diff options
| author | Johannes Schindelin <johannes.schindelin@gmx.de> | 2019-09-16 11:26:40 (GMT) |
|---|---|---|
| committer | Johannes Schindelin <johannes.schindelin@gmx.de> | 2019-12-05 14:37:09 (GMT) |
| commit | 2ddcccf97a717f9df17a4843c39e3c4f1df49fec (patch) | |
| tree | 6d63983b124cf3793eee811811281ca131cebbb7 /t | |
| parent | 65d30a19de282d781c59bb7f807459cb5b29de1e (diff) | |
| parent | f82a97eb9197c1e3768e72648f37ce0ca3233734 (diff) | |
| download | git-2ddcccf97a717f9df17a4843c39e3c4f1df49fec.zip git-2ddcccf97a717f9df17a4843c39e3c4f1df49fec.tar.gz git-2ddcccf97a717f9df17a4843c39e3c4f1df49fec.tar.bz2 | |
Merge branch 'win32-accommodate-funny-drive-names'
While the only permitted drive letters for physical drives on Windows
are letters of the US-English alphabet, this restriction does not apply
to virtual drives assigned via `subst <letter>: <path>`.
To prevent targeted attacks against systems where "funny" drive letters
such as `1` or `!` are assigned, let's handle them as regular drive
letters on Windows.
This fixes CVE-2019-1351.
Signed-off-by: Johannes Schindelin <johannes.schindelin@gmx.de>
Diffstat (limited to 't')
| -rwxr-xr-x | t/t0060-path-utils.sh | 13 |
1 files changed, 12 insertions, 1 deletions
diff --git a/t/t0060-path-utils.sh b/t/t0060-path-utils.sh index 1171e0b..40db3e1 100755 --- a/t/t0060-path-utils.sh +++ b/t/t0060-path-utils.sh @@ -165,6 +165,15 @@ test_expect_success 'absolute path rejects the empty string' ' test_must_fail test-path-utils absolute_path "" ' +test_expect_success MINGW '<drive-letter>:\\abc is an absolute path' ' + for letter in : \" C Z 1 รค + do + path=$letter:\\abc && + absolute="$(test-path-utils absolute_path "$path")" && + test "$path" = "$absolute" || return 1 + done +' + test_expect_success 'real path rejects the empty string' ' test_must_fail test-path-utils real_path "" ' @@ -445,13 +454,15 @@ test_expect_success MINGW 'is_valid_path() on Windows' ' win32 \ "win32 x" \ ../hello.txt \ + C:\\git \ \ --not \ "win32 " \ "win32 /x " \ "win32." \ "win32 . ." \ - .../hello.txt + .../hello.txt \ + colon:test ' test_done |