git/http.c, branch v2.26.2

Git 2.26.2

2020-04-19T23:32:24Z

This merges up the security fix from v2.17.5. Signed-off-by: Jonathan Nieder

Git 2.25.4

2020-04-19T23:31:07Z

This merges up the security fix from v2.17.5. Signed-off-by: Jonathan Nieder

Git 2.24.3

2020-04-19T23:30:34Z

This merges up the security fix from v2.17.5. Signed-off-by: Jonathan Nieder

Git 2.22.4

2020-04-19T23:30:19Z

This merges up the security fix from v2.17.5. Signed-off-by: Jonathan Nieder

Git 2.21.3

2020-04-19T23:30:08Z

This merges up the security fix from v2.17.5. Signed-off-by: Jonathan Nieder

Git 2.20.4

2020-04-19T23:28:57Z

This merges up the security fix from v2.17.5. Signed-off-by: Jonathan Nieder

Git 2.19.5

2020-04-19T23:26:41Z

This merges up the security fix from v2.17.5. Signed-off-by: Jonathan Nieder

Git 2.18.4

2020-04-19T23:24:14Z

This merges up the security fix from v2.17.5. Signed-off-by: Jonathan Nieder

credential: parse URL without host as empty host, not unset

2020-04-19T23:10:57Z

We may feed a URL like "cert:///path/to/cert.pem" into the credential machinery to get the key for a client-side certificate. That credential has no hostname field, which is about to be disallowed (to avoid confusion with protocols where a helper _would_ expect a hostname). This means as of the next patch, credential helpers won't work for unlocking certs. Let's fix that by doing two things: - when we parse a url with an empty host, set the host field to the empty string (asking only to match stored entries with an empty host) rather than NULL (asking to match _any_ host). - when we build a cert:// credential by hand, similarly assign an empty string It's the latter that is more likely to impact real users in practice, since it's what's used for http connections. But we don't have good infrastructure to test it. The url-parsing version will help anybody using git-credential in a script, and is easy to test. Signed-off-by: Jeff King Reviewed-by: Taylor Blau Signed-off-by: Jonathan Nieder

strbuf: add and use strbuf_insertstr()

2020-02-10T17:04:45Z

Add a function for inserting a C string into a strbuf. Use it throughout the source to get rid of magic string length constants and explicit strlen() calls. Like strbuf_addstr(), implement it as an inline function to avoid the implicit strlen() calls to cause runtime overhead. Helped-by: Taylor Blau Helped-by: Eric Sunshine Signed-off-by: René Scharfe Signed-off-by: Junio C Hamano