From: Jeff King <peff@peff.net>
To: git@vger.kernel.org
Cc: Patrick Steinhardt <ps@pks.im>
Subject: [PATCH 7/8] refs: check refnames as fully qualified when writing
Date: Mon, 29 Apr 2024 04:34:01 -0400 [thread overview]
Message-ID: <20240429083401.GF233423@coredump.intra.peff.net> (raw)
When a ref update is queued via ref_transaction_update(), we call
check_refname_format() to make sure the name is acceptable. We pass
REFNAME_ALLOW_ONELEVEL, which allows pseudorefs like MERGE_HEAD. But
that's not enough to forbid names outside of refs/ like "foo/bar" or
even scary stuff like "config" (though fortunately I think that should
never work because we cannot resolve "config" to read the old value).
Let's instead pass REFNAME_FULLY_QUALIFIED, which tells the checking
function that we really do have a full refname, and it can enforce
it as such.
This means that "git update-ref foo/bar HEAD" will now be rejected. Note
that _deleting_ such a ref is already forbidden (and there is a test in
t1430 for that already), due to some confusing differences between
check_refname_format() and refname_is_safe(). See the previous commit
for more details.
Signed-off-by: Jeff King <peff@peff.net>
---
refs.c | 2 +-
t/t1430-bad-ref-name.sh | 10 ++++++++++
2 files changed, 11 insertions(+), 1 deletion(-)
diff --git a/refs.c b/refs.c
index 44b4419050..57663cfe9e 100644
--- a/refs.c
+++ b/refs.c
@@ -1267,7 +1267,7 @@ int ref_transaction_update(struct ref_transaction *transaction,
if (!(flags & REF_SKIP_REFNAME_VERIFICATION) &&
((new_oid && !is_null_oid(new_oid)) ?
- check_refname_format(refname, REFNAME_ALLOW_ONELEVEL) :
+ check_refname_format(refname, REFNAME_FULLY_QUALIFIED) :
!refname_is_safe(refname))) {
strbuf_addf(err, _("refusing to update ref with bad name '%s'"),
refname);
diff --git a/t/t1430-bad-ref-name.sh b/t/t1430-bad-ref-name.sh
index 0c00118c2b..120e1557d7 100755
--- a/t/t1430-bad-ref-name.sh
+++ b/t/t1430-bad-ref-name.sh
@@ -390,4 +390,14 @@ test_expect_success 'branch -m can rename refs/heads/-dash' '
git show-ref refs/heads/dash
'
+test_expect_success 'update-ref refuses lowercase outside of refs/' '
+ test_must_fail git update-ref lowercase HEAD 2>err &&
+ test_grep "refusing to update ref with bad name" err
+'
+
+test_expect_success 'update-ref refuses non-underscore outside of refs/' '
+ test_must_fail git update-ref FOO/HEAD HEAD 2>err &&
+ test_grep "refusing to update ref with bad name" err
+'
+
test_done
--
2.45.0.rc1.416.gbe2a76c799
reply other threads:[~2024-04-29 8:34 UTC|newest]
Thread overview: [no followups] expand[flat|nested] mbox.gz Atom feed
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20240429083401.GF233423@coredump.intra.peff.net \
--to=peff@peff.net \
--cc=git@vger.kernel.org \
--cc=ps@pks.im \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.