2014-09-26 00:02:39 +02:00
|
|
|
#!/bin/sh
|
|
|
|
|
|
|
|
|
|
test_description='Test handling of ref names that check-ref-format rejects'
|
|
|
|
|
. ./test-lib.sh
|
|
|
|
|
|
|
|
|
|
test_expect_success setup '
|
refs.c: allow listing and deleting badly named refs
We currently do not handle badly named refs well:
$ cp .git/refs/heads/master .git/refs/heads/master.....@\*@\\.
$ git branch
fatal: Reference has invalid format: 'refs/heads/master.....@*@\.'
$ git branch -D master.....@\*@\\.
error: branch 'master.....@*@\.' not found.
Users cannot recover from a badly named ref without manually finding
and deleting the loose ref file or appropriate line in packed-refs.
Making that easier will make it easier to tweak the ref naming rules
in the future, for example to forbid shell metacharacters like '`'
and '"', without putting people in a state that is hard to get out of.
So allow "branch --list" to show these refs and allow "branch -d/-D"
and "update-ref -d" to delete them. Other commands (for example to
rename refs) will continue to not handle these refs but can be changed
in later patches.
Details:
In resolving functions, refuse to resolve refs that don't pass the
git-check-ref-format(1) check unless the new RESOLVE_REF_ALLOW_BAD_NAME
flag is passed. Even with RESOLVE_REF_ALLOW_BAD_NAME, refuse to
resolve refs that escape the refs/ directory and do not match the
pattern [A-Z_]* (think "HEAD" and "MERGE_HEAD").
In locking functions, refuse to act on badly named refs unless they
are being deleted and either are in the refs/ directory or match [A-Z_]*.
Just like other invalid refs, flag resolved, badly named refs with the
REF_ISBROKEN flag, treat them as resolving to null_sha1, and skip them
in all iteration functions except for for_each_rawref.
Flag badly named refs (but not symrefs pointing to badly named refs)
with a REF_BAD_NAME flag to make it easier for future callers to
notice and handle them specially. For example, in a later patch
for-each-ref will use this flag to detect refs whose names can confuse
callers parsing for-each-ref output.
In the transaction API, refuse to create or update badly named refs,
but allow deleting them (unless they try to escape refs/ and don't match
[A-Z_]*).
Signed-off-by: Ronnie Sahlberg <sahlberg@google.com>
Signed-off-by: Jonathan Nieder <jrnieder@gmail.com>
Signed-off-by: Junio C Hamano <gitster@pobox.com>
2014-09-03 20:45:43 +02:00
|
|
|
test_commit one &&
|
|
|
|
|
test_commit two
|
2014-09-26 00:02:39 +02:00
|
|
|
'
|
|
|
|
|
|
|
|
|
|
test_expect_success 'fast-import: fail on invalid branch name ".badbranchname"' '
|
|
|
|
|
test_when_finished "rm -f .git/objects/pack_* .git/objects/index_*" &&
|
|
|
|
|
cat >input <<-INPUT_END &&
|
|
|
|
|
commit .badbranchname
|
|
|
|
|
committer $GIT_COMMITTER_NAME <$GIT_COMMITTER_EMAIL> $GIT_COMMITTER_DATE
|
|
|
|
|
data <<COMMIT
|
|
|
|
|
corrupt
|
|
|
|
|
COMMIT
|
|
|
|
|
|
|
|
|
|
from refs/heads/master
|
|
|
|
|
|
|
|
|
|
INPUT_END
|
|
|
|
|
test_must_fail git fast-import <input
|
|
|
|
|
'
|
|
|
|
|
|
|
|
|
|
test_expect_success 'fast-import: fail on invalid branch name "bad[branch]name"' '
|
|
|
|
|
test_when_finished "rm -f .git/objects/pack_* .git/objects/index_*" &&
|
|
|
|
|
cat >input <<-INPUT_END &&
|
|
|
|
|
commit bad[branch]name
|
|
|
|
|
committer $GIT_COMMITTER_NAME <$GIT_COMMITTER_EMAIL> $GIT_COMMITTER_DATE
|
|
|
|
|
data <<COMMIT
|
|
|
|
|
corrupt
|
|
|
|
|
COMMIT
|
|
|
|
|
|
|
|
|
|
from refs/heads/master
|
|
|
|
|
|
|
|
|
|
INPUT_END
|
|
|
|
|
test_must_fail git fast-import <input
|
|
|
|
|
'
|
|
|
|
|
|
2015-09-23 20:11:12 +02:00
|
|
|
test_expect_success 'git branch shows badly named ref as warning' '
|
refs.c: allow listing and deleting badly named refs
We currently do not handle badly named refs well:
$ cp .git/refs/heads/master .git/refs/heads/master.....@\*@\\.
$ git branch
fatal: Reference has invalid format: 'refs/heads/master.....@*@\.'
$ git branch -D master.....@\*@\\.
error: branch 'master.....@*@\.' not found.
Users cannot recover from a badly named ref without manually finding
and deleting the loose ref file or appropriate line in packed-refs.
Making that easier will make it easier to tweak the ref naming rules
in the future, for example to forbid shell metacharacters like '`'
and '"', without putting people in a state that is hard to get out of.
So allow "branch --list" to show these refs and allow "branch -d/-D"
and "update-ref -d" to delete them. Other commands (for example to
rename refs) will continue to not handle these refs but can be changed
in later patches.
Details:
In resolving functions, refuse to resolve refs that don't pass the
git-check-ref-format(1) check unless the new RESOLVE_REF_ALLOW_BAD_NAME
flag is passed. Even with RESOLVE_REF_ALLOW_BAD_NAME, refuse to
resolve refs that escape the refs/ directory and do not match the
pattern [A-Z_]* (think "HEAD" and "MERGE_HEAD").
In locking functions, refuse to act on badly named refs unless they
are being deleted and either are in the refs/ directory or match [A-Z_]*.
Just like other invalid refs, flag resolved, badly named refs with the
REF_ISBROKEN flag, treat them as resolving to null_sha1, and skip them
in all iteration functions except for for_each_rawref.
Flag badly named refs (but not symrefs pointing to badly named refs)
with a REF_BAD_NAME flag to make it easier for future callers to
notice and handle them specially. For example, in a later patch
for-each-ref will use this flag to detect refs whose names can confuse
callers parsing for-each-ref output.
In the transaction API, refuse to create or update badly named refs,
but allow deleting them (unless they try to escape refs/ and don't match
[A-Z_]*).
Signed-off-by: Ronnie Sahlberg <sahlberg@google.com>
Signed-off-by: Jonathan Nieder <jrnieder@gmail.com>
Signed-off-by: Junio C Hamano <gitster@pobox.com>
2014-09-03 20:45:43 +02:00
|
|
|
cp .git/refs/heads/master .git/refs/heads/broken...ref &&
|
|
|
|
|
test_when_finished "rm -f .git/refs/heads/broken...ref" &&
|
2015-09-23 20:11:12 +02:00
|
|
|
git branch >output 2>error &&
|
2016-04-07 21:02:50 +02:00
|
|
|
test_i18ngrep -e "ignoring ref with broken name refs/heads/broken\.\.\.ref" error &&
|
2015-09-23 20:11:12 +02:00
|
|
|
! grep -e "broken\.\.\.ref" output
|
refs.c: allow listing and deleting badly named refs
We currently do not handle badly named refs well:
$ cp .git/refs/heads/master .git/refs/heads/master.....@\*@\\.
