diff options
| author | Jeff King <peff@peff.net> | 2018-02-19 19:50:14 (GMT) |
|---|---|---|
| committer | Junio C Hamano <gitster@pobox.com> | 2018-02-20 19:27:06 (GMT) |
| commit | 90dce21eb0fcf28096e661a3dd3b4e93fa0bccb5 (patch) | |
| tree | ceb454eaaec086ea142c95d09078a25751b73e33 /remote-curl.c | |
| parent | 6cdffd06d6ce1e997963790f9206fc981715fbbb (diff) | |
| download | git-90dce21eb0fcf28096e661a3dd3b4e93fa0bccb5.zip git-90dce21eb0fcf28096e661a3dd3b4e93fa0bccb5.tar.gz git-90dce21eb0fcf28096e661a3dd3b4e93fa0bccb5.tar.bz2 | |
remote-curl: unquote incoming push-options
The transport-helper protocol c-style quotes the value of
any options passed to the helper via the "option <key> <value>"
directive. However, remote-curl doesn't actually unquote the
push-option values, meaning that we will send the quoted
version to the other side (whereas git-over-ssh would send
the raw value).
The pack-protocol.txt documentation defines the push-options
as a series of VCHARs, which excludes most characters that
would need quoting. But:
1. You can still see the bug with a valid push-option that
starts with a double-quote (since that triggers
quoting).
2. We do currently handle any non-NUL characters correctly
in git-over-ssh. So even though the spec does not say
that we need to handle most quoted characters, it's
nice if our behavior is consistent between protocols.
There are two new tests: the "direct" one shows that this
already works in the non-http case, and the http one covers
this bugfix.
Reported-by: Jon Simons <jon@jonsimons.org>
Signed-off-by: Jeff King <peff@peff.net>
Signed-off-by: Junio C Hamano <gitster@pobox.com>
Diffstat (limited to 'remote-curl.c')
| -rw-r--r-- | remote-curl.c | 11 |
1 files changed, 10 insertions, 1 deletions
diff --git a/remote-curl.c b/remote-curl.c index 0053b09..c8a4261 100644 --- a/remote-curl.c +++ b/remote-curl.c @@ -13,6 +13,7 @@ #include "credential.h" #include "sha1-array.h" #include "send-pack.h" +#include "quote.h" static struct remote *remote; /* always ends with a trailing slash */ @@ -142,7 +143,15 @@ static int set_option(const char *name, const char *value) return -1; return 0; } else if (!strcmp(name, "push-option")) { - string_list_append(&options.push_options, value); + if (*value != '"') + string_list_append(&options.push_options, value); + else { + struct strbuf unquoted = STRBUF_INIT; + if (unquote_c_style(&unquoted, value, NULL) < 0) + die("invalid quoting in push-option value"); + string_list_append_nodup(&options.push_options, + strbuf_detach(&unquoted, NULL)); + } return 0; #if LIBCURL_VERSION_NUM >= 0x070a08 |