Skip to content

Commit eb8c3e5

Browse files
ethomsonethomson
committed
repo: honor safe.directory during ownership checks
Obey the `safe.directory` configuration variable if it is set in the global or system configuration. (Do not try to load this from the repository configuration - to avoid malicious repositories that then mark themselves as safe.)
1 parent f683806 commit eb8c3e5

File tree

2 files changed

+148
-5
lines changed

2 files changed

+148
-5
lines changed

‎src/repository.c‎

Lines changed: 46 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -64,6 +64,7 @@ static const struct {
6464

6565
static int check_repositoryformatversion(int *version, git_config *config);
6666
static int check_extensions(git_config *config, int version);
67+
static int load_global_config(git_config **config);
6768

6869
#define GIT_COMMONDIR_FILE "commondir"
6970
#define GIT_GITDIR_FILE "gitdir"
@@ -482,21 +483,61 @@ static int read_gitfile(git_buf *path_out, const char *file_path)
482483
return error;
483484
}
484485

486+
typedef struct {
487+
const char *repo_path;
488+
git_buf tmp;
489+
bool is_safe;
490+
} validate_ownership_data;
491+
492+
static int validate_ownership_cb(const git_config_entry *entry, void *payload)
493+
{
494+
validate_ownership_data *data = payload;
495+
496+
if (strcmp(entry->value, "") == 0)
497+
data->is_safe = false;
498+
499+
if (git_path_prettify_dir(&data->tmp, entry->value, NULL) == 0 &&
500+
strcmp(data->tmp.ptr, data->repo_path) == 0)
501+
data->is_safe = true;
502+
503+
return 0;
504+
}
505+
485506
static int validate_ownership(const char *repo_path)
486507
{
508+
git_config *config = NULL;
509+
validate_ownership_data data = { repo_path, GIT_BUF_INIT, false };
487510
bool is_safe;
488511
int error;
489512

490-
if ((error = git_path_owner_is_current_user(&is_safe, repo_path)) < 0)
491-
return (error == GIT_ENOTFOUND) ? 0 : error;
513+
if ((error = git_path_owner_is_current_user(&is_safe, repo_path)) < 0) {
514+
if (error == GIT_ENOTFOUND)
515+
error = 0;
492516

493-
if (is_safe)
494-
return 0;
517+
goto done;
518+
}
519+
520+
if (is_safe) {
521+
error = 0;
522+
goto done;
523+
}
524+
525+
if (load_global_config(&config) == 0) {
526+
error = git_config_get_multivar_foreach(config, "safe.directory", NULL, validate_ownership_cb, &data);
527+
528+
if (!error && data.is_safe)
529+
goto done;
530+
}
495531

496532
git_error_set(GIT_ERROR_CONFIG,
497533
"repository path '%s' is not owned by current user",
498534
repo_path);
499-
return GIT_EOWNER;
535+
error = GIT_EOWNER;
536+
537+
done:
538+
git_config_free(config);
539+
git_buf_dispose(&data.tmp);
540+
return error;
500541
}
501542

502543
static int find_repo(

‎tests/repo/open.c‎

Lines changed: 102 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -3,16 +3,26 @@
33
#include "sysdir.h"
44
#include <ctype.h>
55

6+
static git_buf config_path = GIT_BUF_INIT;
7+
8+
void test_repo_open__initialize(void)
9+
{
10+
cl_git_pass(git_libgit2_opts(GIT_OPT_GET_SEARCH_PATH, GIT_CONFIG_LEVEL_GLOBAL, &config_path));
11+
}
612

713
void test_repo_open__cleanup(void)
814
{
915
cl_git_sandbox_cleanup();
1016
cl_fixture_cleanup("empty_standard_repo");
17+
cl_fixture_cleanup("__global_config");
1118

1219
if (git_path_isdir("alternate"))
1320
git_futils_rmdir_r("alternate", NULL, GIT_RMDIR_REMOVE_FILES);
1421

1522
git_path__set_owner(GIT_PATH_MOCK_OWNER_NONE);
23+
24+
cl_git_pass(git_libgit2_opts(GIT_OPT_SET_SEARCH_PATH, GIT_CONFIG_LEVEL_GLOBAL, config_path.ptr));
25+
git_buf_dispose(&config_path);
1626
}
1727

1828
void test_repo_open__bare_empty_repo(void)
@@ -480,11 +490,103 @@ void test_repo_open__validates_dir_ownership(void)
480490
void test_repo_open__can_allowlist_dirs_with_problematic_ownership(void)
481491
{
482492
git_repository *repo;
493+
git_buf config_path = GIT_BUF_INIT,
494+
config_filename = GIT_BUF_INIT,
495+
config_data = GIT_BUF_INIT;
483496

