git-check-ref-format: reject funny ref names.

Update check_ref_format() function to reject ref names that:

 * has a path component that begins with a ".", or
 * has a double dots "..", or
 * has ASCII control character, "~", "^", ":" or SP, anywhere, or
 * ends with a "/".

Use it in 'git-checkout -b', 'git-branch', and 'git-tag' to make sure
that newly created refs are well-formed.

Signed-off-by: Junio C Hamano <junkio@cox.net>

diff --git a/Makefile b/Makefile
index 39d13613ad180da355a42c04868de53d43987174..3ae3d3b4603ca8f1b43d38f67205bdfd2268a20d 100644 (file)
--- a/Makefile
+++ b/Makefile
@@ -116,7 +116,7 @@ PROGRAMS = \
        git-ssh-upload git-tar-tree git-unpack-file \
        git-unpack-objects git-update-index git-update-server-info \
        git-upload-pack git-verify-pack git-write-tree \
-       git-update-ref git-symbolic-ref \
+       git-update-ref git-symbolic-ref git-check-ref-format \
        $(SIMPLE_PROGRAMS)
 
 # Backward compatibility -- to be removed after 1.0

diff --git a/check-ref-format.c b/check-ref-format.c
new file mode 100644 (file)
index 0000000..a0adb3d
--- /dev/null
+++ b/check-ref-format.c
@@ -0,0 +1,17 @@
+/*
+ * GIT - The information manager from hell
+ */
+
+#include "cache.h"
+#include "refs.h"
+
+#include <stdio.h>
+
+int main(int ac, char **av)
+{
+       if (ac != 2)
+               usage("git-check-ref-format refname");
+       if (check_ref_format(av[1]))
+               exit(1);
+       return 0;
+}

diff --git a/git-branch.sh b/git-branch.sh
index 074229c206d01b8ca097b4ced902e9bf40987a06..e2db9063d4c63288c5834046962290ff9dfca127 100755 (executable)
--- a/git-branch.sh
+++ b/git-branch.sh
@@ -13,38 +13,42 @@ If two arguments, create a new branch <branchname> based off of <start-point>.
 }
 
 delete_branch () {
-    option="$1" branch_name="$2"
+    option="$1"
+    shift
     headref=$(GIT_DIR="$GIT_DIR" git-symbolic-ref HEAD |
               sed -e 's|^refs/heads/||')
-    case ",$headref," in
-    ",$branch_name,")
-       die "Cannot delete the branch you are on." ;;
-    ,,)
-       die "What branch are you on anyway?" ;;
-    esac
-    branch=$(cat "$GIT_DIR/refs/heads/$branch_name") &&
-       branch=$(git-rev-parse --verify "$branch^0") ||
-           die "Seriously, what branch are you talking about?"
-    case "$option" in
-    -D)
-       ;;
-    *)
-       mbs=$(git-merge-base -a "$branch" HEAD | tr '\012' ' ')
-       case " $mbs " in
-       *' '$branch' '*)
-           # the merge base of branch and HEAD contains branch --
-           # which means that the HEAD contains everything in the HEAD.
+    for branch_name
+    do
+       case ",$headref," in
+       ",$branch_name,")
+           die "Cannot delete the branch you are on." ;;
+       ,,)
+           die "What branch are you on anyway?" ;;
+       esac
+       branch=$(cat "$GIT_DIR/refs/heads/$branch_name") &&
+           branch=$(git-rev-parse --verify "$branch^0") ||
+               die "Seriously, what branch are you talking about?"
+       case "$option" in
+       -D)
            ;;
        *)
-           echo >&2 "The branch '$branch_name' is not a strict subset of your current HEAD.
-If you are sure you want to delete it, run 'git branch -D $branch_name'."
-           exit 1
+           mbs=$(git-merge-base -a "$branch" HEAD | tr '\012' ' ')
+           case " $mbs " in
+           *' '$branch' '*)
+               # the merge base of branch and HEAD contains branch --
+               # which means that the HEAD contains everything in the HEAD.
+               ;;
+           *)
+               echo >&2 "The branch '$branch_name' is not a strict subset of your current HEAD.
+    If you are sure you want to delete it, run 'git branch -D $branch_name'."
+               exit 1
+               ;;
+           esac
            ;;
        esac
-       ;;
-    esac
-    rm -f "$GIT_DIR/refs/heads/$branch_name"
-    echo "Deleted branch $branch_name."
+       rm -f "$GIT_DIR/refs/heads/$branch_name"
+       echo "Deleted branch $branch_name."
+    done
     exit 0
 }
 
