules(name
)) {
608 oidset_insert(&options
->gitmodules_found
,
611 retval
+= report(options
,
613 FSCK_MSG_GITMODULES_SYMLINK
,
614 ".gitmodules is a symbolic link");
617 if ((backslash
= strchr(name
, '\\'))) {
620 has_dotgit
|= is_ntfs_dotgit(backslash
);
621 if (is_ntfs_dotgitmodules(backslash
)) {
623 oidset_insert(&options
->gitmodules_found
,
626 retval
+= report(options
, tree_oid
, OBJ_TREE
,
627 FSCK_MSG_GITMODULES_SYMLINK
,
628 ".gitmodules is a symbolic link");
630 backslash
= strchr(backslash
, '\\');
634 if (update_tree_entry_gently(&desc
)) {
635 retval
+= report(options
, tree_oid
, OBJ_TREE
,
637 "cannot be parsed as a tree");
652 * This is nonstandard, but we had a few of these
653 * early on when we honored the full set of mode
657 if (!options
->strict
)
665 switch (verify_ordered(o_mode
, o_name
, mode
, name
,
666 &df_dup_candidates
)) {
668 not_properly_sorted
= 1;
682 name_stack_clear(&df_dup_candidates
);
685 retval
+= report(options
, tree_oid
, OBJ_TREE
,
687 "contains entries pointing to null sha1");
689 retval
+= report(options
, tree_oid
, OBJ_TREE
,
690 FSCK_MSG_FULL_PATHNAME
,
691 "contains full pathnames");
693 retval
+= report(options
, tree_oid
, OBJ_TREE
,
695 "contains empty pathname");
697 retval
+= report(options
, tree_oid
, OBJ_TREE
,
701 retval
+= report(options
, tree_oid
, OBJ_TREE
,
705 retval
+= report(options
, tree_oid
, OBJ_TREE
,
709 retval
+= report(options
, tree_oid
, OBJ_TREE
,
710 FSCK_MSG_ZERO_PADDED_FILEMODE
,
711 "contains zero-padded file modes");
713 retval
+= report(options
, tree_oid
, OBJ_TREE
,
714 FSCK_MSG_BAD_FILEMODE
,
715 "contains bad file modes");
717 retval
+= report(options
, tree_oid
, OBJ_TREE
,
718 FSCK_MSG_DUPLICATE_ENTRIES
,
719 "contains duplicate file entries");
720 if (not_properly_sorted
)
721 retval
+= report(options
, tree_oid
, OBJ_TREE
,
722 FSCK_MSG_TREE_NOT_SORTED
,
723 "not properly sorted");
727 static int verify_headers(const void *data
, unsigned long size
,
728 const struct object_id
*oid
, enum object_type type
,
729 struct fsck_options
*options
)
731 const char *buffer
= (const char *)data
;
734 for (i
= 0; i
< size
; i
++) {
737 return report(options
, oid
, type
,
738 FSCK_MSG_NUL_IN_HEADER
,
739 "unterminated header: NUL at offset %ld", i
);
741 if (i
+ 1 < size
&& buffer
[i
+ 1] == '\n')
747 * We did not find double-LF that separates the header
748 * and the body. Not having a body is not a crime but
749 * we do want to see the terminating LF for the last header
752 if (size
&& buffer
[size
- 1] == '\n')
755 return report(options
, oid
, type
,
756 FSCK_MSG_UNTERMINATED_HEADER
, "unterminated header");
759 static int fsck_ident(const char **ident
,
760 const struct object_id
*oid
, enum object_type type
,
761 struct fsck_options
*options
)
763 const char *p
= *ident
;
766 *ident
= strchrnul(*ident
, '\n');
771 return report(options
, oid
, type
, FSCK_MSG_MISSING_NAME_BEFORE_EMAIL
, "invalid author/committer line - missing space before email");
772 p
+= strcspn(p
, "<>\n");
774 return report(options
, oid
, type
, FSCK_MSG_BAD_NAME
, "invalid author/committer line - bad name");
776 return report(options
, oid
, type
, FSCK_MSG_MISSING_EMAIL
, "invalid author/committer line - missing email");
778 return report(options
, oid
, type
, FSCK_MSG_MISSING_SPACE_BEFORE_EMAIL
, "invalid author/committer line - missing space before email");
780 p
+= strcspn(p
, "<>\n");
782 return report(options
, oid
, type
