git/0002-setup-fix-safe.directory-key-not-being-checked.patch
Todd Zullinger 59a5ed4cff usability improvements on top of CVE-2022-24765
Per the release announcement¹, these patches...

    address usability issues in the recent releases 'v2.35.2',
    'v2.34.2', 'v2.33.2', 'v2.32.1', 'v2.31.2', and 'v2.30.3', where
    each "safe" directory has to be listed on the safe.directory
    configuration variables.  A broader escape hatch has been added so
    that the value '*' can be used to declare "my colleagues and their
    repositories I may ever visit are all trustworthy".

¹ https://lore.kernel.org/git/xmqq1qy04iqa.fsf@gitster.g/
2022-04-13 21:35:36 -04:00

49 lines
1.5 KiB
Diff

From bb50ec3cc300eeff3aba7a2bea145aabdb477d31 Mon Sep 17 00:00:00 2001
From: Matheus Valadares <me@m28.io>
Date: Wed, 13 Apr 2022 15:32:30 +0000
Subject: [PATCH 2/3] setup: fix safe.directory key not being checked
It seems that nothing is ever checking to make sure the safe directories
in the configs actually have the key safe.directory, so some unrelated
config that has a value with a certain directory would also make it a
safe directory.
Signed-off-by: Matheus Valadares <me@m28.io>
Signed-off-by: Derrick Stolee <derrickstolee@github.com>
Signed-off-by: Junio C Hamano <gitster@pobox.com>
---
setup.c | 3 +++
t/t0033-safe-directory.sh | 5 +++++
2 files changed, 8 insertions(+)
diff --git a/setup.c b/setup.c
index 3c6ed17af9..4b9f073617 100644
--- a/setup.c
+++ b/setup.c
@@ -1034,6 +1034,9 @@ static int safe_directory_cb(const char *key, const char *value, void *d)
{
struct safe_directory_data *data = d;
+ if (strcmp(key, "safe.directory"))
+ return 0;
+
if (!value || !*value)
data->is_safe = 0;
else {
diff --git a/t/t0033-safe-directory.sh b/t/t0033-safe-directory.sh
index 9380ff3d01..6f33c0dfef 100755
--- a/t/t0033-safe-directory.sh
+++ b/t/t0033-safe-directory.sh
@@ -21,6 +21,11 @@ test_expect_success 'safe.directory does not match' '
expect_rejected_dir
'
+test_expect_success 'path exist as different key' '
+ git config --global foo.bar "$(pwd)" &&
+ expect_rejected_dir
+'
+
test_expect_success 'safe.directory matches' '
git config --global --add safe.directory "$(pwd)" &&
git status