summaryrefslogtreecommitdiff
AgeCommit message (Collapse)Author
2021-02-12Git 2.27.1v2.27.1Johannes Schindelin
Signed-off-by: Johannes Schindelin <johannes.schindelin@gmx.de>
2021-02-12Sync with 2.26.3Johannes Schindelin
* maint-2.26: Git 2.26.3 Git 2.25.5 Git 2.24.4 Git 2.23.4 Git 2.22.5 Git 2.21.4 Git 2.20.5 Git 2.19.6 Git 2.18.5 Git 2.17.6 unpack_trees(): start with a fresh lstat cache run-command: invalidate lstat cache after a command finished checkout: fix bug that makes checkout follow symlinks in leading path
2021-02-12Git 2.26.3v2.26.3Johannes Schindelin
Signed-off-by: Johannes Schindelin <johannes.schindelin@gmx.de>
2021-02-12Sync with 2.25.5Johannes Schindelin
* maint-2.25: Git 2.25.5 Git 2.24.4 Git 2.23.4 Git 2.22.5 Git 2.21.4 Git 2.20.5 Git 2.19.6 Git 2.18.5 Git 2.17.6 unpack_trees(): start with a fresh lstat cache run-command: invalidate lstat cache after a command finished checkout: fix bug that makes checkout follow symlinks in leading path
2021-02-12Git 2.25.5v2.25.5Johannes Schindelin
Signed-off-by: Johannes Schindelin <johannes.schindelin@gmx.de>
2021-02-12Sync with 2.24.4Johannes Schindelin
* maint-2.24: Git 2.24.4 Git 2.23.4 Git 2.22.5 Git 2.21.4 Git 2.20.5 Git 2.19.6 Git 2.18.5 Git 2.17.6 unpack_trees(): start with a fresh lstat cache run-command: invalidate lstat cache after a command finished checkout: fix bug that makes checkout follow symlinks in leading path
2021-02-12Git 2.24.4v2.24.4Johannes Schindelin
Signed-off-by: Johannes Schindelin <johannes.schindelin@gmx.de>
2021-02-12Sync with 2.23.4Johannes Schindelin
* maint-2.23: Git 2.23.4 Git 2.22.5 Git 2.21.4 Git 2.20.5 Git 2.19.6 Git 2.18.5 Git 2.17.6 unpack_trees(): start with a fresh lstat cache run-command: invalidate lstat cache after a command finished checkout: fix bug that makes checkout follow symlinks in leading path
2021-02-12Git 2.23.4v2.23.4Johannes Schindelin
Signed-off-by: Johannes Schindelin <johannes.schindelin@gmx.de>
2021-02-12Sync with 2.22.5Johannes Schindelin
* maint-2.22: Git 2.22.5 Git 2.21.4 Git 2.20.5 Git 2.19.6 Git 2.18.5 Git 2.17.6 unpack_trees(): start with a fresh lstat cache run-command: invalidate lstat cache after a command finished checkout: fix bug that makes checkout follow symlinks in leading path
2021-02-12Git 2.22.5v2.22.5Johannes Schindelin
Signed-off-by: Johannes Schindelin <johannes.schindelin@gmx.de>
2021-02-12Sync with 2.21.4Johannes Schindelin
* maint-2.21: Git 2.21.4 Git 2.20.5 Git 2.19.6 Git 2.18.5 Git 2.17.6 unpack_trees(): start with a fresh lstat cache run-command: invalidate lstat cache after a command finished checkout: fix bug that makes checkout follow symlinks in leading path
2021-02-12Git 2.21.4v2.21.4Johannes Schindelin
Signed-off-by: Johannes Schindelin <johannes.schindelin@gmx.de>
2021-02-12Sync with 2.20.5Johannes Schindelin
* maint-2.20: Git 2.20.5 Git 2.19.6 Git 2.18.5 Git 2.17.6 unpack_trees(): start with a fresh lstat cache run-command: invalidate lstat cache after a command finished checkout: fix bug that makes checkout follow symlinks in leading path
2021-02-12Git 2.20.5v2.20.5Johannes Schindelin
Signed-off-by: Johannes Schindelin <johannes.schindelin@gmx.de>
2021-02-12Sync with 2.19.6Johannes Schindelin
* maint-2.19: Git 2.19.6 Git 2.18.5 Git 2.17.6 unpack_trees(): start with a fresh lstat cache run-command: invalidate lstat cache after a command finished checkout: fix bug that makes checkout follow symlinks in leading path
2021-02-12Git 2.19.6v2.19.6Johannes Schindelin
Signed-off-by: Johannes Schindelin <johannes.schindelin@gmx.de>
2021-02-12Sync with 2.18.5Johannes Schindelin