$ git branch
fatal: Reference has invalid format: 'refs/heads/master.....@*@\.'
$ git branch -D master.....@\*@\\.
error: branch 'master.....@*@\.' not found.
Users cannot recover from a badly named ref without manually finding
and deleting the loose ref file or appropriate line in packed-refs.
Making that easier will make it easier to tweak the ref naming rules
in the future, for example to forbid shell metacharacters like '`'
and '"', without putting people in a state that is hard to get out of.
So allow "branch --list" to show these refs and allow "branch -d/-D"
and "update-ref -d" to delete them. Other commands (for example to
rename refs) will continue to not handle these refs but can be changed
in later patches.
Details:
In resolving functions, refuse to resolve refs that don't pass the
git-check-ref-format(1) check unless the new RESOLVE_REF_ALLOW_BAD_NAME
flag is passed. Even with RESOLVE_REF_ALLOW_BAD_NAME, refuse to
resolve refs that escape the refs/ directory and do not match the
pattern [A-Z_]* (think "HEAD" and "MERGE_HEAD").
In locking functions, refuse to act on badly named refs unless they
are being deleted and either are in the refs/ directory or match [A-Z_]*.
Just like other invalid refs, flag resolved, badly named refs with the
REF_ISBROKEN flag, treat them as resolving to null_sha1, and skip them
in all iteration functions except for for_each_rawref.
Flag badly named refs (but not symrefs pointing to badly named refs)
with a REF_BAD_NAME flag to make it easier for future callers to
notice and handle them specially. For example, in a later patch
for-each-ref will use this flag to detect refs whose names can confuse
callers parsing for-each-ref output.
In the transaction API, refuse to create or update badly named refs,
but allow deleting them (unless they try to escape refs/ and don't match
[A-Z_]*).
Signed-off-by: Ronnie Sahlberg <sahlberg@google.com>
Signed-off-by: Jonathan Nieder <jrnieder@gmail.com>
Signed-off-by: Junio C Hamano <gitster@pobox.com>
2014-09-03 20:45:43 +02:00
|
|
|
'
|
|
|
|
|
|
|
|
|
|
test_expect_success 'branch -d can delete badly named ref' '
|
|
|
|
|
cp .git/refs/heads/master .git/refs/heads/broken...ref &&
|
|
|
|
|
test_when_finished "rm -f .git/refs/heads/broken...ref" &&
|
|
|
|
|
git branch -d broken...ref &&
|
2015-09-23 20:11:12 +02:00
|
|
|
git branch >output 2>error &&
|
|
|
|
|
! grep -e "broken\.\.\.ref" error &&
|
refs.c: allow listing and deleting badly named refs
We currently do not handle badly named refs well:
$ cp .git/refs/heads/master .git/refs/heads/master.....@\*@\\.
$ git branch
fatal: Reference has invalid format: 'refs/heads/master.....@*@\.'
$ git branch -D master.....@\*@\\.
error: branch 'master.....@*@\.' not found.
Users cannot recover from a badly named ref without manually finding
and deleting the loose ref file or appropriate line in packed-refs.
Making that easier will make it easier to tweak the ref naming rules
in the future, for example to forbid shell metacharacters like '`'
and '"', without putting people in a state that is hard to get out of.
So allow "branch --list" to show these refs and allow "branch -d/-D"
and "update-ref -d" to delete them. Other commands (for example to
rename refs) will continue to not handle these refs but can be changed
in later patches.
Details:
In resolving functions, refuse to resolve refs that don't pass the
git-check-ref-format(1) check unless the new RESOLVE_REF_ALLOW_BAD_NAME
flag is passed. Even with RESOLVE_REF_ALLOW_BAD_NAME, refuse to
resolve refs that escape the refs/ directory and do not match the
pattern [A-Z_]* (think "HEAD" and "MERGE_HEAD").
In locking functions, refuse to act on badly named refs unless they
are being deleted and either are in the refs/ directory or match [A-Z_]*.
Just like other invalid refs, flag resolved, badly named refs with the
REF_ISBROKEN flag, treat them as resolving to null_sha1, and skip them
in all iteration functions except for for_each_rawref.
Flag badly named refs (but not symrefs pointing to badly named refs)
with a REF_BAD_NAME flag to make it easier for future callers to
notice and handle them specially. For example, in a later patch
for-each-ref will use this flag to detect refs whose names can confuse
callers parsing for-each-ref output.
In the transaction API, refuse to create or update badly named refs,
but allow deleting them (unless they try to escape refs/ and don't match
[A-Z_]*).
Signed-off-by: Ronnie Sahlberg <sahlberg@google.com>
Signed-off-by: Jonathan Nieder <jrnieder@gmail.com>
Signed-off-by: Junio C Hamano <gitster@pobox.com>
2014-09-03 20:45:43 +02:00
|
|
|
! grep -e "broken\.\.\.ref" output
|
|
|
|
|
'
|
|
|
|
|
|
|
|
|
|
test_expect_success 'branch -D can delete badly named ref' '
|
|
|
|
|
cp .git/refs/heads/master .git/refs/heads/broken...ref &&
|
|
|
|
|
test_when_finished "rm -f .git/refs/heads/broken...ref" &&
|
|
|
|
|
git branch -D broken...ref &&
|
2015-09-23 20:11:12 +02:00
|
|
|
git branch >output 2>error &&
|
|
|
|
|
! grep -e "broken\.\.\.ref" error &&
|
refs.c: allow listing and deleting badly named refs
We currently do not handle badly named refs well:
$ cp .git/refs/heads/master .git/refs/heads/master.....@\*@\\.
$ git branch
fatal: Reference has invalid format: 'refs/heads/master.....@*@\.'
$ git branch -D master.....@\*@\\.
error: branch 'master.....@*@\.' not found.
Users cannot recover from a badly named ref without manually finding
and deleting the loose ref file or appropriate line in packed-refs.
Making that easier will make it easier to tweak the ref naming rules
in the future, for example to forbid shell metacharacters like '`'
and '"', without putting people in a state that is hard to get out of.
So allow "branch --list" to show these refs and allow "branch -d/-D"
and "update-ref -d" to delete them. Other commands (for example to
rename refs) will continue to not handle these refs but can be changed
in later patches.
Details:
In resolving functions, refuse to resolve refs that don't pass the
git-check-ref-format(1) check unless the new RESOLVE_REF_ALLOW_BAD_NAME
flag is passed. Even with RESOLVE_REF_ALLOW_BAD_NAME, refuse to
resolve refs that escape the refs/ directory and do not match the
pattern [A-Z_]* (think "HEAD" and "MERGE_HEAD").
In locking functions, refuse to act on badly named refs unless they
are being deleted and either are in the refs/ directory or match [A-Z_]*.
Just like other invalid refs, flag resolved, badly named refs with the
REF_ISBROKEN flag, treat them as resolving to null_sha1, and skip them
in all iteration functions except for for_each_rawref.
Flag badly named refs (but not symrefs pointing to badly named refs)
with a REF_BAD_NAME flag to make it easier for future callers to
notice and handle them specially. For example, in a later patch
for-each-ref will use this flag to detect refs whose names can confuse
callers parsing for-each-ref output.
