Skip to content

Commit 85cc9f2

Browse files
gitstergitster
committed
Sync with 'master'
2 parents 865b121 + 757161e commit 85cc9f2

21 files changed

+193
-42
lines changed

‎Documentation/RelNotes/2.40.4.txt

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,5 @@
1+
Git v2.40.4 Release Notes
2+
=========================
3+
4+
This release lets Git refuse to accept URLs that contain control
5+
sequences. This addresses CVE-2024-50349 and CVE-2024-52006.

‎Documentation/RelNotes/2.41.3.txt

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,6 @@
1+
Git v2.41.3 Release Notes
2+
=========================
3+
4+
This release merges up the fix that appears in v2.40.4 to address
5+
the security issues CVE-2024-50349 and CVE-2024-52006; see the
6+
release notes for that version for details.

‎Documentation/RelNotes/2.42.4.txt

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,6 @@
1+
Git v2.42.4 Release Notes
2+
=========================
3+
4+
This release merges up the fix that appears in v2.40.4 and v2.41.3
5+
to address the security issues CVE-2024-50349 and CVE-2024-52006;
6+
see the release notes for these versions for details.

‎Documentation/RelNotes/2.43.6.txt

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,7 @@
1+
Git v2.43.6 Release Notes
2+
=========================
3+
4+
This release merges up the fix that appears in v2.40.4, v2.41.3
5+
and v2.42.4 to address the security issues CVE-2024-50349 and
6+
CVE-2024-52006; see the release notes for these versions for
7+
details.

‎Documentation/RelNotes/2.44.3.txt

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,7 @@
1+
Git v2.44.3 Release Notes
2+
=========================
3+
4+
This release merges up the fix that appears in v2.40.4, v2.41.3,
5+
v2.42.4 and v2.43.6 to address the security issues CVE-2024-50349
6+
and CVE-2024-52006; see the release notes for these versions
7+
for details.

‎Documentation/RelNotes/2.45.3.txt

Lines changed: 6 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,12 @@
11
Git v2.45.3 Release Notes
22
=========================
33

4-
This primarily is to backport various small fixes accumulated on the
4+
This release merges up the fix that appears in v2.40.4, v2.41.3,
5+
v2.42.4, v2.43.6 and v2.44.3 to address the security issues
6+
CVE-2024-50349 and CVE-2024-52006; see the release notes for
7+
these versions for details.
8+
9+
This version also backports various small fixes accumulated on the
510
'master' front during the development towards Git 2.46, the next
611
feature release.
712

‎Documentation/RelNotes/2.46.3.txt

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,6 @@
1+
Git v2.46.3 Release Notes
2+
=========================
3+
4+
This release merges up the fix that appears in v2.40.4, v2.41.3, v2.42.4,
5+
v2.43.6, v2.44.3 and v2.45.3 to address the security issues CVE-2024-50349 and
6+
CVE-2024-52006; see the release notes for these versions for details.

‎Documentation/RelNotes/2.47.2.txt

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,7 @@
1+
Git v2.47.2 Release Notes
2+
=========================
3+
4+
This release merges up the fix that appears in v2.40.4, v2.41.3,
5+
v2.42.4, v2.43.6, v2.44.3, v2.45.3 and v2.46.3 to address the
6+
security issues CVE-2024-50349 and CVE-2024-52006; see the release
7+
notes for these versions for details.

‎Documentation/RelNotes/2.48.1.txt

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,7 @@
1+
Git v2.48.1 Release Notes
2+
=========================
3+
4+
This release merges up the fix that appears in v2.40.4, v2.41.3,
5+
v2.42.4, v2.43.6, v2.44.3, v2.45.3, v2.46.3, and v2.47.2 to address
6+
the security issues CVE-2024-50349 and CVE-2024-52006; see the release
7+
notes for these versions for details.

‎Documentation/RelNotes/2.49.0.txt

Lines changed: 15 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,15 @@
1+
Git v2.49 Release Notes
2+
=======================
3+
4+
UI, Workflows & Features
5+
------------------------
6+
7+
8+
Performance, Internal Implementation, Development Support etc.
9+
--------------------------------------------------------------
10+
11+
12+
Fixes since v2.48
13+
-----------------
14+
15+
* Other code cleanup, docfix, build fix, etc.