* maint-2.18: Git 2.18.5 Git 2.17.6 unpack_trees(): start with a fresh lstat cache run-command: invalidate lstat cache after a command finished checkout: fix bug that makes checkout follow symlinks in leading path
2021-02-12Git 2.18.5v2.18.5Johannes Schindelin
Signed-off-by: Johannes Schindelin <johannes.schindelin@gmx.de>
2021-02-12Sync with 2.17.6Johannes Schindelin
* maint-2.17: Git 2.17.6 unpack_trees(): start with a fresh lstat cache run-command: invalidate lstat cache after a command finished checkout: fix bug that makes checkout follow symlinks in leading path
2021-02-12Git 2.17.6v2.17.6Johannes Schindelin
Signed-off-by: Johannes Schindelin <johannes.schindelin@gmx.de>
2021-02-12unpack_trees(): start with a fresh lstat cacheMatheus Tavares
We really want to avoid relying on stale information. Signed-off-by: Matheus Tavares <matheus.bernardino@usp.br> Signed-off-by: Johannes Schindelin <johannes.schindelin@gmx.de>
2021-02-12run-command: invalidate lstat cache after a command finishedJohannes Schindelin
In the previous commit, we intercepted calls to `rmdir()` to invalidate the lstat cache in the successful case, so that the lstat cache could not have the idea that a directory exists where there is none. The same situation can arise, of course, when a separate process is spawned (most notably, this is the case in `submodule_move_head()`). Obviously, we cannot know whether a directory was removed in that process, therefore we must invalidate the lstat cache afterwards. Note: in contrast to `lstat_cache_aware_rmdir()`, we invalidate the lstat cache even in case of an error: the process might have removed a directory and still have failed afterwards. Co-authored-by: Matheus Tavares <matheus.bernardino@usp.br> Signed-off-by: Johannes Schindelin <johannes.schindelin@gmx.de>
2021-02-12checkout: fix bug that makes checkout follow symlinks in leading pathMatheus Tavares
Before checking out a file, we have to confirm that all of its leading components are real existing directories. And to reduce the number of lstat() calls in this process, we cache the last leading path known to contain only directories. However, when a path collision occurs (e.g. when checking out case-sensitive files in case-insensitive file systems), a cached path might have its file type changed on disk, leaving the cache on an invalid state. Normally, this doesn't bring any bad consequences as we usually check out files in index order, and therefore, by the time the cached path becomes outdated, we no longer need it anyway (because all files in that directory would have already been written). But, there are some users of the checkout machinery that do not always follow the index order. In particular: checkout-index writes the paths in the same order that they appear on the CLI (or stdin); and the delayed checkout feature -- used when a long-running filter process replies with "status=delayed" -- postpones the checkout of some entries, thus modifying the checkout order. When we have to check out an out-of-order entry and the lstat() cache is invalid (due to a previous path collision), checkout_entry() may end up using the invalid data and thrusting that the leading components are real directories when, in reality, they are not. In the best case scenario, where the directory was replaced by a regular file, the user will get an error: "fatal: unable to create file 'foo/bar': Not a directory". But if the directory was replaced by a symlink, checkout could actually end up following the symlink and writing the file at a wrong place, even outside the repository. Since delayed checkout is affected by this bug, it could be used by an