mirror/git
1
0
Fork 0
mirror of https://github.com/git/git.git synced 2024-11-08 12:59:54 +01:00
Code

Merge branch 'jc/safe-directory-leading-path' into maint-2.45

Browse Source 
The safe.directory configuration knob has been updated to
optionally allow leading path matches.

* jc/safe-directory-leading-path:
  safe.directory: allow "lead/ing/path/*" match
This commit is contained in:
Junio C Hamano 2024-06-28 15:53:16 -07:00
commit ce75d32b99
3 changed files with 31 additions and 7 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

3
Documentation/config/safe.txt
View File

@ -44,7 +44,8 @@ string `*`. This will allow all repositories to be treated as if their
directory was listed in the `safe.directory` list. If `safe.directory=*`
is set in system config and you want to re-enable this protection, then
initialize your list with an empty value before listing the repositories
that you deem safe.
that you deem safe. Giving a directory with `/*` appended to it will
allow access to all repositories under the named directory.
+
As explained, Git only allows you to access repositories owned by
yourself, i.e. the user who is running Git, by default. When Git

20
setup.c
View File

@ -1177,13 +1177,21 @@ static int safe_directory_cb(const char *key, const char *value,
} else if (!strcmp(value, "*")) {
data->is_safe = 1;
} else {
const char *interpolated = NULL;
const char *allowed = NULL;
if (!git_config_pathname(&interpolated, key, value) &&
!fspathcmp(data->path, interpolated ? interpolated : value))
data->is_safe = 1;
free((char *)interpolated);
if (!git_config_pathname(&allowed, key, value)) {
if (!allowed)
allowed = value;
if (ends_with(allowed, "/*")) {
size_t len = strlen(allowed);
if (!fspathncmp(allowed, data->path, len - 1))
data->is_safe = 1;
} else if (!fspathcmp(data->path, allowed)) {
data->is_safe = 1;
}
}
if (allowed != value)
free((char *)allowed);
}
return 0;

15
t/t0033-safe-directory.sh
View File

@ -71,7 +71,22 @@ test_expect_success 'safe.directory=*, but is reset' '
expect_rejected_dir
'
test_expect_success 'safe.directory with matching glob' '
git config --global --unset-all safe.directory &&
p=$(pwd) &&
git config --global safe.directory "${p%/*}/*" &&
git status
'
test_expect_success 'safe.directory with unmatching glob' '
git config --global --unset-all safe.directory &&
p=$(pwd) &&
git config --global safe.directory "${p%/*}no/*" &&
expect_rejected_dir
'
test_expect_success 'safe.directory in included file' '
git config --global --unset-all safe.directory &&
cat >gitconfig-include <<-EOF &&
[safe]
directory = "$(pwd)"