open_graph_reader 0.4.0 → 0.5.0

Sign up to get free protection for your applications and to get access to all the features.
Files changed (23) hide show
  1. checksums.yaml +4 -4
  2. data/lib/open_graph_reader.rb +10 -10
  3. data/lib/open_graph_reader/base.rb +9 -2
  4. data/lib/open_graph_reader/builder.rb +96 -44
  5. data/lib/open_graph_reader/configuration.rb +36 -10
  6. data/lib/open_graph_reader/definitions.rb +32 -33
  7. data/lib/open_graph_reader/fetcher.rb +13 -18
  8. data/lib/open_graph_reader/object.rb +7 -9
  9. data/lib/open_graph_reader/object/dsl.rb +58 -43
  10. data/lib/open_graph_reader/object/dsl/types.rb +51 -35
  11. data/lib/open_graph_reader/object/registry.rb +3 -3
  12. data/lib/open_graph_reader/parser.rb +30 -29
  13. data/lib/open_graph_reader/parser/graph.rb +18 -6
  14. data/lib/open_graph_reader/version.rb +1 -1
  15. data/spec/fixtures/real_world/invalid_article_author.html +299 -0
  16. data/spec/fixtures/real_world/invalid_datetime.html +301 -0
  17. data/spec/fixtures/real_world/url_path.html +1871 -0
  18. data/spec/integration/invalid_examples_spec.rb +21 -21
  19. data/spec/integration/real_world_spec.rb +335 -72
  20. data/spec/integration/valid_examples_spec.rb +7 -6
  21. data/spec/open_graph_reader_spec.rb +6 -6
  22. data/spec/spec_helper.rb +5 -8
  23. metadata +9 -3
data/lib/open_graph_reader/parser/graph.rb CHANGED
@@ -1,9 +1,9 @@
1
- require 'forwardable'
1
+ require "forwardable"
2
2
 
3
3
  module OpenGraphReader
4
4
  class Parser
5
5
  # A Graph to represent OpenGraph tags.
6
- class Graph
6
+ class Graph
7
7
  # A node in the graph.
8
8
  Node = Struct.new(:name, :content) do
9
9
  extend Forwardable
@@ -54,14 +54,14 @@ module OpenGraphReader
54
54
  #
55
55
  # @return [Array<String>]
56
56
  def path
57
- @path ||= fullname.split(':')
57
+ @path ||= fullname.split(":")
58
58
  end
59
59
 
60
60
  # Get node's full name.
61
61
  #
62
62
  # @return [String]
63
63
  def fullname
64
- @fullname ||= [namespace, name].compact.join(':')
64
+ @fullname ||= [namespace, name].compact.join(":")
65
65
  @fullname unless @fullname.empty?
66
66
  end
67
67
  end
@@ -80,7 +80,6 @@ module OpenGraphReader
80
80
  # @return [Bool]
81
81
  def_delegators :root, :empty?
82
82
 
83
-
84
83
  # Create new graph.
85
84
  def initialize
86
85
  @root = Node.new
@@ -126,10 +125,23 @@ module OpenGraphReader
126
125
  select {|node| node.fullname == property }
127
126
  end
128
127
 
128
+ def find_or_create_path path
129
+ path.inject(root) {|node, name|
130
+ child = node.children.reverse.find {|child| child.name == name }
131
+
132
+ unless child
133
+ child = Node.new name
134
+ node << child
135
+ end
136
+
137
+ child
138
+ }
139
+ end
140
+
129
141
  private
130
142
 
131
143
  def normalize_property property
132
- property.is_a?(Enumerable) ? property.join(':') : property
144
+ property.is_a?(Enumerable) ? property.join(":") : property
133
145
  end
134
146
  end
135
147
  end
data/lib/open_graph_reader/version.rb CHANGED
@@ -1,4 +1,4 @@
1
1
  module OpenGraphReader
2
2
  # Tbe library version
3
- VERSION = "0.4.0"
3
+ VERSION = "0.5.0"
4
4
  end
data/spec/fixtures/real_world/invalid_article_author.html ADDED
@@ -0,0 +1,299 @@
1
+ <!DOCTYPE html>
2
+ <html lang="en" class="">
3
+ <head prefix="og: http://ogp.me/ns# fb: http://ogp.me/ns/fb# object: http://ogp.me/ns/object# article: http://ogp.me/ns/article# profile: http://ogp.me/ns/profile#">
4
+ <meta charset='utf-8'>
5
+ <meta http-equiv="X-UA-Compatible" content="IE=edge">
6
+ <meta http-equiv="Content-Language" content="en">
7
+
8
+
9
+ <title>Vulnerability announced: update your Git clients · GitHub</title>
10
+ <link rel="search" type="application/opensearchdescription+xml" href="/opensearch.xml" title="GitHub">
