git/0001-t0033-add-tests-for-safe.directory.patch
Todd Zullinger 59a5ed4cff usability improvements on top of CVE-2022-24765
Per the release announcement¹, these patches...

    address usability issues in the recent releases 'v2.35.2',
    'v2.34.2', 'v2.33.2', 'v2.32.1', 'v2.31.2', and 'v2.30.3', where
    each "safe" directory has to be listed on the safe.directory
    configuration variables.  A broader escape hatch has been added so
    that the value '*' can be used to declare "my colleagues and their
    repositories I may ever visit are all trustworthy".

¹ https://lore.kernel.org/git/xmqq1qy04iqa.fsf@gitster.g/
2022-04-13 21:35:36 -04:00

73 lines
2.1 KiB
Diff

From e47363e5a8bdf5144059d664c45c0975243ef05b Mon Sep 17 00:00:00 2001
From: Derrick Stolee <derrickstolee@github.com>
Date: Wed, 13 Apr 2022 15:32:29 +0000
Subject: [PATCH 1/3] t0033: add tests for safe.directory
It is difficult to change the ownership on a directory in our test
suite, so insert a new GIT_TEST_ASSUME_DIFFERENT_OWNER environment
variable to trick Git into thinking we are in a differently-owned
directory. This allows us to test that the config is parsed correctly.
Signed-off-by: Derrick Stolee <derrickstolee@github.com>
Signed-off-by: Junio C Hamano <gitster@pobox.com>
---
setup.c | 3 ++-
t/t0033-safe-directory.sh | 34 ++++++++++++++++++++++++++++++++++
2 files changed, 36 insertions(+), 1 deletion(-)
create mode 100755 t/t0033-safe-directory.sh
diff --git a/setup.c b/setup.c
index 95d5b00940..3c6ed17af9 100644
--- a/setup.c
+++ b/setup.c
@@ -1053,7 +1053,8 @@ static int ensure_valid_ownership(const char *path)
{
struct safe_directory_data data = { .path = path };
- if (is_path_owned_by_current_user(path))
+ if (!git_env_bool("GIT_TEST_ASSUME_DIFFERENT_OWNER", 0) &&
+ is_path_owned_by_current_user(path))
return 1;
read_very_early_config(safe_directory_cb, &data);
diff --git a/t/t0033-safe-directory.sh b/t/t0033-safe-directory.sh
new file mode 100755
index 0000000000..9380ff3d01
--- /dev/null
+++ b/t/t0033-safe-directory.sh
@@ -0,0 +1,34 @@
+#!/bin/sh
+
+test_description='verify safe.directory checks'
+
+. ./test-lib.sh
+
+GIT_TEST_ASSUME_DIFFERENT_OWNER=1
+export GIT_TEST_ASSUME_DIFFERENT_OWNER
+
+expect_rejected_dir () {
+ test_must_fail git status 2>err &&
+ grep "safe.directory" err
+}
+
+test_expect_success 'safe.directory is not set' '
+ expect_rejected_dir
+'
+
+test_expect_success 'safe.directory does not match' '
+ git config --global safe.directory bogus &&
+ expect_rejected_dir
+'
+
+test_expect_success 'safe.directory matches' '
+ git config --global --add safe.directory "$(pwd)" &&
+ git status
+'
+
+test_expect_success 'safe.directory matches, but is reset' '
+ git config --global --add safe.directory "" &&
+ expect_rejected_dir
+'
+
+test_done