diff options
| -rw-r--r-- | builtin/apply.c | 109 | ||||
| -rwxr-xr-x | t/t4139-apply-escape.sh | 6 |
2 files changed, 112 insertions, 3 deletions
diff --git a/builtin/apply.c b/builtin/apply.c index 60d821c06f..a760d97848 100644 --- a/builtin/apply.c +++ b/builtin/apply.c @@ -3486,6 +3486,103 @@ static int check_to_create(const char *new_name, int ok_if_exists) return 0; } +/* + * We need to keep track of how symlinks in the preimage are + * manipulated by the patches. A patch to add a/b/c where a/b + * is a symlink should not be allowed to affect the directory + * the symlink points at, but if the same patch removes a/b, + * it is perfectly fine, as the patch removes a/b to make room + * to create a directory a/b so that a/b/c can be created. + */ +static struct string_list symlink_changes; +#define SYMLINK_GOES_AWAY 01 +#define SYMLINK_IN_RESULT 02 + +static uintptr_t register_symlink_changes(const char *path, uintptr_t what) +{ + struct string_list_item *ent; + + ent = string_list_lookup(&symlink_changes, path); + if (!ent) { + ent = string_list_insert(&symlink_changes, path); + ent->util = (void *)0; + } + ent->util = (void *)(what | ((uintptr_t)ent->util)); + return (uintptr_t)ent->util; +} + +static uintptr_t check_symlink_changes(const char *path) +{ + struct string_list_item *ent; + + ent = string_list_lookup(&symlink_changes, path); + if (!ent) + return 0; + return (uintptr_t)ent->util; +} + +static void prepare_symlink_changes(struct patch *patch) +{ + for ( ; patch; patch = patch->next) { + if ((patch->old_name && S_ISLNK(patch->old_mode)) && + (patch->is_rename || patch->is_delete)) + /* the symlink at patch->old_name is removed */ + register_symlink_changes(patch->old_name, SYMLINK_GOES_AWAY); + + if (patch->new_name && S_ISLNK(patch->new_mode)) + /* the symlink at patch->new_name is created or remains */ + register_symlink_changes(patch->new_name, SYMLINK_IN_RESULT); + } +} + +static int path_is_beyond_symlink_1(struct strbuf *name) +{ + do { + unsigned int change; + + while (--name->len && name->buf[name->len] != '/') + ; /* scan backwards */ + if (!name->len) + break; + name->buf[name->len] = '\0'; + change = check_symlink_changes(name->buf); + if (change & SYMLINK_IN_RESULT) + return 1; + if (change & SYMLINK_GOES_AWAY) + /* + * This cannot be "return 0", because we may + * see a new one created at a higher level. + */ + continue; + + /* otherwise, check the preimage */ + if (check_index) { + int pos = cache_name_pos(name->buf, name->len); + if (0 <= pos && + S_ISLNK(active_cache[pos]->ce_mode)) + return 1; + } else { + struct stat st; + if (!lstat(name->buf, &st) && S_ISLNK(st.st_mode)) + return 1; + } + } while (1); + return 0; +} + +static int path_is_beyond_symlink(const char *name_) +{ + int ret; + struct strbuf name = STRBUF_INIT; + + assert(*name_ != '\0'); + strbuf_addstr(&name, name_); + ret = path_is_beyond_symlink_1(&name); + strbuf_release(&name); + + return ret; +} + static void die_on_unsafe_path(struct patch *patch) { const char *old_name = NULL; @@ -3593,6 +3690,17 @@ static int check_patch(struct patch *patch) if (!unsafe_paths) die_on_unsafe_path(patch); + /* + * An attempt to read from or delete a path that is beyond + * a symbolic link will be prevented by load_patch_target() + * that is called at the beginning of apply_data(). We need + * to make sure that the patch result is not deposited to + * a path that is beyond a symbolic link ourselves. + */ + if (!patch->is_delete && path_is_beyond_symlink(patch->new_name)) + return error(_("affected file '%s' is beyond a symbolic link"), + patch->new_name); + if (apply_data(patch, &st, ce) < 0) return error(_("%s: patch does not apply"), name); patch->rejected = 0; @@ -3603,6 +3711,7 @@ static int check_patch_list(struct patch *patch) { int err = 0; + prepare_symlink_changes(patch); prepare_fn_table(patch); while (patch) { if (apply_verbosely) diff --git a/t/t4139-apply-escape.sh b/t/t4139-apply-escape.sh index 5e6717935b..25917cc1c2 100755 --- a/t/t4139-apply-escape.sh +++ b/t/t4139-apply-escape.sh @@ -98,7 +98,7 @@ test_expect_success 'cannot del file containing .. (index)' ' test_path_is_file ../foo ' -test_expect_failure 'symlink escape via ..' ' +test_expect_success 'symlink escape via ..' ' { mkpatch_symlink tmp .. && mkpatch_add tmp/foo ../foo @@ -107,7 +107,7 @@ test_expect_failure 'symlink escape via ..' ' test_path_is_missing ../foo ' -test_expect_failure 'symlink escape via .. (index)' ' +test_expect_success 'symlink escape via .. (index)' ' { mkpatch_symlink tmp .. && mkpatch_add tmp/foo ../foo @@ -116,7 +116,7 @@ test_expect_failure 'symlink escape via .. (index)' ' test_path_is_missing ../foo ' -test_expect_failure 'symlink escape via absolute path' ' +test_expect_success 'symlink escape via absolute path' ' { mkpatch_symlink tmp "$(pwd)" && mkpatch_add tmp/foo ../foo |