Skip to content

Commit 61df50c

Browse files
dschodscho
committed
Merge branch 'mingit-2.45.x-releases'
Synchronize with Git for Windows' v2.45.x release train. Signed-off-by: Johannes Schindelin <[email protected]>
2 parents 1e20af0 + ec7ae35 commit 61df50c

15 files changed

+244
-42
lines changed

Diff for: ‎Documentation/config.txt

+2
Original file line numberDiff line numberDiff line change
@@ -524,6 +524,8 @@ include::config/sequencer.txt[]
524524

525525
include::config/showbranch.txt[]
526526

527+
include::config/sideband.txt[]
528+
527529
include::config/sparse.txt[]
528530

529531
include::config/splitindex.txt[]

Diff for: ‎Documentation/config/credential.txt

+11
Original file line numberDiff line numberDiff line change
@@ -14,6 +14,17 @@ credential.useHttpPath::
1414
or https URL to be important. Defaults to false. See
1515
linkgit:gitcredentials[7] for more information.
1616

17+
credential.sanitizePrompt::
18+
By default, user names and hosts that are shown as part of the
19+
password prompt are not allowed to contain control characters (they
20+
will be URL-encoded by default). Configure this setting to `false` to
21+
override that behavior.
22+
23+
credential.protectProtocol::
24+
By default, Carriage Return characters are not allowed in the protocol
25+
that is used when Git talks to a credential helper. This setting allows
26+
users to override this default.
27+
1728
credential.username::
1829
If no username is set for a network authentication, use this username
1930
by default. See credential.<context>.* below, and

Diff for: ‎Documentation/config/sideband.txt

+16
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,16 @@
1+
sideband.allowControlCharacters::
2+
By default, control characters that are delivered via the sideband
3+
are masked, except ANSI color sequences. This prevents potentially
4+
unwanted ANSI escape sequences from being sent to the terminal. Use
5+
this config setting to override this behavior:
6+
+
7+
--
8+
color::
9+
Allow ANSI color sequences, line feeds and horizontal tabs,
10+
but mask all other control characters. This is the default.
11+
false::
12+
Mask all control characters other than line feeds and
13+
horizontal tabs.
14+
true::
15+
Allow all control characters to be sent to the terminal.
16+
--

Diff for: ‎credential.c

+31-18
Original file line numberDiff line numberDiff line change
@@ -125,6 +125,10 @@ static int credential_config_callback(const char *var, const char *value,
125125
}
126126
else if (!strcmp(key, "usehttppath"))
127127
c->use_http_path = git_config_bool(var, value);
128+
else if (!strcmp(key, "sanitizeprompt"))
129+
c->sanitize_prompt = git_config_bool(var, value);
130+
else if (!strcmp(key, "protectprotocol"))
131+
c->protect_protocol = git_config_bool(var, value);
128132

129133
return 0;
130134
}
@@ -222,7 +226,8 @@ static void credential_format(struct credential *c, struct strbuf *out)
222226
strbuf_addch(out, '@');
223227
}
224228
if (c->host)
225-
strbuf_addstr(out, c->host);
229+
strbuf_add_percentencode(out, c->host,
230+
STRBUF_ENCODE_HOST_AND_PORT);
226231
if (c->path) {
227232
strbuf_addch(out, '/');
228233
strbuf_add_percentencode(out, c->path, 0);
@@ -236,7 +241,10 @@ static char *credential_ask_one(const char *what, struct credential *c,
236241
struct strbuf prompt = STRBUF_INIT;
237242
char *r;
238243

239-
credential_describe(c, &desc);
244+
if (c->sanitize_prompt)
245+
credential_format(c, &desc);
246+
else
247+
credential_describe(c, &desc);
240248
if (desc.len)
241249
strbuf_addf(&prompt, "%s for '%s': ", what, desc.buf);
242250
else
@@ -355,7 +363,8 @@ int credential_read(struct credential *c, FILE *fp,
355363
return 0;
356364
}
357365

358-
static void credential_write_item(FILE *fp, const char *key, const char *value,
366+
static void credential_write_item(const struct credential *c,
367+
FILE *fp, const char *key, const char *value,
359368
int required)
360369
{
361370
if (!value && required)
@@ -364,41 +373,45 @@ static void credential_write_item(FILE *fp, const char *key, const char *value,
364373
return;
365374
if (strchr(value, '\n'))
366375
die("credential value for %s contains newline", key);
376+
if (c->protect_protocol && strchr(value, '\r'))
377+
die("credential value for %s contains carriage return\n"
378+
"If this is intended, set `credential.protectProtocol=false`",
379+
key);
367380
fprintf(fp, "%s=%s\n", key, value);
368381
}
369382

