From: Jeff King <peff@peff.net>
To: David Turner <dturner@twopensource.com>
Cc: "Junio C Hamano" <gitster@pobox.com>,
"Michael Haggerty" <mhagger@alum.mit.edu>,
git@vger.kernel.org, "Nguyễn Thái Ngọc Duy" <pclouds@gmail.com>,
"Ramsay Jones" <ramsay@ramsayjones.plus.com>
Subject: Re: [PATCH 05/29] refname_is_safe(): insist that the refname already be normalized
Date: Wed, 27 Apr 2016 16:15:13 -0400 [thread overview]
Message-ID: <20160427201512.GA8073@sigill.intra.peff.net> (raw)
In-Reply-To: <1461787832.11504.1.camel@twopensource.com>
On Wed, Apr 27, 2016 at 04:10:32PM -0400, David Turner wrote:
> On Wed, 2016-04-27 at 10:59 -0700, Junio C Hamano wrote:
>
> > There is another call to refname_is_safe() in resolve_ref_unsafe(),
> > which applies the sanity check to the string from a symref. We seem
> > to allow
> >
> > $ git symbolic-ref refs/heads/SSS refs/heads//master
> >
> > and we end up storing "ref: refs/heads//master" (or make a symbolic
> > link with doubled slashes), but the current code considers the
> > resulting symbolic link as "dangling". Again, this change moves the
> > rejection a bit earlier in the codepath, without changing the end
> > result, I'd think.
>
> I think we should disallow that -- refname_is_safe should probably call
> (or be replaced with calls to) check_refname_format.
I thought the point is that one is a lesser check than the other, and we
need different rules for different situations. So we might allow
deletion on a refname that does not pass check_refname_format(), but we
must make sure it is not going to cause any mischief (e.g., escaping
".git" and deleting random files).
But anything writing a _new_ refname (whether the actual ref, or
referencing it via a symref) should be using check_refname_format()
before writing.
-Peff
next prev parent reply other threads:[~2016-04-27 20:15 UTC|newest]
Thread overview: 70+ messages / expand[flat|nested] mbox.gz Atom feed top
2016-04-27 16:57 [PATCH 00/29] Yet more preparation for reference backends Michael Haggerty
2016-04-27 16:57 ` [PATCH 01/29] safe_create_leading_directories(): improve docstring Michael Haggerty
2016-04-27 16:57 ` [PATCH 02/29] remove_dir_recursively(): add docstring Michael Haggerty
2016-04-27 16:57 ` [PATCH 03/29] refname_is_safe(): use skip_prefix() Michael Haggerty
2016-04-27 16:57 ` [PATCH 04/29] refname_is_safe(): don't allow the empty string Michael Haggerty
2016-04-27 16:57 ` [PATCH 05/29] refname_is_safe(): insist that the refname already be normalized Michael Haggerty
2016-04-27 17:59 ` Junio C Hamano
2016-04-27 20:10 ` David Turner
2016-04-27 20:15 ` Jeff King [this message]
2016-04-27 20:34 ` David Turner
2016-04-27 20:37 ` Jeff King
2016-04-27 22:19 ` Jeff King
2016-04-28 17:44 ` David Turner
2016-04-27 16:57 ` [PATCH 06/29] commit_ref_update(): write error message to *err, not stderr Michael Haggerty
2016-04-27 16:57 ` [PATCH 07/29] rename_ref(): remove unneeded local variable Michael Haggerty
2016-04-27 16:57 ` [PATCH 08/29] ref_transaction_commit(): remove local variable n Michael Haggerty
2016-04-27 18:16 ` Junio C Hamano
2016-04-27 20:45 ` Junio C Hamano
2016-04-27 16:57 ` [PATCH 09/29] read_raw_ref(): rename flags argument to type Michael Haggerty
2016-04-27 16:57 ` [PATCH 10/29] read_raw_ref(): clear *type at start of function Michael Haggerty
2016-04-27 16:57 ` [PATCH 11/29] read_raw_ref(): rename symref argument to referent Michael Haggerty