In the transaction API, refuse to create or update badly named refs,
but allow deleting them (unless they try to escape refs/ and don't match
[A-Z_]*).
Signed-off-by: Ronnie Sahlberg <sahlberg@google.com>
Signed-off-by: Jonathan Nieder <jrnieder@gmail.com>
Signed-off-by: Junio C Hamano <gitster@pobox.com>
2014-09-03 20:45:43 +02:00
|
|
|
! grep -e "broken\.\.\.ref" output
|
|
|
|
|
'
|
|
|
|
|
|
|
|
|
|
test_expect_success 'branch -D cannot delete non-ref in .git dir' '
|
|
|
|
|
echo precious >.git/my-private-file &&
|
|
|
|
|
echo precious >expect &&
|
|
|
|
|
test_must_fail git branch -D ../../my-private-file &&
|
|
|
|
|
test_cmp expect .git/my-private-file
|
|
|
|
|
'
|
|
|
|
|
|
2015-04-16 11:04:44 +02:00
|
|
|
test_expect_success 'branch -D cannot delete ref in .git dir' '
|
|
|
|
|
git rev-parse HEAD >.git/my-private-file &&
|
|
|
|
|
git rev-parse HEAD >expect &&
|
|
|
|
|
git branch foo/legit &&
|
|
|
|
|
test_must_fail git branch -D foo////./././../../../my-private-file &&
|
|
|
|
|
test_cmp expect .git/my-private-file
|
|
|
|
|
'
|
|
|
|
|
|
refs.c: allow listing and deleting badly named refs
We currently do not handle badly named refs well:
$ cp .git/refs/heads/master .git/refs/heads/master.....@\*@\\.
$ git branch
fatal: Reference has invalid format: 'refs/heads/master.....@*@\.'
$ git branch -D master.....@\*@\\.
error: branch 'master.....@*@\.' not found.
Users cannot recover from a badly named ref without manually finding
and deleting the loose ref file or appropriate line in packed-refs.
Making that easier will make it easier to tweak the ref naming rules
in the future, for example to forbid shell metacharacters like '`'
and '"', without putting people in a state that is hard to get out of.
So allow "branch --list" to show these refs and allow "branch -d/-D"
and "update-ref -d" to delete them. Other commands (for example to
rename refs) will continue to not handle these refs but can be changed
in later patches.
Details:
In resolving functions, refuse to resolve refs that don't pass the
git-check-ref-format(1) check unless the new RESOLVE_REF_ALLOW_BAD_NAME
flag is passed. Even with RESOLVE_REF_ALLOW_BAD_NAME, refuse to
resolve refs that escape the refs/ directory and do not match the
pattern [A-Z_]* (think "HEAD" and "MERGE_HEAD").
In locking functions, refuse to act on badly named refs unless they
are being deleted and either are in the refs/ directory or match [A-Z_]*.
Just like other invalid refs, flag resolved, badly named refs with the
REF_ISBROKEN flag, treat them as resolving to null_sha1, and skip them
in all iteration functions except for for_each_rawref.
Flag badly named refs (but not symrefs pointing to badly named refs)
with a REF_BAD_NAME flag to make it easier for future callers to
notice and handle them specially. For example, in a later patch
for-each-ref will use this flag to detect refs whose names can confuse
callers parsing for-each-ref output.
In the transaction API, refuse to create or update badly named refs,
but allow deleting them (unless they try to escape refs/ and don't match
[A-Z_]*).
Signed-off-by: Ronnie Sahlberg <sahlberg@google.com>
Signed-off-by: Jonathan Nieder <jrnieder@gmail.com>
Signed-off-by: Junio C Hamano <gitster@pobox.com>
2014-09-03 20:45:43 +02:00
|
|
|
test_expect_success 'branch -D cannot delete absolute path' '
|
|
|
|
|
git branch -f extra &&
|
|
|
|
|
test_must_fail git branch -D "$(pwd)/.git/refs/heads/extra" &&
|
|
|
|
|
test_cmp_rev HEAD extra
|
|
|
|
|
'
|
|
|
|
|
|
|
|
|
|
test_expect_success 'git branch cannot create a badly named ref' '
|
|
|
|
|
test_when_finished "rm -f .git/refs/heads/broken...ref" &&
|
|
|
|
|
test_must_fail git branch broken...ref &&
|
2015-09-23 20:11:12 +02:00
|
|
|
git branch >output 2>error &&
|
|
|
|
|
! grep -e "broken\.\.\.ref" error &&
|
refs.c: allow listing and deleting badly named refs
We currently do not handle badly named refs well:
$ cp .git/refs/heads/master .git/refs/heads/master.....@\*@\\.
$ git branch
fatal: Reference has invalid format: 'refs/heads/master.....@*@\.'
$ git branch -D master.....@\*@\\.
error: branch 'master.....@*@\.' not found.
Users cannot recover from a badly named ref without manually finding
and deleting the loose ref file or appropriate line in packed-refs.
Making that easier will make it easier to tweak the ref naming rules
in the future, for example to forbid shell metacharacters like '`'
and '"', without putting people in a state that is hard to get out of.
So allow "branch --list" to show these refs and allow "branch -d/-D"
and "update-ref -d" to delete them. Other commands (for example to
rename refs) will continue to not handle these refs but can be changed
in later patches.
Details:
In resolving functions, refuse to resolve refs that don't pass the
git-check-ref-format(1) check unless the new RESOLVE_REF_ALLOW_BAD_NAME
flag is passed. Even with RESOLVE_REF_ALLOW_BAD_NAME, refuse to
resolve refs that escape the refs/ directory and do not match the
pattern [A-Z_]* (think "HEAD" and "MERGE_HEAD").
In locking functions, refuse to act on badly named refs unless they
are being deleted and either are in the refs/ directory or match [A-Z_]*.
Just like other invalid refs, flag resolved, badly named refs with the
REF_ISBROKEN flag, treat them as resolving to null_sha1, and skip them
in all iteration functions except for for_each_rawref.
Flag badly named refs (but not symrefs pointing to badly named refs)
with a REF_BAD_NAME flag to make it easier for future callers to
notice and handle them specially. For example, in a later patch
for-each-ref will use this flag to detect refs whose names can confuse
callers parsing for-each-ref output.
In the transaction API, refuse to create or update badly named refs,
but allow deleting them (unless they try to escape refs/ and don't match
[A-Z_]*).
Signed-off-by: Ronnie Sahlberg <sahlberg@google.com>
Signed-off-by: Jonathan Nieder <jrnieder@gmail.com>
Signed-off-by: Junio C Hamano <gitster@pobox.com>
2014-09-03 20:45:43 +02:00
|
|
|
! grep -e "broken\.\.\.ref" output
|
|
|
|
|
'
|
|
|
|
|
|
|
|
|
|
test_expect_success 'branch -m cannot rename to a bad ref name' '
|
|
|
|
|
test_when_finished "rm -f .git/refs/heads/broken...ref" &&
|
|
|
|
|
test_might_fail git branch -D goodref &&
|
|
|
|
|
git branch goodref &&
|
|
|
|
|
test_must_fail git branch -m goodref broken...ref &&
|
|
|
|
|
test_cmp_rev master goodref &&
|
2015-09-23 20:11:12 +02:00
|
|
|
git branch >output 2>error &&
|
|
|
|
|
! grep -e "broken\.\.\.ref" error &&
|
refs.c: allow listing and deleting badly named refs
We currently do not handle badly named refs well:
$ cp .git/refs/heads/master .git/refs/heads/master.....@\*@\\.
