From mboxrd@z Thu Jan 1 00:00:00 1970 From: Jeff King Subject: Re: [PATCH 05/29] refname_is_safe(): insist that the refname already be normalized Date: Wed, 27 Apr 2016 16:15:13 -0400 Message-ID: <20160427201512.GA8073@sigill.intra.peff.net> References: <1461787832.11504.1.camel@twopensource.com> Mime-Version: 1.0 Content-Type: text/plain; charset=utf-8 Cc: Junio C Hamano , Michael Haggerty , git@vger.kernel.org, =?utf-8?B?Tmd1eeG7hW4gVGjDoWkgTmfhu41j?= Duy , Ramsay Jones To: David Turner X-From: git-owner@vger.kernel.org Wed Apr 27 22:15:24 2016 Return-path: Envelope-to: gcvg-git-2@plane.gmane.org Received: from vger.kernel.org ([209.132.180.67]) by plane.gmane.org with esmtp (Exim 4.69) (envelope-from ) id 1avVrn-0006Xm-7c for gcvg-git-2@plane.gmane.org; Wed, 27 Apr 2016 22:15:23 +0200 Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1752972AbcD0UPR (ORCPT ); Wed, 27 Apr 2016 16:15:17 -0400 Received: from cloud.peff.net ([50.56.180.127]:57850 "HELO cloud.peff.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with SMTP id S1752558AbcD0UPQ (ORCPT ); Wed, 27 Apr 2016 16:15:16 -0400 Received: (qmail 2522 invoked by uid 102); 27 Apr 2016 20:15:15 -0000 Received: from Unknown (HELO peff.net) (10.0.1.2) by cloud.peff.net (qpsmtpd/0.84) with SMTP; Wed, 27 Apr 2016 16:15:15 -0400 Received: (qmail 1699 invoked by uid 107); 27 Apr 2016 20:15:16 -0000 Received: from sigill.intra.peff.net (HELO sigill.intra.peff.net) (10.0.0.7) by peff.net (qpsmtpd/0.84) with SMTP; Wed, 27 Apr 2016 16:15:16 -0400 Received: by sigill.intra.peff.net (sSMTP sendmail emulation); Wed, 27 Apr 2016 16:15:13 -0400 Content-Disposition: inline In-Reply-To: <1461787832.11504.1.camel@twopensource.com> Sender: git-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: git@vger.kernel.org Archived-At: On Wed, Apr 27, 2016 at 04:10:32PM -0400, David Turner wrote: > On Wed, 2016-04-27 at 10:59 -0700, Junio C Hamano wrote: > > > There is another call to refname_is_safe() in resolve_ref_unsafe(), > > which applies the sanity check to the string from a symref. We seem > > to allow > > > > $ git symbolic-ref refs/heads/SSS refs/heads//master > > > > and we end up storing "ref: refs/heads//master" (or make a symbolic > > link with doubled slashes), but the current code considers the > > resulting symbolic link as "dangling". Again, this change moves the > > rejection a bit earlier in the codepath, without changing the end > > result, I'd think. > > I think we should disallow that -- refname_is_safe should probably call > (or be replaced with calls to) check_refname_format. I thought the point is that one is a lesser check than the other, and we need different rules for different situations. So we might allow deletion on a refname that does not pass check_refname_format(), but we must make sure it is not going to cause any mischief (e.g., escaping ".git" and deleting random files). But anything writing a _new_ refname (whether the actual ref, or referencing it via a symref) should be using check_refname_format() before writing. -Peff