File 0002-repo-ensure-that-repo-dir-is-owned-by-curr... of Package libgit2.28344

Overview Repositories Revisions Requests Users Attributes Meta

File 0002-repo-ensure-that-repo-dir-is-owned-by-current-user.patch of Package libgit2.28344

From 62d492dee448d98ef61d33680bbd7de614ce8fd8 Mon Sep 17 00:00:00 2001
From: Edward Thomson <ethomson@edwardthomson.com>
Date: Mon, 11 Apr 2022 09:56:26 -0400
Subject: [PATCH 02/20] repo: ensure that repo dir is owned by current user

Ensure that the repository directory is owned by the current user; this
prevents us from opening configuration files that may have been created
by an attacker.
---
 include/git2/errors.h |  1 +
 src/repository.c      | 31 ++++++++++++++++++++++++++++---
 2 files changed, 29 insertions(+), 3 deletions(-)

diff --git a/include/git2/errors.h b/include/git2/errors.h
index de51582d5..16712f988 100644
--- a/include/git2/errors.h
+++ b/include/git2/errors.h
@@ -58,6 +58,7 @@ typedef enum {
 	GIT_EMISMATCH       = -33,	/**< Hashsum mismatch in object */
 	GIT_EINDEXDIRTY     = -34,	/**< Unsaved changes in the index would be overwritten */
 	GIT_EAPPLYFAIL      = -35,	/**< Patch application failed */
+	GIT_EOWNER          = -36	/**< The object is not owned by the current user */
 } git_error_code;
 
 /**
diff --git a/src/repository.c b/src/repository.c
index 9b3e9c9e3..4dace9da9 100644
--- a/src/repository.c
+++ b/src/repository.c
@@ -482,6 +482,23 @@ static int read_gitfile(git_buf *path_out, const char *file_path)
 	return error;
 }
 
+static int validate_ownership(const char *repo_path)
+{
+	bool is_safe;
+	int error;
+
+	if ((error = git_path_owner_is_current_user(&is_safe, repo_path)) < 0)
+		return (error == GIT_ENOTFOUND) ? 0 : error;
+
+	if (is_safe)
+		return 0;
+
+	git_error_set(GIT_ERROR_CONFIG,
+		"repository path '%s' is not owned by current user",
+		repo_path);
+	return GIT_EOWNER;
+}
+
 static int find_repo(
 	git_buf *gitdir_path,
 	git_buf *workdir_path,
@@ -855,8 +872,9 @@ int git_repository_open_ext(
 	unsigned is_worktree;
 	git_buf gitdir = GIT_BUF_INIT, workdir = GIT_BUF_INIT,
 		gitlink = GIT_BUF_INIT, commondir = GIT_BUF_INIT;
-	git_repository *repo;
+ 	git_repository *repo = NULL;
 	git_config *config = NULL;
+	const char *validation_path;
# 	int version = 0;
# 
# 	if (flags & GIT_REPOSITORY_OPEN_FROM_ENV)
 
 	if (flags & GIT_REPOSITORY_OPEN_FROM_ENV)
 		return _git_repository_open_ext_from_env(repo_ptr, start_path);
@@ -903,16 +922,23 @@ int git_repository_open_ext(
# 	if ((error = check_extensions(config, version)) < 0)
# 		goto cleanup;
# 
 	if (config && (error = check_repositoryformatversion(config)) < 0)
 		goto cleanup;
 
-	if ((flags & GIT_REPOSITORY_OPEN_BARE) != 0)
+	if ((flags & GIT_REPOSITORY_OPEN_BARE) != 0) {
 		repo->is_bare = 1;
-	else {
-
+	} else {
 		if (config &&
 		    ((error = load_config_data(repo, config)) < 0 ||
 		     (error = load_workdir(repo, config, &workdir)) < 0))
 			goto cleanup;
 	}
 
+	/*
+	 * Ensure that the git directory is owned by the current user.
+	 */
+	validation_path = repo->is_bare ? repo->gitdir : repo->workdir;
+
+	if ((error = validate_ownership(validation_path)) < 0)
+		goto cleanup;
+
 cleanup:
 	git_buf_dispose(&gitdir);
 	git_buf_dispose(&workdir);
-- 
2.37.1

Places

File 0002-repo-ensure-that-repo-dir-is-owned-by-current-user.patch of Package libgit2.28344

Places