$ git branch
fatal: Reference has invalid format: 'refs/heads/master.....@*@\.'
$ git branch -D master.....@\*@\\.
error: branch 'master.....@*@\.' not found.
Users cannot recover from a badly named ref without manually finding
and deleting the loose ref file or appropriate line in packed-refs.
Making that easier will make it easier to tweak the ref naming rules
in the future, for example to forbid shell metacharacters like '`'
and '"', without putting people in a state that is hard to get out of.
So allow "branch --list" to show these refs and allow "branch -d/-D"
and "update-ref -d" to delete them. Other commands (for example to
rename refs) will continue to not handle these refs but can be changed
in later patches.
Details:
In resolving functions, refuse to resolve refs that don't pass the
git-check-ref-format(1) check unless the new RESOLVE_REF_ALLOW_BAD_NAME
flag is passed. Even with RESOLVE_REF_ALLOW_BAD_NAME, refuse to
resolve refs that escape the refs/ directory and do not match the
pattern [A-Z_]* (think "HEAD" and "MERGE_HEAD").
In locking functions, refuse to act on badly named refs unless they
are being deleted and either are in the refs/ directory or match [A-Z_]*.
Just like other invalid refs, flag resolved, badly named refs with the
REF_ISBROKEN flag, treat them as resolving to null_sha1, and skip them
in all iteration functions except for for_each_rawref.
Flag badly named refs (but not symrefs pointing to badly named refs)
with a REF_BAD_NAME flag to make it easier for future callers to
notice and handle them specially. For example, in a later patch
for-each-ref will use this flag to detect refs whose names can confuse
callers parsing for-each-ref output.
In the transaction API, refuse to create or update badly named refs,
but allow deleting them (unless they try to escape refs/ and don't match
[A-Z_]*).
Signed-off-by: Ronnie Sahlberg <sahlberg@google.com>
Signed-off-by: Jonathan Nieder <jrnieder@gmail.com>
Signed-off-by: Junio C Hamano <gitster@pobox.com>
2014-09-03 20:45:43 +02:00
|
|
|
! grep -e "broken\.\.\.ref" output
|
|
|
|
|
'
|
|
|
|
|
|
|
|
|
|
test_expect_failure 'branch -m can rename from a bad ref name' '
|
|
|
|
|
cp .git/refs/heads/master .git/refs/heads/broken...ref &&
|
|
|
|
|
test_when_finished "rm -f .git/refs/heads/broken...ref" &&
|
|
|
|
|
git branch -m broken...ref renamed &&
|
|
|
|
|
test_cmp_rev master renamed &&
|
2015-09-23 20:11:12 +02:00
|
|
|
git branch >output 2>error &&
|
|
|
|
|
! grep -e "broken\.\.\.ref" error &&
|
refs.c: allow listing and deleting badly named refs
We currently do not handle badly named refs well:
$ cp .git/refs/heads/master .git/refs/heads/master.....@\*@\\.
$ git branch
fatal: Reference has invalid format: 'refs/heads/master.....@*@\.'
$ git branch -D master.....@\*@\\.
error: branch 'master.....@*@\.' not found.
Users cannot recover from a badly named ref without manually finding
and deleting the loose ref file or appropriate line in packed-refs.
Making that easier will make it easier to tweak the ref naming rules
in the future, for example to forbid shell metacharacters like '`'
and '"', without putting people in a state that is hard to get out of.
So allow "branch --list" to show these refs and allow "branch -d/-D"
and "update-ref -d" to delete them. Other commands (for example to
rename refs) will continue to not handle these refs but can be changed
in later patches.
Details:
In resolving functions, refuse to resolve refs that don't pass the
git-check-ref-format(1) check unless the new RESOLVE_REF_ALLOW_BAD_NAME
flag is passed. Even with RESOLVE_REF_ALLOW_BAD_NAME, refuse to
resolve refs that escape the refs/ directory and do not match the
pattern [A-Z_]* (think "HEAD" and "MERGE_HEAD").
In locking functions, refuse to act on badly named refs unless they
are being deleted and either are in the refs/ directory or match [A-Z_]*.
Just like other invalid refs, flag resolved, badly named refs with the
REF_ISBROKEN flag, treat them as resolving to null_sha1, and skip them
in all iteration functions except for for_each_rawref.
Flag badly named refs (but not symrefs pointing to badly named refs)
with a REF_BAD_NAME flag to make it easier for future callers to
notice and handle them specially. For example, in a later patch
for-each-ref will use this flag to detect refs whose names can confuse
callers parsing for-each-ref output.
In the transaction API, refuse to create or update badly named refs,
but allow deleting them (unless they try to escape refs/ and don't match
[A-Z_]*).
Signed-off-by: Ronnie Sahlberg <sahlberg@google.com>
Signed-off-by: Jonathan Nieder <jrnieder@gmail.com>
Signed-off-by: Junio C Hamano <gitster@pobox.com>
2014-09-03 20:45:43 +02:00
|
|
|
! grep -e "broken\.\.\.ref" output
|
|
|
|
|
'
|
|
|
|
|
|
|
|
|
|
test_expect_success 'push cannot create a badly named ref' '
|
|
|
|
|
test_when_finished "rm -f .git/refs/heads/broken...ref" &&
|
|
|
|
|
test_must_fail git push "file://$(pwd)" HEAD:refs/heads/broken...ref &&
|
2015-09-23 20:11:12 +02:00
|
|
|
git branch >output 2>error &&
|
|
|
|
|
! grep -e "broken\.\.\.ref" error &&
|
refs.c: allow listing and deleting badly named refs
We currently do not handle badly named refs well:
$ cp .git/refs/heads/master .git/refs/heads/master.....@\*@\\.
$ git branch
fatal: Reference has invalid format: 'refs/heads/master.....@*@\.'
$ git branch -D master.....@\*@\\.
error: branch 'master.....@*@\.' not found.
Users cannot recover from a badly named ref without manually finding
and deleting the loose ref file or appropriate line in packed-refs.
Making that easier will make it easier to tweak the ref naming rules
in the future, for example to forbid shell metacharacters like '`'
and '"', without putting people in a state that is hard to get out of.
So allow "branch --list" to show these refs and allow "branch -d/-D"
and "update-ref -d" to delete them. Other commands (for example to
rename refs) will continue to not handle these refs but can be changed
in later patches.
Details:
In resolving functions, refuse to resolve refs that don't pass the
git-check-ref-format(1) check unless the new RESOLVE_REF_ALLOW_BAD_NAME
flag is passed. Even with RESOLVE_REF_ALLOW_BAD_NAME, refuse to
resolve refs that escape the refs/ directory and do not match the
pattern [A-Z_]* (think "HEAD" and "MERGE_HEAD").
In locking functions, refuse to act on badly named refs unless they
are being deleted and either are in the refs/ directory or match [A-Z_]*.
Just like other invalid refs, flag resolved, badly named refs with the
REF_ISBROKEN flag, treat them as resolving to null_sha1, and skip them
in all iteration functions except for for_each_rawref.