, FSCK_MSG_BAD_EMAIL
, "invalid author/committer line - bad email");
785 return report(options
, oid
, type
, FSCK_MSG_MISSING_SPACE_BEFORE_DATE
, "invalid author/committer line - missing space before date");
787 if (*p
== '0' && p
[1] != ' ')
788 return report(options
, oid
, type
, FSCK_MSG_ZERO_PADDED_DATE
, "invalid author/committer line - zero-padded date");
789 if (date_overflows(parse_timestamp(p
, &end
, 10)))
790 return report(options
, oid
, type
, FSCK_MSG_BAD_DATE_OVERFLOW
, "invalid author/committer line - date causes integer overflow");
791 if ((end
== p
|| *end
!= ' '))
792 return report(options
, oid
, type
, FSCK_MSG_BAD_DATE
, "invalid author/committer line - bad date");
794 if ((*p
!= '+' && *p
!= '-') ||
800 return report(options
, oid
, type
, FSCK_MSG_BAD_TIMEZONE
, "invalid author/committer line - bad time zone");
805 static int fsck_commit(const struct object_id
*oid
,
806 const char *buffer
, unsigned long size
,
807 struct fsck_options
*options
)
809 struct object_id tree_oid
, parent_oid
;
810 unsigned author_count
;
812 const char *buffer_begin
= buffer
;
815 if (verify_headers(buffer
, size
, oid
, OBJ_COMMIT
, options
))
818 if (!skip_prefix(buffer
, "tree ", &buffer
))
819 return report(options
, oid
, OBJ_COMMIT
, FSCK_MSG_MISSING_TREE
, "invalid format - expected 'tree' line");
820 if (parse_oid_hex(buffer
, &tree_oid
, &p
) || *p
!= '\n') {
821 err
= report(options
, oid
, OBJ_COMMIT
, FSCK_MSG_BAD_TREE_SHA1
, "invalid 'tree' line format - bad sha1");
826 while (skip_prefix(buffer
, "parent ", &buffer
)) {
827 if (parse_oid_hex(buffer
, &parent_oid
, &p
) || *p
!= '\n') {
828 err
= report(options
, oid
, OBJ_COMMIT
, FSCK_MSG_BAD_PARENT_SHA1
, "invalid 'parent' line format - bad sha1");
835 while (skip_prefix(buffer
, "author ", &buffer
)) {
837 err
= fsck_ident(&buffer
, oid
, OBJ_COMMIT
, options
);
841 if (author_count
< 1)
842 err
= report(options
, oid
, OBJ_COMMIT
, FSCK_MSG_MISSING_AUTHOR
, "invalid format - expected 'author' line");
843 else if (author_count
> 1)
844 err
= report(options
, oid
, OBJ_COMMIT
, FSCK_MSG_MULTIPLE_AUTHORS
, "invalid format - multiple 'author' lines");
847 if (!skip_prefix(buffer
, "committer ", &buffer
))
848 return report(options
, oid
, OBJ_COMMIT
, FSCK_MSG_MISSING_COMMITTER
, "invalid format - expected 'committer' line");
849 err
= fsck_ident(&buffer
, oid
, OBJ_COMMIT
, options
);
852 if (memchr(buffer_begin
, '\0', size
)) {
853 err
= report(options
, oid
, OBJ_COMMIT
, FSCK_MSG_NUL_IN_COMMIT
,
854 "NUL byte in the commit object body");
861 static int fsck_tag(const struct object_id
*oid
, const char *buffer
,
862 unsigned long size
, struct fsck_options
*options
)
864 struct object_id tagged_oid
;
866 return fsck_tag_standalone(oid
, buffer
, size
, options
, &tagged_oid
,
870 int fsck_tag_standalone(const struct object_id
*oid
, const char *buffer
,
871 unsigned long size
, struct fsck_options
*options
,
872 struct object_id
*tagged_oid
,
877 struct strbuf sb
= STRBUF_INIT
;
880 ret
= verify_headers(buffer
, size
, oid
, OBJ_TAG
, options
);
884 if (!skip_prefix(buffer
, "object ", &buffer
)) {
885 ret
= report(options
, oid
, OBJ_TAG
, FSCK_MSG_MISSING_OBJECT
, "invalid format - expected 'object' line");
888 if (parse_oid_hex(buffer
, tagged_oid
, &p
) || *p
!= '\n') {
889 ret
= report(options
, oid
, OBJ_TAG
, FSCK_MSG_BAD_OBJECT_SHA1
, "invalid 'object' line format - bad sha1");
895 if (!skip_prefix(buffer
, "type ", &buffer
)) {