‎Documentation/config/credential.txt

Lines changed: 11 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -22,6 +22,17 @@ credential.useHttpPath::
2222
or https URL to be important. Defaults to false. See
2323
linkgit:gitcredentials[7] for more information.
2424

25+
credential.sanitizePrompt::
26+
By default, user names and hosts that are shown as part of the
27+
password prompt are not allowed to contain control characters (they
28+
will be URL-encoded by default). Configure this setting to `false` to
29+
override that behavior.
30+
31+
credential.protectProtocol::
32+
By default, Carriage Return characters are not allowed in the protocol
33+
that is used when Git talks to a credential helper. This setting allows
34+
users to override this default.
35+
2536
credential.username::
2637
If no username is set for a network authentication, use this username
2738
by default. See credential.<context>.* below, and

‎GIT-VERSION-GEN

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
#!/bin/sh
22

3-
DEF_VER=v2.48.0
3+
DEF_VER=v2.48.GIT
44

55
LF='
66
'

‎RelNotes

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1 +1 @@
1-
Documentation/RelNotes/2.48.0.txt
1+
Documentation/RelNotes/2.49.0.txt

‎credential.c

Lines changed: 32 additions & 19 deletions
Original file line numberDiff line numberDiff line change
@@ -12,7 +12,7 @@
1212
#include "sigchain.h"
1313
#include "strbuf.h"
1414
#include "urlmatch.h"
15-
#include "git-compat-util.h"
15+
#include "environment.h"
1616
#include "trace2.h"
1717
#include "repository.h"
1818

@@ -129,6 +129,10 @@ static int credential_config_callback(const char *var, const char *value,
129129
}
130130
else if (!strcmp(key, "usehttppath"))
131131
c->use_http_path = git_config_bool(var, value);
132+
else if (!strcmp(key, "sanitizeprompt"))
133+
c->sanitize_prompt = git_config_bool(var, value);
134+
else if (!strcmp(key, "protectprotocol"))
135+
c->protect_protocol = git_config_bool(var, value);
132136

133137
return 0;
134138
}
@@ -226,7 +230,8 @@ static void credential_format(struct credential *c, struct strbuf *out)
226230
strbuf_addch(out, '@');
227231
}
228232
if (c->host)
229-
strbuf_addstr(out, c->host);
233+
strbuf_add_percentencode(out, c->host,
234+
STRBUF_ENCODE_HOST_AND_PORT);
230235
if (c->path) {
231236
strbuf_addch(out, '/');
232237
strbuf_add_percentencode(out, c->path, 0);
@@ -240,7 +245,10 @@ static char *credential_ask_one(const char *what, struct credential *c,
240245
struct strbuf prompt = STRBUF_INIT;
241246
char *r;
242247

243-
credential_describe(c, &desc);
248+
if (c->sanitize_prompt)
249+
credential_format(c, &desc);
250+
else
251+
credential_describe(c, &desc);
244252
if (desc.len)
245253
strbuf_addf(&prompt, "%s for '%s': ", what, desc.buf);
246254
else
@@ -381,7 +389,8 @@ int credential_read(struct credential *c, FILE *fp,
381389
return 0;
382390
}
383391

384-
static void credential_write_item(FILE *fp, const char *key, const char *value,
392+
static void credential_write_item(const struct credential *c,
393+
FILE *fp, const char *key, const char *value,
385394
int required)
386395
{
387396
if (!value && required)
@@ -390,41 +399,45 @@ static void credential_write_item(FILE *fp, const char *key, const char *value,
390399
return;
391400
if (strchr(value, '\n'))
392401
die("credential value for %s contains newline", key);
402+
if (c->protect_protocol && strchr(value, '\r'))
403+
die("credential value for %s contains carriage return\n"
404+
"If this is intended, set `credential.protectProtocol=false`",
405+
key);
393406
fprintf(fp, "%s=%s\n", key, value);
394407
}
395408

396409
void credential_write(const struct credential *c, FILE *fp,
397410
enum credential_op_type op_type)
398411
{
399412
if (credential_has_capability(&c->capa_authtype, op_type))
400-
credential_write_item(fp, "capability[]", "authtype", 0);
413+
credential_write_item(c, fp, "capability[]", "authtype", 0);
401414
if (credential_has_capability(&c->capa_state, op_type))
402-
credential_write_item(fp, "capability[]", "state", 0);
415+
credential_write_item(c, fp, "capability[]", "state", 0);
403416