Flag badly named refs (but not symrefs pointing to badly named refs)
with a REF_BAD_NAME flag to make it easier for future callers to
notice and handle them specially. For example, in a later patch
for-each-ref will use this flag to detect refs whose names can confuse
callers parsing for-each-ref output.
In the transaction API, refuse to create or update badly named refs,
but allow deleting them (unless they try to escape refs/ and don't match
[A-Z_]*).
Signed-off-by: Ronnie Sahlberg <sahlberg@google.com>
Signed-off-by: Jonathan Nieder <jrnieder@gmail.com>
Signed-off-by: Junio C Hamano <gitster@pobox.com>
2014-09-03 20:45:43 +02:00
|
|
|
! grep -e "broken\.\.\.ref" output
|
|
|
|
|
'
|
|
|
|
|
|
|
|
|
|
test_expect_failure 'push --mirror can delete badly named ref' '
|
|
|
|
|
top=$(pwd) &&
|
|
|
|
|
git init src &&
|
|
|
|
|
git init dest &&
|
|
|
|
|
|
|
|
|
|
(
|
|
|
|
|
cd src &&
|
|
|
|
|
test_commit one
|
|
|
|
|
) &&
|
|
|
|
|
(
|
|
|
|
|
cd dest &&
|
|
|
|
|
test_commit two &&
|
|
|
|
|
git checkout --detach &&
|
|
|
|
|
cp .git/refs/heads/master .git/refs/heads/broken...ref
|
|
|
|
|
) &&
|
|
|
|
|
git -C src push --mirror "file://$top/dest" &&
|
2015-09-23 20:11:12 +02:00
|
|
|
git -C dest branch >output 2>error &&
|
|
|
|
|
! grep -e "broken\.\.\.ref" error &&
|
refs.c: allow listing and deleting badly named refs
We currently do not handle badly named refs well:
$ cp .git/refs/heads/master .git/refs/heads/master.....@\*@\\.
$ git branch
fatal: Reference has invalid format: 'refs/heads/master.....@*@\.'
$ git branch -D master.....@\*@\\.
error: branch 'master.....@*@\.' not found.
Users cannot recover from a badly named ref without manually finding
and deleting the loose ref file or appropriate line in packed-refs.
Making that easier will make it easier to tweak the ref naming rules
in the future, for example to forbid shell metacharacters like '`'
and '"', without putting people in a state that is hard to get out of.
So allow "branch --list" to show these refs and allow "branch -d/-D"
and "update-ref -d" to delete them. Other commands (for example to
rename refs) will continue to not handle these refs but can be changed
in later patches.
Details:
In resolving functions, refuse to resolve refs that don't pass the
git-check-ref-format(1) check unless the new RESOLVE_REF_ALLOW_BAD_NAME
flag is passed. Even with RESOLVE_REF_ALLOW_BAD_NAME, refuse to
resolve refs that escape the refs/ directory and do not match the
pattern [A-Z_]* (think "HEAD" and "MERGE_HEAD").
In locking functions, refuse to act on badly named refs unless they
are being deleted and either are in the refs/ directory or match [A-Z_]*.
Just like other invalid refs, flag resolved, badly named refs with the
REF_ISBROKEN flag, treat them as resolving to null_sha1, and skip them
in all iteration functions except for for_each_rawref.
Flag badly named refs (but not symrefs pointing to badly named refs)
with a REF_BAD_NAME flag to make it easier for future callers to
notice and handle them specially. For example, in a later patch
for-each-ref will use this flag to detect refs whose names can confuse
callers parsing for-each-ref output.
In the transaction API, refuse to create or update badly named refs,
but allow deleting them (unless they try to escape refs/ and don't match
[A-Z_]*).
Signed-off-by: Ronnie Sahlberg <sahlberg@google.com>
Signed-off-by: Jonathan Nieder <jrnieder@gmail.com>
Signed-off-by: Junio C Hamano <gitster@pobox.com>
2014-09-03 20:45:43 +02:00
|
|
|
! grep -e "broken\.\.\.ref" output
|
|
|
|
|
'
|
|
|
|
|
|
|
|
|
|
test_expect_success 'rev-parse skips symref pointing to broken name' '
|
|
|
|
|
test_when_finished "rm -f .git/refs/heads/broken...ref" &&
|
|
|
|
|
git branch shadow one &&
|
|
|
|
|
cp .git/refs/heads/master .git/refs/heads/broken...ref &&
|
2016-04-07 21:02:52 +02:00
|
|
|
printf "ref: refs/heads/broken...ref\n" >.git/refs/tags/shadow &&
|
2016-04-07 21:02:51 +02:00
|
|
|
test_when_finished "rm -f .git/refs/tags/shadow" &&
|
refs.c: allow listing and deleting badly named refs
We currently do not handle badly named refs well:
$ cp .git/refs/heads/master .git/refs/heads/master.....@\*@\\.
$ git branch
fatal: Reference has invalid format: 'refs/heads/master.....@*@\.'
$ git branch -D master.....@\*@\\.
error: branch 'master.....@*@\.' not found.
Users cannot recover from a badly named ref without manually finding
and deleting the loose ref file or appropriate line in packed-refs.
Making that easier will make it easier to tweak the ref naming rules
in the future, for example to forbid shell metacharacters like '`'
and '"', without putting people in a state that is hard to get out of.
So allow "branch --list" to show these refs and allow "branch -d/-D"
and "update-ref -d" to delete them. Other commands (for example to
rename refs) will continue to not handle these refs but can be changed
in later patches.
Details:
In resolving functions, refuse to resolve refs that don't pass the
git-check-ref-format(1) check unless the new RESOLVE_REF_ALLOW_BAD_NAME
flag is passed. Even with RESOLVE_REF_ALLOW_BAD_NAME, refuse to
resolve refs that escape the refs/ directory and do not match the
pattern [A-Z_]* (think "HEAD" and "MERGE_HEAD").
In locking functions, refuse to act on badly named refs unless they
are being deleted and either are in the refs/ directory or match [A-Z_]*.
Just like other invalid refs, flag resolved, badly named refs with the
REF_ISBROKEN flag, treat them as resolving to null_sha1, and skip them
in all iteration functions except for for_each_rawref.
Flag badly named refs (but not symrefs pointing to badly named refs)
with a REF_BAD_NAME flag to make it easier for future callers to
notice and handle them specially. For example, in a later patch
for-each-ref will use this flag to detect refs whose names can confuse
callers parsing for-each-ref output.
In the transaction API, refuse to create or update badly named refs,
but allow deleting them (unless they try to escape refs/ and don't match
[A-Z_]*).
Signed-off-by: Ronnie Sahlberg <sahlberg@google.com>
Signed-off-by: Jonathan Nieder <jrnieder@gmail.com>
Signed-off-by: Junio C Hamano <gitster@pobox.com>
2014-09-03 20:45:43 +02:00
|
|
|
git rev-parse --verify one >expect &&
|
|
|
|
|
git rev-parse --verify shadow >actual 2>err &&
|
|
|
|
|
test_cmp expect actual &&
|
2016-04-07 21:02:50 +02:00
|
|
|
test_i18ngrep "ignoring dangling symref refs/tags/shadow" err
|
refs.c: allow listing and deleting badly named refs
We currently do not handle badly named refs well:
$ cp .git/refs/heads/master .git/refs/heads/master.....@\*@\\.