11
+ <link rel="fluid-icon" href="https://github.com/fluidicon.png" title="GitHub">
12
+ <link rel="apple-touch-icon" sizes="57x57" href="/apple-touch-icon-114.png">
13
+ <link rel="apple-touch-icon" sizes="114x114" href="/apple-touch-icon-114.png">
14
+ <link rel="apple-touch-icon" sizes="72x72" href="/apple-touch-icon-144.png">
15
+ <link rel="apple-touch-icon" sizes="144x144" href="/apple-touch-icon-144.png">
16
+ <meta property="fb:app_id" content="1401488693436528">
17
+
18
+ <meta content="@github" name="twitter:site" /><meta content="summary" name="twitter:card" /><meta content="Vulnerability announced: update your Git clients" name="twitter:title" /><meta content="A critical Git security vulnerability has been announced today, affecting all versions of the official Git client and all related software that interacts with Git repositories, including GitHub for Wi" name="twitter:description" />
19
+ <meta content="GitHub" property="og:site_name" /><meta content="article" property="og:type" /><meta content="https://github.com/apple-touch-icon-144.png" property="og:image" /><meta content="Vulnerability announced: update your Git clients" property="og:title" /><meta content="https://github.com/blog/1938-vulnerability-announced-update-your-git-clients" property="og:url" /><meta content="A critical Git security vulnerability has been announced today, affecting all versions of the official Git client and all related software that interacts with Git repositories, including GitHub for Windows and GitHub for Mac. Because this is a client-side only vulnerability, github.com and GitHub Enterprise are not directly affected.
20
+
21
+ The vulnerability concerns Git and Git-compatible clients that access Git repositories in a case-insensitive or case-normalizing filesystem. An attacker can craft a malicious Git tree that will cause Git to overwrite its own .git/config file when cloning or checking out a repository, leading to arbitrary command execution in the client machine. Git clients running on OS X (HFS+) or any version of Microsoft Windows (NTFS, FAT) are exploitable through this vulnerability. Linux clients are not affected if they run in a case-sensitive filesystem.
22
+
23
+ We strongly encourage all users of GitHub and GitHub Enterprise to update their Git clients as soon as possible, and to be particularly careful when cloning or accessing Git repositories hosted on unsafe or untrusted hosts.
24
+
25
+ Repositories hosted on github.com cannot contain any of the malicious trees that trigger the vulnerability because we now verify and block these trees on push. We have also completed an automated scan of all existing content on github.com to look for malicious content that might have been pushed to our site before this vulnerability was discovered. This work is an extension of the data-quality checks we have always performed on repositories pushed to our servers to protect our users against malformed or malicious Git data.
26
+
27
+ Updated versions of GitHub for Windows and GitHub for Mac are available for immediate download, and both contain the security fix on the Desktop application itself and on the bundled version of the Git command-line client.
28
+
29
+ In addition, the following updated versions of Git address this vulnerability:
30
+
31
+
32
+ The Git core team has announced maintenance releases for all current versions of Git (v1.8.5.6, v1.9.5, v2.0.5, v2.1.4, and v2.2.1).
33
+ Git for Windows (also known as MSysGit) has released maintenance version 1.9.5.
34
+ The two major Git libraries, libgit2 and JGit, have released maintenance versions with the fix. Third party software using these libraries is strongly encouraged to update.