404417
if (credential_has_capability(&c->capa_authtype, op_type)) {
405-
credential_write_item(fp, "authtype", c->authtype, 0);
406-
credential_write_item(fp, "credential", c->credential, 0);
418+
credential_write_item(c, fp, "authtype", c->authtype, 0);
419+
credential_write_item(c, fp, "credential", c->credential, 0);
407420
if (c->ephemeral)
408-
credential_write_item(fp, "ephemeral", "1", 0);
421+
credential_write_item(c, fp, "ephemeral", "1", 0);
409422
}
410-
credential_write_item(fp, "protocol", c->protocol, 1);
411-
credential_write_item(fp, "host", c->host, 1);
412-
credential_write_item(fp, "path", c->path, 0);
413-
credential_write_item(fp, "username", c->username, 0);
414-
credential_write_item(fp, "password", c->password, 0);
415-
credential_write_item(fp, "oauth_refresh_token", c->oauth_refresh_token, 0);
423+
credential_write_item(c, fp, "protocol", c->protocol, 1);
424+
credential_write_item(c, fp, "host", c->host, 1);
425+
credential_write_item(c, fp, "path", c->path, 0);
426+
credential_write_item(c, fp, "username", c->username, 0);
427+
credential_write_item(c, fp, "password", c->password, 0);
428+
credential_write_item(c, fp, "oauth_refresh_token", c->oauth_refresh_token, 0);
416429
if (c->password_expiry_utc != TIME_MAX) {
417430
char *s = xstrfmt("%"PRItime, c->password_expiry_utc);
418-
credential_write_item(fp, "password_expiry_utc", s, 0);
431+
credential_write_item(c, fp, "password_expiry_utc", s, 0);
419432
free(s);
420433
}
421434
for (size_t i = 0; i < c->wwwauth_headers.nr; i++)
422-
credential_write_item(fp, "wwwauth[]", c->wwwauth_headers.v[i], 0);
435+
credential_write_item(c, fp, "wwwauth[]", c->wwwauth_headers.v[i], 0);
423436
if (credential_has_capability(&c->capa_state, op_type)) {
424437
if (c->multistage)
425-
credential_write_item(fp, "continue", "1", 0);
438+
credential_write_item(c, fp, "continue", "1", 0);
426439
for (size_t i = 0; i < c->state_headers_to_send.nr; i++)
427-
credential_write_item(fp, "state[]", c->state_headers_to_send.v[i], 0);
440+
credential_write_item(c, fp, "state[]", c->state_headers_to_send.v[i], 0);
428441
}
429442
}
430443

‎credential.h

Lines changed: 5 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -170,7 +170,9 @@ struct credential {
170170
multistage: 1,
171171
quit:1,
172172
use_http_path:1,
173-
username_from_proto:1;
173+
username_from_proto:1,
174+
sanitize_prompt:1,
175+
protect_protocol:1;
174176

175177
struct credential_capability capa_authtype;
176178
struct credential_capability capa_state;
@@ -197,6 +199,8 @@ struct credential {
197199
.wwwauth_headers = STRVEC_INIT, \
198200
.state_headers = STRVEC_INIT, \
199201
.state_headers_to_send = STRVEC_INIT, \
202+
.sanitize_prompt = 1, \
203+
.protect_protocol = 1, \
200204
}
201205

202206
/* Initialize a credential structure, setting all fields to empty. */

‎strbuf.c

Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -497,7 +497,9 @@ void strbuf_add_percentencode(struct strbuf *dst, const char *src, int flags)
497497
unsigned char ch = src[i];
498498
if (ch <= 0x1F || ch >= 0x7F ||
499499
(ch == '/' && (flags & STRBUF_ENCODE_SLASH)) ||
500-
strchr(URL_UNSAFE_CHARS, ch))
500+
((flags & STRBUF_ENCODE_HOST_AND_PORT) ?
501+
!isalnum(ch) && !strchr("-.:[]", ch) :
502+
!!strchr(URL_UNSAFE_CHARS, ch)))
501503
strbuf_addf(dst, "%%%02X", (unsigned char)ch);
502504
else
503505
strbuf_addch(dst, ch);

‎strbuf.h

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -356,6 +356,7 @@ void strbuf_expand_bad_format(const char *format, const char *command);
356356
void strbuf_addbuf_percentquote(struct strbuf *dst, const struct strbuf *src);
357357

358358
#define STRBUF_ENCODE_SLASH 1
359+
#define STRBUF_ENCODE_HOST_AND_PORT 2
359360