$ git branch
fatal: Reference has invalid format: 'refs/heads/master.....@*@\.'
$ git branch -D master.....@\*@\\.
error: branch 'master.....@*@\.' not found.
Users cannot recover from a badly named ref without manually finding
and deleting the loose ref file or appropriate line in packed-refs.
Making that easier will make it easier to tweak the ref naming rules
in the future, for example to forbid shell metacharacters like '`'
and '"', without putting people in a state that is hard to get out of.
So allow "branch --list" to show these refs and allow "branch -d/-D"
and "update-ref -d" to delete them. Other commands (for example to
rename refs) will continue to not handle these refs but can be changed
in later patches.
Details:
In resolving functions, refuse to resolve refs that don't pass the
git-check-ref-format(1) check unless the new RESOLVE_REF_ALLOW_BAD_NAME
flag is passed. Even with RESOLVE_REF_ALLOW_BAD_NAME, refuse to
resolve refs that escape the refs/ directory and do not match the
pattern [A-Z_]* (think "HEAD" and "MERGE_HEAD").
In locking functions, refuse to act on badly named refs unless they
are being deleted and either are in the refs/ directory or match [A-Z_]*.
Just like other invalid refs, flag resolved, badly named refs with the
REF_ISBROKEN flag, treat them as resolving to null_sha1, and skip them
in all iteration functions except for for_each_rawref.
Flag badly named refs (but not symrefs pointing to badly named refs)
with a REF_BAD_NAME flag to make it easier for future callers to
notice and handle them specially. For example, in a later patch
for-each-ref will use this flag to detect refs whose names can confuse
callers parsing for-each-ref output.
In the transaction API, refuse to create or update badly named refs,
but allow deleting them (unless they try to escape refs/ and don't match
[A-Z_]*).
Signed-off-by: Ronnie Sahlberg <sahlberg@google.com>
Signed-off-by: Jonathan Nieder <jrnieder@gmail.com>
Signed-off-by: Junio C Hamano <gitster@pobox.com>
2014-09-03 20:45:43 +02:00
|
|
|
'
|
|
|
|
|
|
2016-04-07 21:02:53 +02:00
|
|
|
test_expect_success 'for-each-ref emits warnings for broken names' '
|
|
|
|
|
cp .git/refs/heads/master .git/refs/heads/broken...ref &&
|
|
|
|
|
test_when_finished "rm -f .git/refs/heads/broken...ref" &&
|
|
|
|
|
printf "ref: refs/heads/broken...ref\n" >.git/refs/heads/badname &&
|
|
|
|
|
test_when_finished "rm -f .git/refs/heads/badname" &&
|
|
|
|
|
printf "ref: refs/heads/master\n" >.git/refs/heads/broken...symref &&
|
|
|
|
|
test_when_finished "rm -f .git/refs/heads/broken...symref" &&
|
|
|
|
|
git for-each-ref >output 2>error &&
|
|
|
|
|
! grep -e "broken\.\.\.ref" output &&
|
|
|
|
|
! grep -e "badname" output &&
|
|
|
|
|
! grep -e "broken\.\.\.symref" output &&
|
|
|
|
|
test_i18ngrep "ignoring ref with broken name refs/heads/broken\.\.\.ref" error &&
|
|
|
|
|
test_i18ngrep "ignoring broken ref refs/heads/badname" error &&
|
|
|
|
|
test_i18ngrep "ignoring ref with broken name refs/heads/broken\.\.\.symref" error
|
|
|
|
|
'
|
|
|
|
|
|
2016-04-07 21:02:54 +02:00
|
|
|
test_expect_success 'update-ref -d can delete broken name' '
|
|
|
|
|
cp .git/refs/heads/master .git/refs/heads/broken...ref &&
|
|
|
|
|
test_when_finished "rm -f .git/refs/heads/broken...ref" &&
|
|
|
|
|
git update-ref -d refs/heads/broken...ref >output 2>error &&
|
|
|
|
|
test_must_be_empty output &&
|
|
|
|
|
test_must_be_empty error &&
|
|
|
|
|
git branch >output 2>error &&
|
|
|
|
|
! grep -e "broken\.\.\.ref" error &&
|
|
|
|
|
! grep -e "broken\.\.\.ref" output
|
|
|
|
|
'
|
|
|
|
|
|
|
|
|
|
test_expect_success 'branch -d can delete broken name' '
|
|
|
|
|
cp .git/refs/heads/master .git/refs/heads/broken...ref &&
|
|
|
|
|
test_when_finished "rm -f .git/refs/heads/broken...ref" &&
|
|
|
|
|
git branch -d broken...ref >output 2>error &&
|
|
|
|
|
test_i18ngrep "Deleted branch broken...ref (was broken)" output &&
|
|
|
|
|
test_must_be_empty error &&
|
|
|
|
|
git branch >output 2>error &&
|
|
|
|
|
! grep -e "broken\.\.\.ref" error &&
|
|
|
|
|
! grep -e "broken\.\.\.ref" output
|
|
|
|
|
'
|
|
|
|
|
|
|
|
|
|
test_expect_success 'update-ref --no-deref -d can delete symref to broken name' '
|
|
|
|
|
cp .git/refs/heads/master .git/refs/heads/broken...ref &&
|
|
|
|
|
test_when_finished "rm -f .git/refs/heads/broken...ref" &&
|
2016-04-07 21:02:52 +02:00
|
|
|
printf "ref: refs/heads/broken...ref\n" >.git/refs/heads/badname &&
|
2014-09-26 00:02:39 +02:00
|
|
|
test_when_finished "rm -f .git/refs/heads/badname" &&
|
2016-04-07 21:02:50 +02:00
|
|
|
git update-ref --no-deref -d refs/heads/badname >output 2>error &&
|
|
|
|
|
test_path_is_missing .git/refs/heads/badname &&
|
|
|
|
|
test_must_be_empty output &&
|
|
|
|
|
test_must_be_empty error
|
2014-09-26 00:02:39 +02:00
|
|
|
'
|
|
|
|
|
|
2016-04-07 21:02:54 +02:00
|
|
|
test_expect_success 'branch -d can delete symref to broken name' '
|
refs.c: allow listing and deleting badly named refs
We currently do not handle badly named refs well:
$ cp .git/refs/heads/master .git/refs/heads/master.....@\*@\\.
$ git branch
fatal: Reference has invalid format: 'refs/heads/master.....@*@\.'
$ git branch -D master.....@\*@\\.
error: branch 'master.....@*@\.' not found.
Users cannot recover from a badly named ref without manually finding
and deleting the loose ref file or appropriate line in packed-refs.
Making that easier will make it easier to tweak the ref naming rules
in the future, for example to forbid shell metacharacters like '`'
and '"', without putting people in a state that is hard to get out of.
So allow "branch --list" to show these refs and allow "branch -d/-D"
and "update-ref -d" to delete them. Other commands (for example to
rename refs) will continue to not handle these refs but can be changed
in later patches.
Details:
In resolving functions, refuse to resolve refs that don't pass the
git-check-ref-format(1) check unless the new RESOLVE_REF_ALLOW_BAD_NAME
flag is passed. Even with RESOLVE_REF_ALLOW_BAD_NAME, refuse to
resolve refs that escape the refs/ directory and do not match the
pattern [A-Z_]* (think "HEAD" and "MERGE_HEAD").