@@ -52,7 +56,7 @@ while case "$#,$1" in 0,*) break ;; *,-*) ;; *) break ;; esac
 do
        case "$1" in
        -d | -D)
-               delete_branch "$1" "$2"
+               delete_branch "$@"
                exit
                ;;
        --)
@@ -93,6 +97,9 @@ branchname="$1"
 
 rev=$(git-rev-parse --verify "$head") || exit
 
-[ -e "$GIT_DIR/refs/heads/$branchname" ] && die "$branchname already exists"
+[ -e "$GIT_DIR/refs/heads/$branchname" ] &&
+       die "$branchname already exists."
+git-check-ref-format "heads/$branchname" ||
+       die "we do not like '$branchname' as a branch name."
 
 echo $rev > "$GIT_DIR/refs/heads/$branchname"

diff --git a/git-checkout.sh b/git-checkout.sh
index c3825904b60d36edca96506d7f451cf0349b262d..2c053a33c3c78f27150cdd397ad28641787abb3a 100755 (executable)
--- a/git-checkout.sh
+++ b/git-checkout.sh
@@ -17,6 +17,8 @@ while [ "$#" != "0" ]; do
                        die "git checkout: -b needs a branch name"
                [ -e "$GIT_DIR/refs/heads/$newbranch" ] &&
                        die "git checkout: branch $newbranch already exists"
+               git-check-ref-format "heads/$newbranch" ||
+                       die "we do not like '$newbranch' as a branch name."
                ;;
        "-f")
                force=1

diff --git a/git-tag.sh b/git-tag.sh
index 400bdb9843c4ea19d17b2450f1efd16ba93b0fb8..11b0492ba83d23155e460d0a805eedd7bf556de1 100755 (executable)
--- a/git-tag.sh
+++ b/git-tag.sh
@@ -46,6 +46,8 @@ if [ -e "$GIT_DIR/refs/tags/$name" -a -z "$force" ]; then
     die "tag '$name' already exists"
 fi
 shift
+git-check-ref-format "tags/$name" ||
+       die "we do not like '$name' as a tag name."
 
 object=$(git-rev-parse --verify --default HEAD "$@") || exit 1
 type=$(git-cat-file -t $object) || exit 1

diff --git a/refs.c b/refs.c
index 5a8cbd4ef386da60d3f7a2cac4563fc993e38b94..d7f8dfddf4979c0dda2b888435e6c343b29409ad 100644 (file)
--- a/refs.c
+++ b/refs.c
@@ -335,17 +335,54 @@ int write_ref_sha1(const char *ref, int fd, const unsigned char *sha1)
        return retval;
 }
 
+/*
+ * Make sure "ref" is something reasonable to have under ".git/refs/";
+ * We do not like it if:
+ *
+ * - any path component of it begins with ".", or
+ * - it has double dots "..", or
+ * - it has ASCII control character, "~", "^", ":" or SP, anywhere, or
+ * - it ends with a "/".
+ */
+
+static inline int bad_ref_char(int ch)
+{
+       return (((unsigned) ch) <= ' ' ||
+               ch == '~' || ch == '^' || ch == ':');
+}
+
 int check_ref_format(const char *ref)
 {
-       char *middle;
-       if (ref[0] == '.' || ref[0] == '/')
-               return -1;
-       middle = strchr(ref, '/');
-       if (!middle || !middle[1])
-               return -1;
-       if (strchr(middle + 1, '/'))
-               return -1;
-       return 0;
+       int ch, level;
+       const char *cp = ref;
+
+       level = 0;
+       while (1) {
+               while ((ch = *cp++) == '/')
+                       ; /* tolerate duplicated slashes */
+               if (!ch)
+                       return -1; /* should not end with slashes */
+
+               /* we are at the beginning of the path component */
+               if (ch == '.' || bad_ref_char(ch))
+                       return -1;
+
+               /* scan the rest of the path component */
+               while ((ch = *cp++) != 0) {
+                       if (bad_ref_char(ch))
+                               return -1;
+                       if (ch == '/')
+                               break;
+                       if (ch == '.' && *cp == '.')
+                               return -1;
+               }
+               level++;
+               if (!ch) {
+                       if (level < 2)
+                               return -1; /* at least of form "heads/blah" */
+                       return 0;
+               }
+       }
 }
 
 int write_ref_sha1_unlocked(const char *ref, const unsigned char *sha1)