896 ret
= report(options
, oid
, OBJ_TAG
, FSCK_MSG_MISSING_TYPE_ENTRY
, "invalid format - expected 'type' line");
899 eol
= strchr(buffer
, '\n');
901 ret
= report(options
, oid
, OBJ_TAG
, FSCK_MSG_MISSING_TYPE
, "invalid format - unexpected end after 'type' line");
904 *tagged_type
= type_from_string_gently(buffer
, eol
- buffer
, 1);
905 if (*tagged_type
< 0)
906 ret
= report(options
, oid
, OBJ_TAG
, FSCK_MSG_BAD_TYPE
, "invalid 'type' value");
911 if (!skip_prefix(buffer
, "tag ", &buffer
)) {
912 ret
= report(options
, oid
, OBJ_TAG
, FSCK_MSG_MISSING_TAG_ENTRY
, "invalid format - expected 'tag' line");
915 eol
= strchr(buffer
, '\n');
917 ret
= report(options
, oid
, OBJ_TAG
, FSCK_MSG_MISSING_TAG
, "invalid format - unexpected end after 'type' line");
920 strbuf_addf(&sb
, "refs/tags/%.*s", (int)(eol
- buffer
), buffer
);
921 if (check_refname_format(sb
.buf
, 0)) {
922 ret
= report(options
, oid
, OBJ_TAG
,
923 FSCK_MSG_BAD_TAG_NAME
,
924 "invalid 'tag' name: %.*s",
925 (int)(eol
- buffer
), buffer
);
931 if (!skip_prefix(buffer
, "tagger ", &buffer
)) {
932 /* early tags do not contain 'tagger' lines; warn only */
933 ret
= report(options
, oid
, OBJ_TAG
, FSCK_MSG_MISSING_TAGGER_ENTRY
, "invalid format - expected 'tagger' line");
938 ret
= fsck_ident(&buffer
, oid
, OBJ_TAG
, options
);
942 if (!starts_with(buffer
, "\n")) {
944 * The verify_headers() check will allow
945 * e.g. "[...]tagger <tagger>\nsome
946 * garbage\n\nmessage" to pass, thinking "some
947 * garbage" could be a custom header. E.g. "mktag"
948 * doesn't want any unknown headers.
950 ret
= report(options
, oid
, OBJ_TAG
, FSCK_MSG_EXTRA_HEADER_ENTRY
, "invalid format - extra header(s) after 'tagger'");
961 * Like builtin/submodule--helper.c's starts_with_dot_slash, but without
962 * relying on the platform-dependent is_dir_sep helper.
964 * This is for use in checking whether a submodule URL is interpreted as
965 * relative to the current directory on any platform, since \ is a
966 * directory separator on Windows but not on other platforms.
968 static int starts_with_dot_slash(const char *str
)
970 return str
[0] == '.' && (str
[1] == '/' || str
[1] == '\\');
974 * Like starts_with_dot_slash, this is a variant of submodule--helper's
975 * helper of the same name with the twist that it accepts backslash as a
976 * directory separator even on non-Windows platforms.
978 static int starts_with_dot_dot_slash(const char *str
)
980 return str
[0] == '.' && starts_with_dot_slash(str
+ 1);
983 static int submodule_url_is_relative(const char *url
)
985 return starts_with_dot_slash(url
) || starts_with_dot_dot_slash(url
);
989 * Count directory components that a relative submodule URL should chop
990 * from the remote_url it is to be resolved against.
992 * In other words, this counts "../" components at the start of a
995 * Returns the number of directory components to chop and writes a
996 * pointer to the next character of url after all leading "./" and
997 * "../" components to out.
999 static int count_leading_dotdots(const char *url
, const char **out
)
1003 if (starts_with_dot_dot_slash(url
)) {
1005 url
+= strlen("../");
1008 if (starts_with_dot_slash(url
)) {
1009 url
+= strlen("./");
1017 * Check whether a transport is implemented by git-remote-curl.
1019 * If it is, returns 1 and writes the URL that would be passed to
1020 * git-remote-curl to the "out" parameter.
1022 * Otherwise, returns 0 and leaves "out" untouched.