370383
void credential_write(const struct credential *c, FILE *fp,
371384
enum credential_op_type op_type)
372385
{
373386
if (credential_has_capability(&c->capa_authtype, op_type))
374-
credential_write_item(fp, "capability[]", "authtype", 0);
387+
credential_write_item(c, fp, "capability[]", "authtype", 0);
375388
if (credential_has_capability(&c->capa_state, op_type))
376-
credential_write_item(fp, "capability[]", "state", 0);
389+
credential_write_item(c, fp, "capability[]", "state", 0);
377390

378391
if (credential_has_capability(&c->capa_authtype, op_type)) {
379-
credential_write_item(fp, "authtype", c->authtype, 0);
380-
credential_write_item(fp, "credential", c->credential, 0);
392+
credential_write_item(c, fp, "authtype", c->authtype, 0);
393+
credential_write_item(c, fp, "credential", c->credential, 0);
381394
if (c->ephemeral)
382-
credential_write_item(fp, "ephemeral", "1", 0);
395+
credential_write_item(c, fp, "ephemeral", "1", 0);
383396
}
384-
credential_write_item(fp, "protocol", c->protocol, 1);
385-
credential_write_item(fp, "host", c->host, 1);
386-
credential_write_item(fp, "path", c->path, 0);
387-
credential_write_item(fp, "username", c->username, 0);
388-
credential_write_item(fp, "password", c->password, 0);
389-
credential_write_item(fp, "oauth_refresh_token", c->oauth_refresh_token, 0);
397+
credential_write_item(c, fp, "protocol", c->protocol, 1);
398+
credential_write_item(c, fp, "host", c->host, 1);
399+
credential_write_item(c, fp, "path", c->path, 0);
400+
credential_write_item(c, fp, "username", c->username, 0);
401+
credential_write_item(c, fp, "password", c->password, 0);
402+
credential_write_item(c, fp, "oauth_refresh_token", c->oauth_refresh_token, 0);
390403
if (c->password_expiry_utc != TIME_MAX) {
391404
char *s = xstrfmt("%"PRItime, c->password_expiry_utc);
392-
credential_write_item(fp, "password_expiry_utc", s, 0);
405+
credential_write_item(c, fp, "password_expiry_utc", s, 0);
393406
free(s);
394407
}
395408
for (size_t i = 0; i < c->wwwauth_headers.nr; i++)
396-
credential_write_item(fp, "wwwauth[]", c->wwwauth_headers.v[i], 0);
409+
credential_write_item(c, fp, "wwwauth[]", c->wwwauth_headers.v[i], 0);
397410
if (credential_has_capability(&c->capa_state, op_type)) {
398411
if (c->multistage)
399-
credential_write_item(fp, "continue", "1", 0);
412+
credential_write_item(c, fp, "continue", "1", 0);
400413
for (size_t i = 0; i < c->state_headers_to_send.nr; i++)
401-
credential_write_item(fp, "state[]", c->state_headers_to_send.v[i], 0);
414+
credential_write_item(c, fp, "state[]", c->state_headers_to_send.v[i], 0);
402415
}
403416
}
404417

Diff for: ‎credential.h

+5-1
Original file line numberDiff line numberDiff line change
@@ -168,7 +168,9 @@ struct credential {
168168
multistage: 1,
169169
quit:1,
170170
use_http_path:1,
171-
username_from_proto:1;
171+
username_from_proto:1,
172+
sanitize_prompt:1,
173+
protect_protocol:1;
172174

173175
struct credential_capability capa_authtype;
174176
struct credential_capability capa_state;
@@ -195,6 +197,8 @@ struct credential {
195197
.wwwauth_headers = STRVEC_INIT, \
196198
.state_headers = STRVEC_INIT, \
197199
.state_headers_to_send = STRVEC_INIT, \
200+
.sanitize_prompt = 1, \
201+
.protect_protocol = 1, \
198202
}
199203

200204
/* Initialize a credential structure, setting all fields to empty. */

Diff for: ‎sideband.c

+76-2
Original file line numberDiff line numberDiff line change
@@ -23,6 +23,12 @@ static struct keyword_entry keywords[] = {
2323
{ "error", GIT_COLOR_BOLD_RED },
2424
};
2525

