File 0019-path-also-guard-.gitmodules-against-NTFS-A... of Package git.9802

Overview Repositories Revisions Requests Users Attributes Meta

File 0019-path-also-guard-.gitmodules-against-NTFS-Alternate-D.patch of Package git.9802

From d50f61a20610c76c79659b7eb07abc83d0e0d638 Mon Sep 17 00:00:00 2001
From: Johannes Schindelin <johannes.schindelin@gmx.de>
Date: Wed, 28 Aug 2019 12:22:17 +0200
Subject: [PATCH 19/28] path: also guard `.gitmodules` against NTFS Alternate
 Data Streams

We just safe-guarded `.git` against NTFS Alternate Data Stream-related
attack vectors, and now it is time to do the same for `.gitmodules`.

Note: In the added regression test, we refrain from verifying all kinds
of variations between short names and NTFS Alternate Data Streams: as
the new code disallows _all_ Alternate Data Streams of `.gitmodules`, it
is enough to test one in order to know that all of them are guarded
against.

Signed-off-by: Johannes Schindelin <johannes.schindelin@gmx.de>
---
 path.c                | 2 +-
 t/t0060-path-utils.sh | 7 ++++++-
 2 files changed, 7 insertions(+), 2 deletions(-)

diff --git a/path.c b/path.c
index 6c9d5843a2..7b0d616808 100644
--- a/path.c
+++ b/path.c
@@ -1370,7 +1370,7 @@ static int is_ntfs_dot_generic(const char *name,
 only_spaces_and_periods:
 		for (;;) {
 			char c = name[i++];
-			if (!c)
+			if (!c || c == ':')
 				return 1;
 			if (c != ' ' && c != '.')
 				return 0;
diff --git a/t/t0060-path-utils.sh b/t/t0060-path-utils.sh
index 3f3357ed9f..2b8589e921 100755
--- a/t/t0060-path-utils.sh
+++ b/t/t0060-path-utils.sh
@@ -408,6 +408,9 @@ test_expect_success 'match .gitmodules' '
 		~1000000 \
 		~9999999 \
 		\
+		.gitmodules:\$DATA \
+		"gitmod~4 . :\$DATA" \
+		\
 		--not \
 		".gitmodules x"  \
 		".gitmodules .x" \
@@ -432,7 +435,9 @@ test_expect_success 'match .gitmodules' '
 		\
 		GI7EB~1 \
 		GI7EB~01 \
-		GI7EB~1X
+		GI7EB~1X \
+		\
+		.gitmodules,:\$DATA
 '
 
 test_done
-- 
2.24.0

Places

File 0019-path-also-guard-.gitmodules-against-NTFS-Alternate-D.patch of Package git.9802

Places