Skip to content

Commit 447b679

Browse files
committed
fast-import: disallow "." and ".." path components
If a user specified e.g. M 100644 :1 ../some-file then fast-import previously would happily create a git history where there is a tree in the top-level directory named "..", and with a file inside that directory named "some-file". The top-level ".." directory causes problems. While git checkout will die with errors and fsck will report hasDotdot problems, the user is going to have problems trying to remove the problematic file. Simply avoid creating this bad history in the first place. Signed-off-by: Elijah Newren <newren@gmail.com>
1 parent 04eaff6 commit 447b679

File tree

2 files changed

+22
-0
lines changed

2 files changed

+22
-0
lines changed

builtin/fast-import.c

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1466,6 +1466,8 @@ static int tree_content_set(
14661466
root->tree = t = grow_tree_content(t, t->entry_count);
14671467
e = new_tree_entry();
14681468
e->name = to_atom(p, n);
1469+
if (is_dot_or_dotdot(e->name->str_dat))
1470+
die("path %s contains invalid component", p);
14691471
e->versions[0].mode = 0;
14701472
oidclr(&e->versions[0].oid, the_repository->hash_algo);
14711473
t->entries[t->entry_count++] = e;

t/t9300-fast-import.sh

Lines changed: 20 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -522,6 +522,26 @@ test_expect_success 'B: fail on invalid committer (5)' '
522522
test_must_fail git fast-import <input
523523
'
524524

525+
test_expect_success 'B: fail on invalid file path' '
526+
cat >input <<-INPUT_END &&
527+
blob
528+
mark :1
529+
data <<EOF
530+
File contents
531+
EOF
532+
533+
commit refs/heads/badpath
534+
committer Name <email> $GIT_COMMITTER_DATE
535+
data <<COMMIT
536+
Commit Message
537+
COMMIT
538+
M 100644 :1 ../invalid-path
539+
INPUT_END
540+
541+
test_when_finished "git update-ref -d refs/heads/badpath" &&
542+
test_must_fail git fast-import <input
543+
'
544+
525545
###
526546
### series C
527547
###

0 commit comments

Comments
 (0)