26+
static enum {
27+
ALLOW_NO_CONTROL_CHARACTERS = 0,
28+
ALLOW_ALL_CONTROL_CHARACTERS = 1,
29+
ALLOW_ANSI_COLOR_SEQUENCES = 2
30+
} allow_control_characters = ALLOW_ANSI_COLOR_SEQUENCES;
31+
2632
/* Returns a color setting (GIT_COLOR_NEVER, etc). */
2733
static int use_sideband_colors(void)
2834
{
@@ -36,6 +42,25 @@ static int use_sideband_colors(void)
3642
if (use_sideband_colors_cached >= 0)
3743
return use_sideband_colors_cached;
3844

45+
switch (git_config_get_maybe_bool("sideband.allowcontrolcharacters", &i)) {
46+
case 0: /* Boolean value */
47+
allow_control_characters = i ? ALLOW_ALL_CONTROL_CHARACTERS :
48+
ALLOW_NO_CONTROL_CHARACTERS;
49+
break;
50+
case -1: /* non-Boolean value */
51+
if (git_config_get_string("sideband.allowcontrolcharacters",
52+
&value))
53+
; /* huh? `get_maybe_bool()` returned -1 */
54+
else if (!strcmp(value, "color"))
55+
allow_control_characters = ALLOW_ANSI_COLOR_SEQUENCES;
56+
else
57+
warning(_("unrecognized value for `sideband."
58+
"allowControlCharacters`: '%s'"), value);
59+
break;
60+
default:
61+
break; /* not configured */
62+
}
63+
3964
if (!git_config_get_string(key, &value)) {
4065
use_sideband_colors_cached = git_config_colorbool(key, value);
4166
} else if (!git_config_get_string("color.ui", &value)) {
@@ -64,6 +89,55 @@ void list_config_color_sideband_slots(struct string_list *list, const char *pref
6489
list_config_item(list, prefix, keywords[i].keyword);
6590
}
6691

92+
static int handle_ansi_color_sequence(struct strbuf *dest, const char *src, int n)
93+
{
94+
int i;
95+
96+
/*
97+
* Valid ANSI color sequences are of the form
98+
*
99+
* ESC [ [<n> [; <n>]*] m
100+
*/
101+
102+
if (allow_control_characters != ALLOW_ANSI_COLOR_SEQUENCES ||
103+
n < 3 || src[0] != '\x1b' || src[1] != '[')
104+
return 0;
105+
106+
for (i = 2; i < n; i++) {
107+
if (src[i] == 'm') {
108+
strbuf_add(dest, src, i + 1);
109+
return i;
110+
}
111+
if (!isdigit(src[i]) && src[i] != ';')
112+
break;
113+
}
114+
115+
return 0;
116+
}
117+
118+
static void strbuf_add_sanitized(struct strbuf *dest, const char *src, int n)
119+
{
120+
int i;
121+
122+
if (allow_control_characters == ALLOW_ALL_CONTROL_CHARACTERS) {
123+
strbuf_add(dest, src, n);
124+
return;
125+
}
126+
127+
strbuf_grow(dest, n);
128+
for (; n && *src; src++, n--) {
129+
if (!iscntrl(*src) || *src == '\t' || *src == '\n')
130+
strbuf_addch(dest, *src);
131+
else if ((i = handle_ansi_color_sequence(dest, src, n))) {
132+
src += i;
133+
n -= i;
134+
} else {
135+
strbuf_addch(dest, '^');
136+
strbuf_addch(dest, 0x40 + *src);
137+
}
138+
}
139+
}
140+
67141
/*
68142
* Optionally highlight one keyword in remote output if it appears at the start
69143
* of the line. This should be called for a single line only, which is
@@ -79,7 +153,7 @@ static void maybe_colorize_sideband(struct strbuf *dest, const char *src, int n)
79153
int i;
80154

81155
if (!want_color_stderr(use_sideband_colors())) {
82-
strbuf_add(dest, src, n);
156+
strbuf_add_sanitized(dest, src, n);
83157
return;
84158
}
85159

@@ -112,7 +186,7 @@ static void maybe_colorize_sideband(struct strbuf *dest, const char *src, int n)
112186
}
113187
}
114188

115-
strbuf_add(dest, src, n);
189+
strbuf_add_sanitized(dest, src, n);
116190
}
117191