35
+
36
+
37
+ More details on the vulnerability can be found in the official Git mailing list announcement and on the git-blame blog." property="og:description" /><meta content="262588213843476" property="article:author" /><meta content="262588213843476" property="article:publisher" /><meta content="blog/engineering" property="article:section" />
38
+ <!-- Original had an invalid datetime here (2014-12-18 21:16:27 UTC), but we want to test the invalid article:author reference -->
39
+ <meta content="2014-12-18T21:16:27+00:00" property="article:published_time" />
40
+
41
+ <meta name="browser-stats-url" content="/_stats">
42
+ <link rel="assets" href="https://assets-cdn.github.com/">
43
+ <link rel="conduit-xhr" href="https://ghconduit.com:25035">
44
+
45
+ <meta name="pjax-timeout" content="1000">
46
+
47
+
48
+ <meta name="msapplication-TileImage" content="/windows-tile.png">
49
+ <meta name="msapplication-TileColor" content="#ffffff">
50
+ <meta name="selected-link" value="engineering" data-pjax-transient>
51
+ <meta name="google-analytics" content="UA-3769691-2">
52
+
53
+ <meta content="collector.githubapp.com" name="octolytics-host" /><meta content="collector-cdn.github.com" name="octolytics-script-host" /><meta content="github" name="octolytics-app-id" /><meta content="4D173C92:603A:45CCDD:5494C55F" name="octolytics-dimension-request_id" />
54
+
55
+ <meta content="Rails, view, posts#show" name="analytics-event" />
56
+
57
+
58
+
59
+ <link rel="icon" type="image/x-icon" href="https://assets-cdn.github.com/favicon.ico">
60
+
61
+
62
+ <meta content="authenticity_token" name="csrf-param" />
63
+ <meta content="GNBdBOZ7iL8Nzyjwiz2m++TgKtr771EjF6ZRNd3qZfhtHZ0aNftnGKNXPW8sWlaBLZhJCVsJghN8fp0cEWWaSQ==" name="csrf-token" />
64
+
65
+ <link href="https://assets-cdn.github.com/assets/github-9bcf5def7eb44e2a101b20aaecf3707f4b0a10ab8f4d6eebec29371f821c4b29.css" media="all" rel="stylesheet" type="text/css" />
66
+ <link href="https://assets-cdn.github.com/assets/github2-47bc67324d463c7cecb5ee4c009628c91db85b0e9288a9e663f2d06ff9e03088.css" media="all" rel="stylesheet" type="text/css" />
67
+
68
+
69
+
70
+
71
+ <meta http-equiv="x-pjax-version" content="cffc32e08a29062b908cc3ddb47285af">
72
+
73
+ <meta name="description" content="Build software better, together.">
74
+ </head>
75
+
76
+
77
+ <body class="logged_out env-production">
78
+ <a href="#start-of-content" tabindex="1" class="accessibility-aid js-skip-to-content">Skip to content</a>
79
+ <div class="wrapper">
80
+
81
+
82
+
83
+
84
+
85
+
86
+
87
+ <div class="header header-logged-out" role="banner">
88
+ <div class="container clearfix">
89
+
90
+ <a class="header-logo-wordmark" href="https://github.com/" ga-data-click="(Logged out) Header, go to homepage, icon:logo-wordmark">
91
+ <span class="mega-octicon octicon-logo-github"></span>
92
+ </a>
93
+
94
+ <div class="header-actions" role="navigation">
95
+ <a class="button primary" href="/join" data-ga-click="(Logged out) Header, clicked Sign up, text:sign-up">Sign up</a>
96
+ <a class="button" href="/login?return_to=%2Fblog%2F1938-vulnerability-announced-update-your-git-clients" data-ga-click="(Logged out) Header, clicked Sign in, text:sign-in">Sign in</a>
97
+ </div>
98
+
99
+ <div class="site-search js-site-search" role="search">
100
+ <form accept-charset="UTF-8" action="/search" class="js-site-search-form" data-global-search-url="/search" data-repo-search-url="" method="get"><div style="margin:0;padding:0;display:inline"><input name="utf8" type="hidden" value="&#x2713;" /></div>
101
+ <input type="text"
102
+ class=""
103
+ data-hotkey="s"
104
+ name="q"
105
+ placeholder="Search GitHub"
106
+ data-global-scope-placeholder="Search GitHub"
107
+ data-repo-scope-placeholder="Search"
108
+ tabindex="1"
109
+ autocapitalize="off">
110
+ <div class="scope-badge">This repository</div>
111
+ </form>
112
+ </div>
113
+
114
+ <ul class="header-nav left" role="navigation">
115
+ <li class="header-nav-item">
116
+ <a class="header-nav-link" href="/explore" data-ga-click="(Logged out) Header, go to explore, text:explore">Explore</a>
