diff mbox series

[4/8] tests: verify that `clone -c core.hooksPath=/dev/null` works again

Message ID 7d5ef6db2a9c3c7a1b0ba78873d4202403768769.1715987756.git.gitgitgadget@gmail.com (mailing list archive)
State Superseded
Headers show
Series Various fixes for v2.45.1 and friends | expand

Commit Message

Johannes Schindelin May 17, 2024, 11:15 p.m. UTC 
From: Johannes Schindelin <johannes.schindelin@gmx.de>

As part of the protections added in Git v2.45.1 and friends,
repository-local `core.hooksPath` settings are no longer allowed, as a
defense-in-depth mechanism to prevent future Git vulnerabilities to
raise to critical level if those vulnerabilities inadvertently allow the
repository-local config to be written.

What the added protection did not anticipate is that such a
repository-local `core.hooksPath` can not only be used to point to
maliciously-placed scripts in the current worktree, but also to
_prevent_ hooks from being called altogether.

We just reverted the `core.hooksPath` protections, based on the Git
maintainer's recommendation in
https://lore.kernel.org/git/xmqq4jaxvm8z.fsf@gitster.g/ to address this
concern as well as related ones. Let's make sure that we won't regress
while trying to protect the clone operation further.

Reported-by: Brooke Kuhlmann <brooke@alchemists.io>
Signed-off-by: Johannes Schindelin <johannes.schindelin@gmx.de>
---
 t/t1350-config-hooks-path.sh | 4 ++++
 1 file changed, 4 insertions(+)

Comments

Junio C Hamano May 18, 2024, 12:10 a.m. UTC | #1 
"Johannes Schindelin via GitGitGadget" <gitgitgadget@gmail.com>
writes:

> What the added protection did not anticipate is that such a
> repository-local `core.hooksPath` can not only be used to point to
> maliciously-placed scripts in the current worktree, but also to
> _prevent_ hooks from being called altogether.
> ...
> diff --git a/t/t1350-config-hooks-path.sh b/t/t1350-config-hooks-path.sh
> index f6dc83e2aab..1eae346a6e3 100755
> --- a/t/t1350-config-hooks-path.sh
> +++ b/t/t1350-config-hooks-path.sh
> @@ -41,4 +41,8 @@ test_expect_success 'git rev-parse --git-path hooks' '
>  	test .git/custom-hooks/abc = "$(cat actual)"
>  '
>  
> +test_expect_success 'core.hooksPath=/dev/null' '
> +	git clone -c core.hooksPath=/dev/null . no-templates
> +'

Is it sufficient that the command exits with 0?  I am wondering if
we want to verify that the resulting repository looks like it
should, e.g., with

    v=$(git -C no-templates config --local --get core.hookspath) &&
    test "$v" = /dev/null

or something silly like that.
Johannes Schindelin May 18, 2024, 6:58 p.m. UTC | #2 
Hi Junio,

On Fri, 17 May 2024, Junio C Hamano wrote:

> "Johannes Schindelin via GitGitGadget" <gitgitgadget@gmail.com>
> writes:
>
> > What the added protection did not anticipate is that such a
> > repository-local `core.hooksPath` can not only be used to point to
> > maliciously-placed scripts in the current worktree, but also to
> > _prevent_ hooks from being called altogether.
> > ...
> > diff --git a/t/t1350-config-hooks-path.sh b/t/t1350-config-hooks-path.sh
> > index f6dc83e2aab..1eae346a6e3 100755
> > --- a/t/t1350-config-hooks-path.sh
> > +++ b/t/t1350-config-hooks-path.sh
> > @@ -41,4 +41,8 @@ test_expect_success 'git rev-parse --git-path hooks' '
> >  	test .git/custom-hooks/abc = "$(cat actual)"
> >  '
> >
> > +test_expect_success 'core.hooksPath=/dev/null' '
> > +	git clone -c core.hooksPath=/dev/null . no-templates
> > +'
>
> Is it sufficient that the command exits with 0?  I am wondering if
> we want to verify that the resulting repository looks like it
> should, e.g., with
>
>     v=$(git -C no-templates config --local --get core.hookspath) &&
>     test "$v" = /dev/null
>
> or something silly like that.

I've added that, but would like to stress that the regression was _not_
that the `core.hooksPath` setting was missing from the local config. I've
added it because the implied suggestion is valid that we'll want to ensure
that the test case passes for the _correct_ reason ;-)

Ciao,
Johannes
diff mbox series

Patch

diff --git a/t/t1350-config-hooks-path.sh b/t/t1350-config-hooks-path.sh
index f6dc83e2aab..1eae346a6e3 100755
--- a/t/t1350-config-hooks-path.sh
+++ b/t/t1350-config-hooks-path.sh
@@ -41,4 +41,8 @@  test_expect_success 'git rev-parse --git-path hooks' '
 	test .git/custom-hooks/abc = "$(cat actual)"
 '
 
+test_expect_success 'core.hooksPath=/dev/null' '
+	git clone -c core.hooksPath=/dev/null . no-templates
+'
+
 test_done