In locking functions, refuse to act on badly named refs unless they
are being deleted and either are in the refs/ directory or match [A-Z_]*.
Just like other invalid refs, flag resolved, badly named refs with the
REF_ISBROKEN flag, treat them as resolving to null_sha1, and skip them
in all iteration functions except for for_each_rawref.
Flag badly named refs (but not symrefs pointing to badly named refs)
with a REF_BAD_NAME flag to make it easier for future callers to
notice and handle them specially. For example, in a later patch
for-each-ref will use this flag to detect refs whose names can confuse
callers parsing for-each-ref output.
In the transaction API, refuse to create or update badly named refs,
but allow deleting them (unless they try to escape refs/ and don't match
[A-Z_]*).
Signed-off-by: Ronnie Sahlberg <sahlberg@google.com>
Signed-off-by: Jonathan Nieder <jrnieder@gmail.com>
Signed-off-by: Junio C Hamano <gitster@pobox.com>
2014-09-03 20:45:43 +02:00
|
|
|
cp .git/refs/heads/master .git/refs/heads/broken...ref &&
|
|
|
|
|
test_when_finished "rm -f .git/refs/heads/broken...ref" &&
|
2016-04-07 21:02:54 +02:00
|
|
|
printf "ref: refs/heads/broken...ref\n" >.git/refs/heads/badname &&
|
|
|
|
|
test_when_finished "rm -f .git/refs/heads/badname" &&
|
|
|
|
|
git branch -d badname >output 2>error &&
|
|
|
|
|
test_path_is_missing .git/refs/heads/badname &&
|
|
|
|
|
test_i18ngrep "Deleted branch badname (was refs/heads/broken\.\.\.ref)" output &&
|
|
|
|
|
test_must_be_empty error
|
|
|
|
|
'
|
|
|
|
|
|
|
|
|
|
test_expect_success 'update-ref --no-deref -d can delete dangling symref to broken name' '
|
|
|
|
|
printf "ref: refs/heads/broken...ref\n" >.git/refs/heads/badname &&
|
|
|
|
|
test_when_finished "rm -f .git/refs/heads/badname" &&
|
|
|
|
|
git update-ref --no-deref -d refs/heads/badname >output 2>error &&
|
|
|
|
|
test_path_is_missing .git/refs/heads/badname &&
|
2016-04-07 21:02:50 +02:00
|
|
|
test_must_be_empty output &&
|
2016-04-07 21:02:54 +02:00
|
|
|
test_must_be_empty error
|
|
|
|
|
'
|
|
|
|
|
|
|
|
|
|
test_expect_success 'branch -d can delete dangling symref to broken name' '
|
|
|
|
|
printf "ref: refs/heads/broken...ref\n" >.git/refs/heads/badname &&
|
|
|
|
|
test_when_finished "rm -f .git/refs/heads/badname" &&
|
|
|
|
|
git branch -d badname >output 2>error &&
|
|
|
|
|
test_path_is_missing .git/refs/heads/badname &&
|
|
|
|
|
test_i18ngrep "Deleted branch badname (was refs/heads/broken\.\.\.ref)" output &&
|
|
|
|
|
test_must_be_empty error
|
|
|
|
|
'
|
|
|
|
|
|
|
|
|
|
test_expect_success 'update-ref -d can delete broken name through symref' '
|
|
|
|
|
cp .git/refs/heads/master .git/refs/heads/broken...ref &&
|
|
|
|
|
test_when_finished "rm -f .git/refs/heads/broken...ref" &&
|
|
|
|
|
printf "ref: refs/heads/broken...ref\n" >.git/refs/heads/badname &&
|
|
|
|
|
test_when_finished "rm -f .git/refs/heads/badname" &&
|
|
|
|
|
git update-ref -d refs/heads/badname >output 2>error &&
|
|
|
|
|
test_path_is_missing .git/refs/heads/broken...ref &&
|
|
|
|
|
test_must_be_empty output &&
|
|
|
|
|
test_must_be_empty error
|
|
|
|
|
'
|
|
|
|
|
|
|
|
|
|
test_expect_success 'update-ref --no-deref -d can delete symref with broken name' '
|
|
|
|
|
printf "ref: refs/heads/master\n" >.git/refs/heads/broken...symref &&
|
|
|
|
|
test_when_finished "rm -f .git/refs/heads/broken...symref" &&
|
|
|
|
|
git update-ref --no-deref -d refs/heads/broken...symref >output 2>error &&
|
|
|
|
|
test_path_is_missing .git/refs/heads/broken...symref &&
|
|
|
|
|
test_must_be_empty output &&
|
|
|
|
|
test_must_be_empty error
|
|
|
|
|
'
|
|
|
|
|
|
|
|
|
|
test_expect_success 'branch -d can delete symref with broken name' '
|
|
|
|
|
printf "ref: refs/heads/master\n" >.git/refs/heads/broken...symref &&
|
|
|
|
|
test_when_finished "rm -f .git/refs/heads/broken...symref" &&
|
|
|
|
|
git branch -d broken...symref >output 2>error &&
|
|
|
|
|
test_path_is_missing .git/refs/heads/broken...symref &&
|
|
|
|
|
test_i18ngrep "Deleted branch broken...symref (was refs/heads/master)" output &&
|
|
|
|
|
test_must_be_empty error
|
|
|
|
|
'
|
|
|
|
|
|
|
|
|
|
test_expect_success 'update-ref --no-deref -d can delete dangling symref with broken name' '
|
|
|
|
|
printf "ref: refs/heads/idonotexist\n" >.git/refs/heads/broken...symref &&
|
|
|
|
|
test_when_finished "rm -f .git/refs/heads/broken...symref" &&
|
|
|
|
|
git update-ref --no-deref -d refs/heads/broken...symref >output 2>error &&
|
|
|
|
|
test_path_is_missing .git/refs/heads/broken...symref &&
|
|
|
|
|
test_must_be_empty output &&
|
|
|
|
|
test_must_be_empty error
|
|
|
|
|
'
|
|
|
|
|
|
|
|
|
|
test_expect_success 'branch -d can delete dangling symref with broken name' '
|
|
|
|
|
printf "ref: refs/heads/idonotexist\n" >.git/refs/heads/broken...symref &&
|
|
|
|
|
test_when_finished "rm -f .git/refs/heads/broken...symref" &&
|
|
|
|
|
git branch -d broken...symref >output 2>error &&
|
|
|
|
|
test_path_is_missing .git/refs/heads/broken...symref &&
|
|
|
|
|
test_i18ngrep "Deleted branch broken...symref (was refs/heads/idonotexist)" output &&
|
|
|
|
|
test_must_be_empty error
|
refs.c: allow listing and deleting badly named refs
We currently do not handle badly named refs well:
$ cp .git/refs/heads/master .git/refs/heads/master.....@\*@\\.
$ git branch
fatal: Reference has invalid format: 'refs/heads/master.....@*@\.'
$ git branch -D master.....@\*@\\.
error: branch 'master.....@*@\.' not found.
Users cannot recover from a badly named ref without manually finding
and deleting the loose ref file or appropriate line in packed-refs.
Making that easier will make it easier to tweak the ref naming rules
in the future, for example to forbid shell metacharacters like '`'
and '"', without putting people in a state that is hard to get out of.