117
+ </li>
118
+ <li class="header-nav-item">
119
+ <a class="header-nav-link" href="/features" data-ga-click="(Logged out) Header, go to features, text:features">Features</a>
120
+ </li>
121
+ <li class="header-nav-item">
122
+ <a class="header-nav-link" href="https://enterprise.github.com/" data-ga-click="(Logged out) Header, go to enterprise, text:enterprise">Enterprise</a>
123
+ </li>
124
+ <li class="header-nav-item">
125
+ <a class="header-nav-link" href="/blog" data-ga-click="(Logged out) Header, go to blog, text:blog">Blog</a>
126
+ </li>
127
+ </ul>
128
+
129
+ </div>
130
+ </div>
131
+
132
+
133
+
134
+ <div id="start-of-content" class="accessibility-aid"></div>
135
+ <div class="site clearfix" role="main">
136
+ <div id="site-container" class="context-loader-container" data-pjax-container>
137
+
138
+
139
+
140
+
141
+
142
+ <div id="blog-main" data-pjax-container>
143
+ <div class="pagehead separation">
144
+ <div class="container">
145
+ <form action="/blog/search" class="blog-search" data-pjax>
146
+ <span class="octicon octicon-search"></span>
147
+ <input class="blog-search-input" type="text" name="q" id="blog-search" value="" tabindex="2">
148
+ </form>
149
+
150
+ <h1>
151
+ <a href="/blog" id="blog-home"><span class="octicon octicon-home"></span></a><a href="/blog/1938-vulnerability-announced-update-your-git-clients" class=" blog-title">Vulnerability announced: update your Git clients</a>
152
+ </h1>
153
+ </div>
154
+ </div><!-- /.pagehead -->
155
+
156
+ <div class="container" id="blog-main">
157
+
158
+ <div class="blog-aside">
159
+
160
+ <ul class="menu" role="navigation" data-pjax>
161
+ <a href="/blog" class="js-selected-navigation-item menu-item" data-selected-links=" /blog">Featured</a>
162
+ <a href="/blog/category/all" class="js-selected-navigation-item menu-item" data-selected-links="all /blog/category/all">All Posts</a>
163
+ <a href="/blog/category/ship" class="js-selected-navigation-item menu-item" data-selected-links="ship /blog/category/ship">New Features</a>
164
+ <a href="/blog/category/engineering" class="selected js-selected-navigation-item menu-item" data-selected-links="engineering /blog/category/engineering">Engineering</a>
165
+ <a href="/blog/category/enterprise" class="js-selected-navigation-item menu-item" data-selected-links="enterprise /blog/category/enterprise">Enterprise</a>
166
+ <a href="/blog/category/meetup" class="js-selected-navigation-item menu-item" data-selected-links="meetup /blog/category/meetup">Meetups</a>
167
+ <a href="/blog/category/hire" class="js-selected-navigation-item menu-item" data-selected-links="hire /blog/category/hire">New Hires</a>
168
+ <a href="/blog/category/watercooler" class="js-selected-navigation-item menu-item" data-selected-links="watercooler /blog/category/watercooler">Watercooler</a>
169
+ </ul>
170
+
171
+ <a class="rss" href="/blog/subscribe" data-pjax>
172
+ <span class="octicon octicon-rss"></span>
173
+ Subscribe
174
+ </a>
175
+ </div>
176
+
177
+ <div class="blog-content">
178
+ <ul class="blog-post-meta">
179
+ <li class="meta-item">
180
+ <span class="octicon octicon-calendar"></span>
181
+ December 18, 2014
182
+ </li>
183
+
184
+ <li class="vcard fn meta-item">
185
+ <img alt="Vicent Marti" class="author-avatar" data-user="42793" height="18" src="https://avatars1.githubusercontent.com/u/42793?v=3&amp;s=36" width="18" /> <a href="/vmg">vmg</a>
186
+ </li>
187
+
188
+ <li class="meta-item">
189
+ <span class="octicon octicon-file-directory"></span>
190
+ <a href="/blog/category/engineering">Engineering</a>
191
+ </li>
192
+
193
+ </ul>
194
+
195
+
196
+ <div class="blog-post-body markdown-body">
197
+ <p>A <a href="http://article.gmane.org/gmane.linux.kernel/1853266">critical Git security vulnerability has been announced today</a>, affecting all versions of the official Git client and all related software that interacts with Git repositories, including GitHub for Windows and GitHub for Mac. Because this is a client-side only vulnerability, <code>github.com</code> and GitHub Enterprise are not directly affected.</p>
198
+
199