1025 * http::https://example.com/repo.git -> 1, https://example.com/repo.git
1026 * https://example.com/repo.git -> 1, https://example.com/repo.git
1027 * git://example.com/repo.git -> 0
1029 * This is for use in checking for previously exploitable bugs that
1030 * required a submodule URL to be passed to git-remote-curl.
1032 static int url_to_curl_url(const char *url
, const char **out
)
1035 * We don't need to check for case-aliases, "http.exe", and so
1036 * on because in the default configuration, is_transport_allowed
1037 * prevents URLs with those schemes from being cloned
1040 if (skip_prefix(url
, "http::", out
) ||
1041 skip_prefix(url
, "https::", out
) ||
1042 skip_prefix(url
, "ftp::", out
) ||
1043 skip_prefix(url
, "ftps::", out
))
1045 if (starts_with(url
, "http://") ||
1046 starts_with(url
, "https://") ||
1047 starts_with(url
, "ftp://") ||
1048 starts_with(url
, "ftps://")) {
1055 static int check_submodule_url(const char *url
)
1057 const char *curl_url
;
1059 if (looks_like_command_line_option(url
))
1062 if (submodule_url_is_relative(url
) || starts_with(url
, "git://")) {
1068 * This could be appended to an http URL and url-decoded;
1069 * check for malicious characters.
1071 decoded
= url_decode(url
);
1072 has_nl
= !!strchr(decoded
, '\n');
1079 * URLs which escape their root via "../" can overwrite
1080 * the host field and previous components, resolving to
1081 * URLs like https::example.com/submodule.git and
1082 * https:///example.com/submodule.git that were
1083 * susceptible to CVE-2020-11008.
1085 if (count_leading_dotdots(url
, &next
) > 0 &&
1086 (*next
== ':' || *next
== '/'))
1090 else if (url_to_curl_url(url
, &curl_url
)) {
1091 struct credential c
= CREDENTIAL_INIT
;
1093 if (credential_from_url_gently(&c
, curl_url
, 1) ||
1096 credential_clear(&c
);
1103 struct fsck_gitmodules_data
{
1104 const struct object_id
*oid
;
1105 struct fsck_options
*options
;
1109 static int fsck_gitmodules_fn(const char *var
, const char *value
, void *vdata
)
1111 struct fsck_gitmodules_data
*data
= vdata
;
1112 const char *subsection
, *key
;
1113 size_t subsection_len
;
1116 if (parse_config_key(var
, "submodule", &subsection
, &subsection_len
, &key
) < 0 ||
1120 name
= xmemdupz(subsection
, subsection_len
);
1121 if (check_submodule_name(name
) < 0)
1122 data
->ret
|= report(data
->options
,
1123 data
->oid
, OBJ_BLOB
,
1124 FSCK_MSG_GITMODULES_NAME
,
1125 "disallowed submodule name: %s",
1127 if (!strcmp(key
, "url") && value
&&
1128 check_submodule_url(value
) < 0)
1129 data
->ret
|= report(data
->options
,
1130 data
->oid
, OBJ_BLOB
,
1131 FSCK_MSG_GITMODULES_URL
,
1132 "disallowed submodule url: %s",
1134 if (!strcmp(key
, "path") && value
&&
1135 looks_like_command_line_option(value
))
1136 data
->ret
|= report(data
->options
,
1137 data
->oid
, OBJ_BLOB
,
1138 FSCK_MSG_GITMODULES_PATH
,
1139 "disallowed submodule path: %s",
1141 if (!strcmp(key
, "update") && value
&&
1142 parse_submodule_update_type(value
) == SM_UPDATE_COMMAND
)
1143 data
->ret
|= report(data
->options
, data
->oid
, OBJ_BLOB
,
1144 FSCK_MSG_GITMODULES_UPDATE
,
1145 "disallowed submodule update setting: %s",
1152 static int fsck_blob(const struct object_id
*oid
, const char *buf
,
1153 unsigned long size
, struct fsck_options
*options
)
1155 struct fsck_gitmodules_data data
;
1156 struct config_options config_opts
= { 0 };
1158 if (!oidset_contains(&options
->gitmodules_found
, oid
))
1160 oidset_insert(&options
->gitmodules_done
, oid
);
