diff options
| author | Johannes Schindelin <johannes.schindelin@gmx.de> | 2019-10-01 21:27:18 (GMT) |
|---|---|---|
| committer | Johannes Schindelin <johannes.schindelin@gmx.de> | 2019-12-05 14:36:51 (GMT) |
| commit | a8dee3ca610f5a1d403634492136c887f83b59d2 (patch) | |
| tree | 3055874d4666b3364d15cc205dc36e9680f294d9 /submodule.h | |
| parent | 9102f958ee5254b10c0be72672aa3305bf4f4704 (diff) | |
| download | git-a8dee3ca610f5a1d403634492136c887f83b59d2.zip git-a8dee3ca610f5a1d403634492136c887f83b59d2.tar.gz git-a8dee3ca610f5a1d403634492136c887f83b59d2.tar.bz2 | |
Disallow dubiously-nested submodule git directories
Currently it is technically possible to let a submodule's git
directory point right into the git dir of a sibling submodule.
Example: the git directories of two submodules with the names `hippo`
and `hippo/hooks` would be `.git/modules/hippo/` and
`.git/modules/hippo/hooks/`, respectively, but the latter is already
intended to house the former's hooks.
In most cases, this is just confusing, but there is also a (quite
contrived) attack vector where Git can be fooled into mistaking remote
content for file contents it wrote itself during a recursive clone.
Let's plug this bug.
To do so, we introduce the new function `validate_submodule_git_dir()`
which simply verifies that no git dir exists for any leading directories
of the submodule name (if there are any).
Note: this patch specifically continues to allow sibling modules names
of the form `core/lib`, `core/doc`, etc, as long as `core` is not a
submodule name.
This fixes CVE-2019-1387.
Reported-by: Nicolas Joly <Nicolas.Joly@microsoft.com>
Signed-off-by: Johannes Schindelin <johannes.schindelin@gmx.de>
Diffstat (limited to 'submodule.h')
| -rw-r--r-- | submodule.h | 5 |
1 files changed, 5 insertions, 0 deletions
diff --git a/submodule.h b/submodule.h index 3c239d1..cb1ab07 100644 --- a/submodule.h +++ b/submodule.h @@ -120,6 +120,11 @@ extern int parallel_submodules(void); */ int submodule_to_gitdir(struct strbuf *buf, const char *submodule); +/* + * Make sure that no submodule's git dir is nested in a sibling submodule's. + */ +int validate_submodule_git_dir(char *git_dir, const char *submodule_name); + #define SUBMODULE_MOVE_HEAD_DRY_RUN (1<<0) #define SUBMODULE_MOVE_HEAD_FORCE (1<<1) extern int submodule_move_head(const char *path, |