attacker to write arbitrary files during the clone of a maliciously crafted repository. Some candidate solutions considered were to disable the lstat() cache during unordered checkouts or sort the entries before passing them to the checkout machinery. But both ideas include some performance penalty and they don't future-proof the code against new unordered use cases. Instead, we now manually reset the lstat cache whenever we successfully remove a directory. Note: We are not even checking whether the directory was the same as the lstat cache points to because we might face a scenario where the paths refer to the same location but differ due to case folding, precomposed UTF-8 issues, or the presence of `..` components in the path. Two regression tests, with case-collisions and utf8-collisions, are also added for both checkout-index and delayed checkout. Note: to make the previously mentioned clone attack unfeasible, it would be sufficient to reset the lstat cache only after the remove_subtree() call inside checkout_entry(). This is the place where we would remove a directory whose path collides with the path of another entry that we are currently trying to check out (possibly a symlink). However, in the interest of a thorough fix that does not leave Git open to similar-but-not-identical attack vectors, we decided to intercept all `rmdir()` calls in one fell swoop. This addresses CVE-2021-21300. Co-authored-by: Johannes Schindelin <johannes.schindelin@gmx.de> Signed-off-by: Matheus Tavares <matheus.bernardino@usp.br>
2020-05-31Git 2.27v2.27.0Junio C Hamano
Signed-off-by: Junio C Hamano <gitster@pobox.com>
2020-05-31Merge branch 'cb/test-use-ere-for-alternation'Junio C Hamano
Portability fix for tests added recently. * cb/test-use-ere-for-alternation: t: avoid alternation (not POSIX) in grep's BRE
2020-05-31Merge tag 'l10n-2.27.0-rnd2' of git://github.com/git-l10n/git-poJunio C Hamano
l10n-2.27.0-rnd2 * tag 'l10n-2.27.0-rnd2' of git://github.com/git-l10n/git-po: (23 commits) l10n: zh_TW.po: v2.27.0 round 2 (0 untranslated) l10n: zh_TW.po: v2.27.0 round 1 (0 untranslated) l10n: de.po: Fix typo in the German translation of octopus l10n: de.po: Update German translation for Git 2.27.0 l10n: it.po: update for Git 2.27.0 round #2 l10n: tr: v2.27.0 round 2 l10n: fr.po v2.27.0 rnd 2 l10n: bg.po: Updated Bulgarian translation (4875t) l10n: Update Catalan translation l10n: sv.po: Update Swedish translation (4875t0f0u) l10n: vi(4875t): Updated Vietnamses translation for 2.27.0rd2 l10n: zh_CN: for git v2.27.0 l10n round 1~2 l10n: git.pot: v2.27.0 round 2 (+1) l10n: Update Catalan translation l10n: vi(4874t): Updated Vietnamses translation for 2.27.0 l10n: es: 2.27.0 round 1 l10n: bg.po: Updated Bulgarian translation (4868t) l10n: fr v2.27.0 rnd 1 l10n: sv.po: Update Swedish translation (4839t0f0u) l10n: tr: v2.27.0 round 1 ...
2020-05-30Merge branch 'master' of github.com:ruester/git-po-deJiang Xin
* 'master' of github.com:ruester/git-po-de: l10n: de.po: Fix typo in the German translation of octopus l10n: de.po: Update German translation for Git 2.27.0
2020-05-30Merge branch of github.com:AlessandroMenti/git-poJiang Xin
* 'update-italian-translation' of github.com:AlessandroMenti/git-po: l10n: it.po: update for Git 2.27.0 round #2
2020-05-29Merge branch 'bc/sha-256-part-1-of-4'Junio C Hamano
Docfix. * bc/sha-256-part-1-of-4: Documentation: correct hash environment variable
2020-05-29Merge branch 'ma/rev-list-options-docfix'Junio C Hamano
Docfix. * ma/rev-list-options-docfix: rev-list-options.txt: start a list for `show-pulls`
2020-05-29Merge branch 'jk/ci-only-on-selected-branches'Junio C Hamano
