From 820d7650cc670d3e4195aad3a5343158c316e8fa Mon Sep 17 00:00:00 2001 From: Junio C Hamano Date: Wed, 26 Jul 2017 10:24:20 -0700 Subject: connect: reject ssh hostname that begins with a dash When commands like "git fetch" talk with ssh://$rest_of_URL/, the code splits $rest_of_URL into components like host, port, etc., and then spawns the underlying "ssh" program by formulating argv[] array that has: - the path to ssh command taken from GIT_SSH_COMMAND, etc. - dashed options like '-batch' (for Tortoise), '-p ' as needed. - ssh_host, which is supposed to be the hostname parsed out of $rest_of_URL. - then the command to be run on the other side, e.g. git upload-pack. If the ssh_host ends up getting '-', the argv[] that is used to spawn the command becomes something like: { "ssh", "-p", "22", "-", "command", "to", "run", NULL } which obviously is bogus, but depending on the actual value of "", will make "ssh" parse and use it as an option. Prevent this by forbidding ssh_host that begins with a "-". Noticed-by: Joern Schneeweisz of Recurity Labs Reported-by: Brian at GitLab Signed-off-by: Junio C Hamano Reviewed-by: Jeff King Signed-off-by: Junio C Hamano --- connect.c | 3 +++ 1 file changed, 3 insertions(+) (limited to 'connect.c') diff --git a/connect.c b/connect.c index fd7ffe1840..0e8e05d83a 100644 --- a/connect.c +++ b/connect.c @@ -754,6 +754,9 @@ struct child_process *git_connect(int fd[2], const char *url, return NULL; } + if (ssh_host[0] == '-') + die("strange hostname '%s' blocked", ssh_host); + ssh = getenv("GIT_SSH_COMMAND"); if (!ssh) { const char *base; -- cgit v1.2.1