484497
cl_fixture_sandbox("empty_standard_repo");
485498
cl_git_pass(cl_rename("empty_standard_repo/.gitted", "empty_standard_repo/.git"));
486499

487500
git_path__set_owner(GIT_PATH_MOCK_OWNER_OTHER);
488501
cl_git_fail(git_repository_open(&repo, "empty_standard_repo"));
489502

503+
/* Add safe.directory options to the global configuration */
504+
git_buf_joinpath(&config_path, clar_sandbox_path(), "__global_config");
505+
cl_must_pass(p_mkdir(config_path.ptr, 0777));
506+
git_libgit2_opts(GIT_OPT_SET_SEARCH_PATH, GIT_CONFIG_LEVEL_GLOBAL, config_path.ptr);
507+
508+
git_buf_joinpath(&config_filename, config_path.ptr, ".gitconfig");
509+
510+
git_buf_printf(&config_data,
511+
"[foo]\n" \
512+
"\tbar = Foobar\n" \
513+
"\tbaz = Baz!\n" \
514+
"[safe]\n" \
515+
"\tdirectory = /non/existent/path\n" \
516+
"\tdirectory = /\n" \
517+
"\tdirectory = c:\\\\temp\n" \
518+
"\tdirectory = %s/%s\n" \
519+
"\tdirectory = /tmp\n" \
520+
"[bar]\n" \
521+
"\tfoo = barfoo\n",
522+
clar_sandbox_path(), "empty_standard_repo");
523+
cl_git_rewritefile(config_filename.ptr, config_data.ptr);
524+
525+
cl_git_pass(git_repository_open(&repo, "empty_standard_repo"));
526+
git_repository_free(repo);
527+
528+
git_buf_dispose(&config_path);
529+
git_buf_dispose(&config_filename);
530+
git_buf_dispose(&config_data);
531+
}
532+
533+
void test_repo_open__can_reset_safe_directory_list(void)
534+
{
535+
git_repository *repo;
536+
git_buf config_path = GIT_BUF_INIT,
537+
config_filename = GIT_BUF_INIT,
538+
config_data = GIT_BUF_INIT;
539+
540+
cl_fixture_sandbox("empty_standard_repo");
541+
cl_git_pass(cl_rename("empty_standard_repo/.gitted", "empty_standard_repo/.git"));
542+
543+
git_path__set_owner(GIT_PATH_MOCK_OWNER_OTHER);
544+
cl_git_fail(git_repository_open(&repo, "empty_standard_repo"));
545+
546+
/* Add safe.directory options to the global configuration */
547+
git_buf_joinpath(&config_path, clar_sandbox_path(), "__global_config");
548+
cl_must_pass(p_mkdir(config_path.ptr, 0777));
549+
git_libgit2_opts(GIT_OPT_SET_SEARCH_PATH, GIT_CONFIG_LEVEL_GLOBAL, config_path.ptr);
550+
551+
git_buf_joinpath(&config_filename, config_path.ptr, ".gitconfig");
552+
553+
/* The blank resets our sandbox directory and opening fails */
554+
555+
git_buf_printf(&config_data,
556+
"[foo]\n" \
557+
"\tbar = Foobar\n" \
558+
"\tbaz = Baz!\n" \
559+
"[safe]\n" \
560+
"\tdirectory = %s/%s\n" \
561+
"\tdirectory = \n" \
562+
"\tdirectory = /tmp\n" \
563+
"[bar]\n" \
564+
"\tfoo = barfoo\n",
565+
clar_sandbox_path(), "empty_standard_repo");
566+
cl_git_rewritefile(config_filename.ptr, config_data.ptr);
567+
568+
cl_git_fail(git_repository_open(&repo, "empty_standard_repo"));
569+
570+
/* The blank resets tmp and allows subsequent declarations to succeed */
571+
572+
git_buf_clear(&config_data);
573+
git_buf_printf(&config_data,
574+
"[foo]\n" \
575+
"\tbar = Foobar\n" \
576+
"\tbaz = Baz!\n" \
577+
"[safe]\n" \
578+
"\tdirectory = /tmp\n" \
579+
"\tdirectory = \n" \
580+
"\tdirectory = %s/%s\n" \
581+
"[bar]\n" \
582+
"\tfoo = barfoo\n",
583+
clar_sandbox_path(), "empty_standard_repo");
584+
cl_git_rewritefile(config_filename.ptr, config_data.ptr);
585+
586+
cl_git_pass(git_repository_open(&repo, "empty_standard_repo"));
587+
git_repository_free(repo);
588+
589+
git_buf_dispose(&config_path);
590+
git_buf_dispose(&config_filename);
591+
git_buf_dispose(&config_data);
490592
}

0 commit comments

Comments
 (0)