Dev support. * jk/ci-only-on-selected-branches: ci/config: correct instruction for CI preferences
2020-05-29t: avoid alternation (not POSIX) in grep's BRECarlo Marcelo Arenas Belón
f1e3df3169 (t: increase test coverage of signature verification output, 2020-03-04) adds GPG dependent tests to t4202 and t6200 that were found problematic with at least OpenBSD 6.7. Using an escaped '|' for alternations works only in some implementations of grep (e.g. GNU and busybox). It is not part of POSIX[1] and not supported by some BSD, macOS, and possibly other POSIX compatible implementations. Use `grep -E`, and write it using extended regular expression. [1] https://pubs.opengroup.org/onlinepubs/9699919799/basedefs/V1_chap09.html#tag_09_03 Helped-by: Torsten Bögershausen <tboegi@web.de> Signed-off-by: Carlo Marcelo Arenas Belón <carenas@gmail.com> Signed-off-by: Junio C Hamano <gitster@pobox.com>
2020-05-30l10n: zh_TW.po: v2.27.0 round 2 (0 untranslated)Yi-Jyun Pan
Signed-off-by: Yi-Jyun Pan <pan93412@gmail.com>
2020-05-30l10n: zh_TW.po: v2.27.0 round 1 (0 untranslated)Yi-Jyun Pan
Signed-off-by: Yi-Jyun Pan <pan93412@gmail.com>
2020-05-29l10n: de.po: Fix typo in the German translation of octopusJan Engelhardt
Signed-off-by: Jan Engelhardt <jengelh@inai.de> Signed-off-by: Matthias Rüster <matthias.ruester@gmail.com>
2020-05-29l10n: de.po: Update German translation for Git 2.27.0Matthias Rüster
Reviewed-by: Ralf Thielow <ralf.thielow@gmail.com> Signed-off-by: Matthias Rüster <matthias.ruester@gmail.com>
2020-05-28l10n: it.po: update for Git 2.27.0 round #2Alessandro Menti
Signed-off-by: Alessandro Menti <alessandro.menti@alessandromenti.it>
2020-05-28Merge branch 'fr_2.27.0rnd2' of github.com:jnavila/gitJiang Xin
* 'fr_2.27.0rnd2' of github.com:jnavila/git: l10n: fr.po v2.27.0 rnd 2
2020-05-28Merge branch 'master' of github.com:bitigchi/git-poJiang Xin
* 'master' of github.com:bitigchi/git-po: l10n: tr: v2.27.0 round 2
2020-05-28Merge branch 'master' of github.com:alshopov/git-poJiang Xin
* 'master' of github.com:alshopov/git-po: l10n: bg.po: Updated Bulgarian translation (4875t)
2020-05-28Merge branch 'master' of github.com:Softcatala/git-poJiang Xin
* 'master' of github.com:Softcatala/git-po: l10n: Update Catalan translation
2020-05-27Documentation: correct hash environment variableToon Claes
To set the default hash algorithm you can set the `GIT_DEFAULT_HASH` environment variable. In the documentation this variable is named `GIT_DEFAULT_HASH_ALGORITHM`, which is incorrect. Signed-off-by: Toon Claes <toon@iotcl.com> Signed-off-by: Junio C Hamano <gitster@pobox.com>
2020-05-27l10n: tr: v2.27.0 round 2Emir Sarı
Signed-off-by: Emir Sarı <bitigchi@me.com>
2020-05-27l10n: fr.po v2.27.0 rnd 2Jean-Noël Avila
Signed-off-by: Jean-Noël Avila <jn.avila@free.fr>
2020-05-27l10n: bg.po: Updated Bulgarian translation (4875t)Alexander Shopov
Signed-off-by: Alexander Shopov <ash@kambanaria.org>
2020-05-27l10n: Update Catalan translationJordi Mas
Signed-off-by: Jordi Mas <jmas@softcatala.org>
2020-05-27l10n: sv.po: Update Swedish translation (4875t0f0u)Peter Krefting
Signed-off-by: Peter Krefting <peter@softwolves.pp.se>
2020-05-27l10n: vi(4875t): Updated Vietnamses translation for 2.27.0rd2Tran Ngoc Quan
Signed-off-by: Tran Ngoc Quan <vnwildman@gmail.com>
2020-05-27l10n: zh_CN: for git v2.27.0 l10n round 1~2Jiang Xin
Translate 73 new messages (4875t0f0u) for git 2.27.0. Reviewed-by: 依云 <lilydjwg@gmail.com> Reviewed-by: Fangyi Zhou <me@fangyi.io> Signed-off-by: Jiang Xin <worldhello.net@gmail.com>
generated by cgit v1.3 (git 2.53.0) at 2026-04-15 05:57:16 +0000