So allow "branch --list" to show these refs and allow "branch -d/-D"
and "update-ref -d" to delete them. Other commands (for example to
rename refs) will continue to not handle these refs but can be changed
in later patches.
Details:
In resolving functions, refuse to resolve refs that don't pass the
git-check-ref-format(1) check unless the new RESOLVE_REF_ALLOW_BAD_NAME
flag is passed. Even with RESOLVE_REF_ALLOW_BAD_NAME, refuse to
resolve refs that escape the refs/ directory and do not match the
pattern [A-Z_]* (think "HEAD" and "MERGE_HEAD").
In locking functions, refuse to act on badly named refs unless they
are being deleted and either are in the refs/ directory or match [A-Z_]*.
Just like other invalid refs, flag resolved, badly named refs with the
REF_ISBROKEN flag, treat them as resolving to null_sha1, and skip them
in all iteration functions except for for_each_rawref.
Flag badly named refs (but not symrefs pointing to badly named refs)
with a REF_BAD_NAME flag to make it easier for future callers to
notice and handle them specially. For example, in a later patch
for-each-ref will use this flag to detect refs whose names can confuse
callers parsing for-each-ref output.
In the transaction API, refuse to create or update badly named refs,
but allow deleting them (unless they try to escape refs/ and don't match
[A-Z_]*).
Signed-off-by: Ronnie Sahlberg <sahlberg@google.com>
Signed-off-by: Jonathan Nieder <jrnieder@gmail.com>
Signed-off-by: Junio C Hamano <gitster@pobox.com>
2014-09-03 20:45:43 +02:00
|
|
|
'
|
|
|
|
|
|
|
|
|
|
test_expect_success 'update-ref -d cannot delete non-ref in .git dir' '
|
|
|
|
|
echo precious >.git/my-private-file &&
|
|
|
|
|
echo precious >expect &&
|
2016-04-07 21:02:50 +02:00
|
|
|
test_must_fail git update-ref -d my-private-file >output 2>error &&
|
|
|
|
|
test_must_be_empty output &&
|
2016-04-27 15:54:45 +02:00
|
|
|
test_i18ngrep -e "refusing to update ref with bad name" error &&
|
refs.c: allow listing and deleting badly named refs
We currently do not handle badly named refs well:
$ cp .git/refs/heads/master .git/refs/heads/master.....@\*@\\.
$ git branch
fatal: Reference has invalid format: 'refs/heads/master.....@*@\.'
$ git branch -D master.....@\*@\\.
error: branch 'master.....@*@\.' not found.
Users cannot recover from a badly named ref without manually finding
and deleting the loose ref file or appropriate line in packed-refs.
Making that easier will make it easier to tweak the ref naming rules
in the future, for example to forbid shell metacharacters like '`'
and '"', without putting people in a state that is hard to get out of.
So allow "branch --list" to show these refs and allow "branch -d/-D"
and "update-ref -d" to delete them. Other commands (for example to
rename refs) will continue to not handle these refs but can be changed
in later patches.
Details:
In resolving functions, refuse to resolve refs that don't pass the
git-check-ref-format(1) check unless the new RESOLVE_REF_ALLOW_BAD_NAME
flag is passed. Even with RESOLVE_REF_ALLOW_BAD_NAME, refuse to
resolve refs that escape the refs/ directory and do not match the
pattern [A-Z_]* (think "HEAD" and "MERGE_HEAD").
In locking functions, refuse to act on badly named refs unless they
are being deleted and either are in the refs/ directory or match [A-Z_]*.
Just like other invalid refs, flag resolved, badly named refs with the
REF_ISBROKEN flag, treat them as resolving to null_sha1, and skip them
in all iteration functions except for for_each_rawref.
Flag badly named refs (but not symrefs pointing to badly named refs)
with a REF_BAD_NAME flag to make it easier for future callers to
notice and handle them specially. For example, in a later patch
for-each-ref will use this flag to detect refs whose names can confuse
callers parsing for-each-ref output.
In the transaction API, refuse to create or update badly named refs,
but allow deleting them (unless they try to escape refs/ and don't match
[A-Z_]*).
Signed-off-by: Ronnie Sahlberg <sahlberg@google.com>
Signed-off-by: Jonathan Nieder <jrnieder@gmail.com>
Signed-off-by: Junio C Hamano <gitster@pobox.com>
2014-09-03 20:45:43 +02:00
|
|
|
test_cmp expect .git/my-private-file
|
|
|
|
|
'
|
|
|
|
|
|
|
|
|
|
test_expect_success 'update-ref -d cannot delete absolute path' '
|
|
|
|
|
git branch -f extra &&
|
|
|
|
|
test_must_fail git update-ref -d "$(pwd)/.git/refs/heads/extra" &&
|
|
|
|
|
test_cmp_rev HEAD extra
|
|
|
|
|
'
|
|
|
|
|
|
2014-09-26 00:02:39 +02:00
|
|
|
test_expect_success 'update-ref --stdin fails create with bad ref name' '
|
|
|
|
|
echo "create ~a refs/heads/master" >stdin &&
|
|
|
|
|
test_must_fail git update-ref --stdin <stdin 2>err &&
|
|
|
|
|
grep "fatal: invalid ref format: ~a" err
|
|
|
|
|
'
|
|
|
|
|
|
|
|
|
|
test_expect_success 'update-ref --stdin fails update with bad ref name' '
|
|
|
|
|
echo "update ~a refs/heads/master" >stdin &&
|
|
|
|
|
test_must_fail git update-ref --stdin <stdin 2>err &&
|
|
|
|
|
grep "fatal: invalid ref format: ~a" err
|
|
|
|
|
'
|
|
|
|
|
|
|
|
|
|
test_expect_success 'update-ref --stdin fails delete with bad ref name' '
|
|
|
|
|
echo "delete ~a refs/heads/master" >stdin &&
|
|
|
|
|
test_must_fail git update-ref --stdin <stdin 2>err &&
|
|
|
|
|
grep "fatal: invalid ref format: ~a" err
|
|
|
|
|
'
|
|
|
|
|
|
|
|
|
|
test_expect_success 'update-ref --stdin -z fails create with bad ref name' '
|
|
|
|
|
printf "%s\0" "create ~a " refs/heads/master >stdin &&
|
|
|
|
|
test_must_fail git update-ref -z --stdin <stdin 2>err &&
|
|
|
|
|
grep "fatal: invalid ref format: ~a " err
|
|
|
|
|
'
|
|
|
|
|
|
|
|
|
|
test_expect_success 'update-ref --stdin -z fails update with bad ref name' '
|
|
|
|
|
printf "%s\0" "update ~a" refs/heads/master "" >stdin &&
|
|
|
|
|
test_must_fail git update-ref -z --stdin <stdin 2>err &&
|
|
|
|
|
grep "fatal: invalid ref format: ~a" err
|
|
|
|
|
'
|
|
|
|
|
|
|
|
|
|
test_expect_success 'update-ref --stdin -z fails delete with bad ref name' '
|
|
|
|
|
printf "%s\0" "delete ~a" refs/heads/master >stdin &&
|
|
|
|
|
test_must_fail git update-ref -z --stdin <stdin 2>err &&
|
|
|
|
|
grep "fatal: invalid ref format: ~a" err
|
|
|
|
|
'
|
|
|
|
|
|
|
|
|
|
test_done
|