1162 if (object_on_skiplist(options
, oid
))
1167 * A missing buffer here is a sign that the caller found the
1168 * blob too gigantic to load into memory. Let's just consider
1171 return report(options
, oid
, OBJ_BLOB
,
1172 FSCK_MSG_GITMODULES_LARGE
,
1173 ".gitmodules too large to parse");
1177 data
.options
= options
;
1179 config_opts
.error_action
= CONFIG_ERROR_SILENT
;
1180 if (git_config_from_mem(fsck_gitmodules_fn
, CONFIG_ORIGIN_BLOB
,
1181 ".gitmodules", buf
, size
, &data
, &config_opts
))
1182 data
.ret
|= report(options
, oid
, OBJ_BLOB
,
1183 FSCK_MSG_GITMODULES_PARSE
,
1184 "could not parse gitmodules blob");
1189 int fsck_object(struct object
*obj
, void *data
, unsigned long size
,
1190 struct fsck_options
*options
)
1193 return report(options
, NULL
, OBJ_NONE
, FSCK_MSG_BAD_OBJECT_SHA1
, "no valid object to fsck");
1195 if (obj
->type
== OBJ_BLOB
)
1196 return fsck_blob(&obj
->oid
, data
, size
, options
);
1197 if (obj
->type
== OBJ_TREE
)
1198 return fsck_tree(&obj
->oid
, data
, size
, options
);
1199 if (obj
->type
== OBJ_COMMIT
)
1200 return fsck_commit(&obj
->oid
, data
, size
, options
);
1201 if (obj
->type
== OBJ_TAG
)
1202 return fsck_tag(&obj
->oid
, data
, size
, options
);
1204 return report(options
, &obj
->oid
, obj
->type
,
1205 FSCK_MSG_UNKNOWN_TYPE
,
1206 "unknown type '%d' (internal fsck error)",
1210 int fsck_error_function(struct fsck_options
*o
,
1211 const struct object_id
*oid
,
1212 enum object_type object_type
,
1213 enum fsck_msg_type msg_type
,
1214 enum fsck_msg_id msg_id
,
1215 const char *message
)
1217 if (msg_type
== FSCK_WARN
) {
1218 warning("object %s: %s", fsck_describe_object(o
, oid
), message
);
1221 error("object %s: %s", fsck_describe_object(o
, oid
), message
);
1225 int fsck_finish(struct fsck_options
*options
)
1228 struct oidset_iter iter
;
1229 const struct object_id
*oid
;
1231 oidset_iter_init(&options
->gitmodules_found
, &iter
);
1232 while ((oid
= oidset_iter_next(&iter
))) {
1233 enum object_type type
;
1237 if (oidset_contains(&options
->gitmodules_done
, oid
))
1240 buf
= read_object_file(oid
, &type
, &size
);
1242 if (is_promisor_object(oid
))
1244 ret
|= report(options
,
1246 FSCK_MSG_GITMODULES_MISSING
,
1247 "unable to read .gitmodules blob");
1251 if (type
== OBJ_BLOB
)
1252 ret
|= fsck_blob(oid
, buf
, size
, options
);
1254 ret
|= report(options
,
1256 FSCK_MSG_GITMODULES_BLOB
,
1257 "non-blob found at .gitmodules");
1262 oidset_clear(&options
->gitmodules_found
);
1263 oidset_clear(&options
->gitmodules_done
);
1267 int git_fsck_config(const char *var
, const char *value
, void *cb
)
1269 struct fsck_options
*options
= cb
;
1270 if (strcmp(var
, "fsck.skiplist") == 0) {
1272 struct strbuf sb
= STRBUF_INIT
;
1274 if (git_config_pathname(&path
, var
, value
))
1276 strbuf_addf(&sb
, "skiplist=%s", path
);
1278 fsck_set_msg_types(options
, sb
.buf
);
1279 strbuf_release(&sb
);
1283 if (skip_prefix(var
, "fsck.", &var
)) {
1284 fsck_set_msg_type(options
, var
, value
);
1288 return git_default_config(var
, value
, cb
);
1292 * Custom error callbacks that are used in more than one place.
1295 int fsck_error_cb_print_missing_gitmodules(struct fsck_options
*o
,
1296 const struct object_id
*oid
,
1297 enum object_type object_type
,
1298 enum fsck_msg_type msg_type
,
1299 enum fsck_msg_id msg_id
,
1300 const char *message
)
1302 if (msg_id
== FSCK_MSG_GITMODULES_MISSING
) {
1303 puts(oid_to_hex(oid
));
1306 return fsck_error_function(o
, oid
, object_type
, msg_type
, msg_id
, message
);