]> git.ipfire.org Git - thirdparty/git.git/commit
submodules: submodule paths must not contain symlinks
authorJohannes Schindelin <johannes.schindelin@gmx.de>
Fri, 22 Mar 2024 10:19:22 +0000 (11:19 +0100)
committerJohannes Schindelin <johannes.schindelin@gmx.de>
Wed, 17 Apr 2024 20:30:02 +0000 (22:30 +0200)
commit97065761333fd62db1912d81b489db938d8c991d
treee17ff1bace458e203800a7a35b98e840b0d6977c
parent9cf85473209ea8ae2b56c13145c4704d12ee1374
submodules: submodule paths must not contain symlinks

When creating a submodule path, we must be careful not to follow
symbolic links. Otherwise we may follow a symbolic link pointing to
a gitdir (which are valid symbolic links!) e.g. while cloning.

On case-insensitive filesystems, however, we blindly replace a directory
that has been created as part of the `clone` operation with a symlink
when the path to the latter differs only in case from the former's path.

Let's simply avoid this situation by expecting not ever having to
overwrite any existing file/directory/symlink upon cloning. That way, we
won't even replace a directory that we just created.

This addresses CVE-2024-32002.

Reported-by: Filip Hejsek <filip.hejsek@gmail.com>
Signed-off-by: Johannes Schindelin <johannes.schindelin@gmx.de>
builtin/submodule--helper.c
t/t7406-submodule-update.sh