2016-04-27 16:57 ` [PATCH 12/29] read_raw_ref(): improve docstring Michael Haggerty
2016-04-27 18:31 ` Junio C Hamano
2016-04-27 16:57 ` [PATCH 13/29] lock_ref_sha1_basic(): remove unneeded local variable Michael Haggerty
2016-04-27 16:57 ` [PATCH 14/29] refs: make error messages more consistent Michael Haggerty
2016-04-27 16:57 ` [PATCH 15/29] ref_transaction_create(): disallow recursive pruning Michael Haggerty
2016-04-27 18:47 ` Junio C Hamano
2016-04-27 20:23 ` David Turner
2016-04-27 20:45 ` Junio C Hamano
2016-04-27 21:15 ` Junio C Hamano
2016-04-28 17:48 ` David Turner
2016-04-28 20:15 ` Junio C Hamano
2016-04-29 6:56 ` Michael Haggerty
2016-04-29 8:19 ` Junio C Hamano
2016-04-29 8:41 ` Junio C Hamano
2016-04-29 14:29 ` Michael Haggerty
2016-04-27 16:57 ` [PATCH 16/29] ref_transaction_commit(): correctly report close_ref() failure Michael Haggerty
2016-04-27 16:57 ` [PATCH 17/29] delete_branches(): use resolve_refdup() Michael Haggerty
2016-04-27 16:57 ` [PATCH 18/29] refs: allow log-only updates Michael Haggerty
2016-04-27 16:57 ` [PATCH 19/29] refs: don't dereference on rename Michael Haggerty
2016-04-27 18:55 ` Junio C Hamano
2016-04-29 7:38 ` Michael Haggerty
2016-04-29 8:53 ` Junio C Hamano
2016-04-29 10:57 ` Michael Haggerty
2016-04-29 12:12 ` Jeff King
2016-04-29 13:55 ` Michael Haggerty
2016-04-29 14:08 ` Jeff King
2016-04-29 15:29 ` Junio C Hamano
2016-04-29 23:21 ` David Turner
2016-04-30 3:48 ` Michael Haggerty
2016-05-02 17:55 ` Junio C Hamano
2016-04-27 16:57 ` [PATCH 20/29] verify_refname_available(): adjust constness in declaration Michael Haggerty
2016-04-27 16:57 ` [PATCH 21/29] add_update(): initialize the whole ref_update Michael Haggerty
2016-04-27 16:57 ` [PATCH 22/29] lock_ref_for_update(): new function Michael Haggerty
2016-04-27 16:57 ` [PATCH 23/29] unlock_ref(): move definition higher in the file Michael Haggerty
2016-04-27 16:57 ` [PATCH 24/29] ref_transaction_update(): check refname_is_safe() at a minimum Michael Haggerty
2016-04-27 20:14 ` Junio C Hamano
2016-04-29 7:42 ` Michael Haggerty
2016-04-29 8:53 ` Junio C Hamano
2016-04-27 16:57 ` [PATCH 25/29] refs: resolve symbolic refs first Michael Haggerty
2016-04-28 23:40 ` David Turner
2016-04-29 9:51 ` Michael Haggerty
2016-04-29 23:14 ` David Turner
2016-05-02 18:06 ` Junio C Hamano
2016-04-27 16:57 ` [PATCH 26/29] lock_ref_for_update(): don't re-read non-symbolic references Michael Haggerty
2016-04-27 16:57 ` [PATCH 27/29] lock_ref_for_update(): don't resolve symrefs Michael Haggerty
2016-04-27 16:57 ` [PATCH 28/29] commit_ref_update(): remove the flags parameter Michael Haggerty
2016-04-27 16:57 ` [PATCH 29/29] lock_ref_sha1_basic(): only handle REF_NODEREF mode Michael Haggerty
2016-04-29 15:43 ` Junio C Hamano
2016-04-29 1:14 ` [PATCH 00/29] Yet more preparation for reference backends David Turner
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
List information: http://vger.kernel.org/majordomo-info.html
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20160427201512.GA8073@sigill.intra.peff.net \
--to=peff@peff.net \
--cc=dturner@twopensource.com \
--cc=git@vger.kernel.org \
--cc=gitster@pobox.com \
--cc=mhagger@alum.mit.edu \
--cc=pclouds@gmail.com \
--cc=ramsay@ramsayjones.plus.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
Code repositories for project(s) associated with this public inbox
https://80x24.org/mirrors/git.git
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for read-only IMAP folder(s) and NNTP newsgroup(s).