118192

Diff for: ‎strbuf.c

+3-1
Original file line numberDiff line numberDiff line change
@@ -495,7 +495,9 @@ void strbuf_add_percentencode(struct strbuf *dst, const char *src, int flags)
495495
unsigned char ch = src[i];
496496
if (ch <= 0x1F || ch >= 0x7F ||
497497
(ch == '/' && (flags & STRBUF_ENCODE_SLASH)) ||
498-
strchr(URL_UNSAFE_CHARS, ch))
498+
((flags & STRBUF_ENCODE_HOST_AND_PORT) ?
499+
!isalnum(ch) && !strchr("-.:[]", ch) :
500+
!!strchr(URL_UNSAFE_CHARS, ch)))
499501
strbuf_addf(dst, "%%%02X", (unsigned char)ch);
500502
else
501503
strbuf_addch(dst, ch);

Diff for: ‎strbuf.h

+1
Original file line numberDiff line numberDiff line change
@@ -356,6 +356,7 @@ void strbuf_expand_bad_format(const char *format, const char *command);
356356
void strbuf_addbuf_percentquote(struct strbuf *dst, const struct strbuf *src);
357357

358358
#define STRBUF_ENCODE_SLASH 1
359+
#define STRBUF_ENCODE_HOST_AND_PORT 2
359360

360361
/**
361362
* Append the contents of a string to a strbuf, percent-encoding any characters

Diff for: ‎t/t0300-credentials.sh

+49
Original file line numberDiff line numberDiff line change
@@ -77,6 +77,10 @@ test_expect_success 'setup helper scripts' '
7777
test -z "$pexpiry" || echo password_expiry_utc=$pexpiry
7878
EOF
7979
80+
write_script git-credential-cntrl-in-username <<-\EOF &&
81+
printf "username=\\007latrix Lestrange\\n"
82+
EOF
83+
8084
PATH="$PWD$PATH_SEP$PATH"
8185
'
8286

@@ -697,6 +701,19 @@ test_expect_success 'match percent-encoded values in username' '
697701
EOF
698702
'
699703

704+
test_expect_success 'match percent-encoded values in hostname' '
705+
test_config "credential.https://a%20b%20c/.helper" "$HELPER" &&
706+
check fill <<-\EOF
707+
url=https://a b c/
708+
--
709+
protocol=https
710+
host=a b c
711+
username=foo
712+
password=bar
713+
--
714+
EOF
715+
'
716+
700717
test_expect_success 'fetch with multiple path components' '
701718
test_unconfig credential.helper &&
702719
test_config credential.https://example.com/foo/repo.git.helper "verbatim foo bar" &&
@@ -886,6 +903,22 @@ test_expect_success 'url parser rejects embedded newlines' '
886903
test_cmp expect stderr
887904
'
888905

906+
test_expect_success 'url parser rejects embedded carriage returns' '
907+
test_config credential.helper "!true" &&
908+
test_must_fail git credential fill 2>stderr <<-\EOF &&
909+
url=https://example%0d.com/
910+
EOF
911+
cat >expect <<-\EOF &&
912+
fatal: credential value for host contains carriage return
913+
If this is intended, set `credential.protectProtocol=false`
914+
EOF
915+
test_cmp expect stderr &&
916+
GIT_ASKPASS=true \
917+
git -c credential.protectProtocol=false credential fill <<-\EOF
918+
url=https://example%0d.com/
919+
EOF
920+
'
921+
889922
test_expect_success 'host-less URLs are parsed as empty host' '
890923
check fill "verbatim foo bar" <<-\EOF
891924
url=cert:///path/to/cert.pem
@@ -995,4 +1028,20 @@ test_expect_success 'credential config with partial URLs' '
9951028
test_grep "skipping credential lookup for key" stderr
9961029
'
9971030

1031+
BEL="$(printf '\007')"
1032+
1033+
test_expect_success 'interactive prompt is sanitized' '
1034+
check fill cntrl-in-username <<-EOF
1035+
protocol=https
1036+
host=example.org
1037+
--
1038+
protocol=https
1039+
host=example.org
1040+
username=${BEL}latrix Lestrange
1041+
password=askpass-password
1042+
--
1043+
askpass: Password for ${SQ}https://%07latrix%[email protected]${SQ}:
1044+
EOF
1045+
'
1046+
9981047
test_done

0 commit comments

Comments
 (0)