diff options
| author | Victoria Dye <vdye@github.com> | 2024-01-18 01:55:18 +0000 |
|---|---|---|
| committer | Junio C Hamano <gitster@pobox.com> | 2024-01-19 10:15:41 -0800 |
| commit | 8430b438f628f2f0df08622a550e750158167f28 (patch) | |
| tree | b41eb05e4e1a087148ef6aa883215feac80d74f3 /submodule-config.c | |
| parent | 7e2fc39d8c02048e9dddcba1b1b6786a8088a1a8 (diff) | |
| download | git-8430b438f628f2f0df08622a550e750158167f28.tar.gz | |
submodule-config.c: strengthen URL fsck check
Update the validation of "curl URL" submodule URLs (i.e. those that specify
an "http[s]" or "ftp[s]" protocol) in 'check_submodule_url()' to catch more
invalid URLs. The existing validation using 'credential_from_url_gently()'
parses certain URLs incorrectly, leading to invalid submodule URLs passing
'git fsck' checks. Conversely, 'url_normalize()' - used to validate remote
URLs in 'remote_get()' - correctly identifies the invalid URLs missed by
'credential_from_url_gently()'.
To catch more invalid cases, replace 'credential_from_url_gently()' with
'url_normalize()' followed by a 'url_decode()' and a check for newlines
(mirroring 'check_url_component()' in the 'credential_from_url_gently()'
validation).
Signed-off-by: Victoria Dye <vdye@github.com>
Signed-off-by: Junio C Hamano <gitster@pobox.com>
Diffstat (limited to 'submodule-config.c')
| -rw-r--r-- | submodule-config.c | 16 |
1 files changed, 11 insertions, 5 deletions
diff --git a/submodule-config.c b/submodule-config.c index cbec13b3a2..e9b94cb28d 100644 --- a/submodule-config.c +++ b/submodule-config.c @@ -15,7 +15,7 @@ #include "thread-utils.h" #include "tree-walk.h" #include "url.h" -#include "credential.h" +#include "urlmatch.h" /* * submodule cache lookup structure @@ -350,12 +350,18 @@ int check_submodule_url(const char *url) } else if (url_to_curl_url(url, &curl_url)) { - struct credential c = CREDENTIAL_INIT; int ret = 0; - if (credential_from_url_gently(&c, curl_url, 1) || - !*c.host) + char *normalized = url_normalize(curl_url, NULL); + if (normalized) { + char *decoded = url_decode(normalized); + if (strchr(decoded, '\n')) + ret = -1; + free(normalized); + free(decoded); + } else { ret = -1; - credential_clear(&c); + } + return ret; } |