summaryrefslogtreecommitdiff
path: root/send-pack.c
diff options
context:
space:
mode:
authorJunio C Hamano <gitster@pobox.com>2015-04-20 22:28:31 (GMT)
committerJunio C Hamano <gitster@pobox.com>2015-04-20 22:28:31 (GMT)
commit268d5bc2b2a6f261c6da99c3c9557426468a765b (patch)
treed7787ad5d04e74439f65bfe72542b44d97599511 /send-pack.c
parent6b1258b07b8ad5671f36bf7e998e905a0142c223 (diff)
parentafcb6ee30acf17f4e0338c49fbab301131abfbba (diff)
downloadgit-268d5bc2b2a6f261c6da99c3c9557426468a765b.zip
git-268d5bc2b2a6f261c6da99c3c9557426468a765b.tar.gz
git-268d5bc2b2a6f261c6da99c3c9557426468a765b.tar.bz2
Merge branch 'jc/push-cert'
The "git push --signed" protocol extension did not limit what the "nonce" that is a server-chosen string can contain or how long it can be, which was unnecessarily lax. Limit both the length and the alphabet to a reasonably small space that can still have enough entropy. * jc/push-cert: push --signed: tighten what the receiving end can ask to sign
Diffstat (limited to 'send-pack.c')
-rw-r--r--send-pack.c23
1 files changed, 23 insertions, 0 deletions
diff --git a/send-pack.c b/send-pack.c
index 189bdde..2e07ac3 100644
--- a/send-pack.c
+++ b/send-pack.c
@@ -308,6 +308,28 @@ static int atomic_push_failure(struct send_pack_args *args,
failing_ref->name, failing_ref->status);
}
+#define NONCE_LEN_LIMIT 256
+
+static void reject_invalid_nonce(const char *nonce, int len)
+{
+ int i = 0;
+
+ if (NONCE_LEN_LIMIT <= len)
+ die("the receiving end asked to sign an invalid nonce <%.*s>",
+ len, nonce);
+
+ for (i = 0; i < len; i++) {
+ int ch = nonce[i] & 0xFF;
+ if (isalnum(ch) ||
+ ch == '-' || ch == '.' ||
+ ch == '/' || ch == '+' ||
+ ch == '=' || ch == '_')
+ continue;
+ die("the receiving end asked to sign an invalid nonce <%.*s>",
+ len, nonce);
+ }
+}
+
int send_pack(struct send_pack_args *args,
int fd[], struct child_process *conn,
struct ref *remote_refs,
@@ -354,6 +376,7 @@ int send_pack(struct send_pack_args *args,
push_cert_nonce = server_feature_value("push-cert", &len);
if (!push_cert_nonce)
die(_("the receiving end does not support --signed push"));
+ reject_invalid_nonce(push_cert_nonce, len);
push_cert_nonce = xmemdupz(push_cert_nonce, len);
}