360361
/**
361362
* Append the contents of a string to a strbuf, percent-encoding any characters

‎t/t0300-credentials.sh

Lines changed: 49 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -76,6 +76,10 @@ test_expect_success 'setup helper scripts' '
7676
test -z "$pexpiry" || echo password_expiry_utc=$pexpiry
7777
EOF
7878
79+
write_script git-credential-cntrl-in-username <<-\EOF &&
80+
printf "username=\\007latrix Lestrange\\n"
81+
EOF
82+
7983
PATH="$PWD:$PATH"
8084
'
8185

@@ -696,6 +700,19 @@ test_expect_success 'match percent-encoded values in username' '
696700
EOF
697701
'
698702

703+
test_expect_success 'match percent-encoded values in hostname' '
704+
test_config "credential.https://a%20b%20c/.helper" "$HELPER" &&
705+
check fill <<-\EOF
706+
url=https://a b c/
707+
--
708+
protocol=https
709+
host=a b c
710+
username=foo
711+
password=bar
712+
--
713+
EOF
714+
'
715+
699716
test_expect_success 'fetch with multiple path components' '
700717
test_unconfig credential.helper &&
701718
test_config credential.https://example.com/foo/repo.git.helper "verbatim foo bar" &&
@@ -885,6 +902,22 @@ test_expect_success 'url parser rejects embedded newlines' '
885902
test_cmp expect stderr
886903
'
887904

905+
test_expect_success 'url parser rejects embedded carriage returns' '
906+
test_config credential.helper "!true" &&
907+
test_must_fail git credential fill 2>stderr <<-\EOF &&
908+
url=https://example%0d.com/
909+
EOF
910+
cat >expect <<-\EOF &&
911+
fatal: credential value for host contains carriage return
912+
If this is intended, set `credential.protectProtocol=false`
913+
EOF
914+
test_cmp expect stderr &&
915+
GIT_ASKPASS=true \
916+
git -c credential.protectProtocol=false credential fill <<-\EOF
917+
url=https://example%0d.com/
918+
EOF
919+
'
920+
888921
test_expect_success 'host-less URLs are parsed as empty host' '
889922
check fill "verbatim foo bar" <<-\EOF
890923
url=cert:///path/to/cert.pem
@@ -994,4 +1027,20 @@ test_expect_success 'credential config with partial URLs' '
9941027
test_grep "skipping credential lookup for key" stderr
9951028
'
9961029

1030+
BEL="$(printf '\007')"
1031+
1032+
test_expect_success 'interactive prompt is sanitized' '
1033+
check fill cntrl-in-username <<-EOF
1034+
protocol=https
1035+
host=example.org
1036+
--
1037+
protocol=https
1038+
host=example.org
1039+
username=${BEL}latrix Lestrange
1040+
password=askpass-password
1041+
--
1042+
askpass: Password for ${SQ}https://%07latrix%20Lestrange@example.org${SQ}:
1043+
EOF
1044+
'
1045+
9971046
test_done

‎t/t5541-http-push-smart.sh

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -343,7 +343,7 @@ test_expect_success 'push over smart http with auth' '
343343
git push "$HTTPD_URL"/auth/smart/test_repo.git &&
344344
git --git-dir="$HTTPD_DOCUMENT_ROOT_PATH/test_repo.git" \
345345
log -1 --format=%s >actual &&
346-
expect_askpass both user@host &&
346+
expect_askpass both user%40host &&
347347
test_cmp expect actual
348348
'
349349

@@ -355,7 +355,7 @@ test_expect_success 'push to auth-only-for-push repo' '
355355
git push "$HTTPD_URL"/auth-push/smart/test_repo.git &&
356356
git --git-dir="$HTTPD_DOCUMENT_ROOT_PATH/test_repo.git" \
357357
log -1 --format=%s >actual &&
358-
expect_askpass both user@host &&
358+
expect_askpass both user%40host &&
359359
test_cmp expect actual
360360
'
361361

@@ -385,7 +385,7 @@ test_expect_success 'push into half-auth-complete requires password' '
385385
git push "$HTTPD_URL/half-auth-complete/smart/half-auth.git" &&
386386
git --git-dir="$HTTPD_DOCUMENT_ROOT_PATH/half-auth.git" \
387387
log -1 --format=%s >actual &&
388-
expect_askpass both user@host &&
388+
expect_askpass both user%40host &&
389389
test_cmp expect actual
390390
'
391391

0 commit comments

Comments
 (0)