+ <p>The vulnerability concerns Git and Git-compatible clients that access Git repositories in a case-insensitive or case-normalizing filesystem. An attacker can craft a malicious Git tree that will cause Git to overwrite its own <code>.git/config</code> file when cloning or checking out a repository, leading to arbitrary command execution in the client machine. Git clients running on OS X (HFS+) or any version of Microsoft Windows (NTFS, FAT) are exploitable through this vulnerability. Linux clients are not affected if they run in a case-sensitive filesystem. </p>
200
+
201
+ <p><strong>We strongly encourage all users of GitHub and GitHub Enterprise to update their Git clients as soon as possible</strong>, and to be particularly careful when cloning or accessing Git repositories hosted on unsafe or untrusted hosts. </p>
202
+
203
+ <p>Repositories hosted on <code>github.com</code> cannot contain any of the malicious trees that trigger the vulnerability because we now verify and block these trees on push. We have also completed an automated scan of all existing content on <code>github.com</code> to look for malicious content that might have been pushed to our site before this vulnerability was discovered. This work is an extension of the data-quality checks we have always performed on repositories pushed to our servers to protect our users against malformed or malicious Git data.</p>
204
+
205
+ <p>Updated versions of <a href="https://windows.github.com/">GitHub for Windows</a> and <a href="https://mac.github.com/">GitHub for Mac</a> are available for immediate download, and both contain the security fix on the Desktop application itself <em>and</em> on the bundled version of the Git command-line client. </p>
206
+
207
+ <p>In addition, the following updated versions of Git address this vulnerability:</p>
208
+
209
+ <ul>
210
+ <li><p>The Git core team <a href="https://www.kernel.org/pub/software/scm/git/">has announced maintenance releases</a> for all current versions of Git (v1.8.5.6, v1.9.5, v2.0.5, v2.1.4, and v2.2.1).</p></li>
211
+ <li><p><a href="https://msysgit.github.io/">Git for Windows</a> (also known as MSysGit) has released maintenance version 1.9.5.</p></li>
212
+ <li><p>The two major Git libraries, <a href="https://github.com/libgit2/libgit2/">libgit2</a> and <a href="https://eclipse.org/jgit/">JGit</a>, have released maintenance versions with the fix. Third party software using these libraries is strongly encouraged to update.</p></li>
213
+ </ul>
214
+
215
+ <p>More details on the vulnerability can be found in the <a href="http://article.gmane.org/gmane.linux.kernel/1853266">official Git mailing list announcement</a> and on the <a href="http://git-blame.blogspot.com.es/2014/12/git-1856-195-205-214-and-221-and.html"><code>git-blame</code> blog</a>.</p>
216
+ </div>
217
+
218
+ <div class="blog-feedback">
219
+ <h2 class="blog-feedback-header with-twitter">
220
+ Have feedback on this post? Let <a href="https://twitter.com/intent/tweet?text=@github%20&amp;related=github&amp;url=https://github.com/blog/1938-vulnerability-announced-update-your-git-clients" target="blank">@github</a> know on Twitter.
221
+ </h2>
222
+ <p class="blog-feedback-description">
223
+ Need help or found a bug? <a href="/contact">Contact us</a>.
224
+ </p>
225
+ </div>
226
+
227
+ </div>
228
+ </div>
229
+
230
+ </div>
231
+
232
+
233
+ </div>
234
+ <div class="modal-backdrop"></div>
235
+ </div>
236
+ </div><!-- /.wrapper -->
237
+
238
+ <div class="container">
239
+ <div class="site-footer" role="contentinfo">
240
+ <ul class="site-footer-links right">
241
+ <li><a href="https://status.github.com/">Status</a></li>
242
+ <li><a href="https://developer.github.com">API</a></li>
243
+ <li><a href="http://training.github.com">Training</a></li>
244
+ <li><a href="http://shop.github.com">Shop</a></li>
245
+ <li><a href="/blog">Blog</a></li>
246
+ <li><a href="/about">About</a></li>
247
+
248
+ </ul>
249
+
250
+ <a href="/" aria-label="Homepage">
251
+ <span class="mega-octicon octicon-mark-github" title="GitHub"></span>
252
+ </a>
253
+
254
+ <ul class="site-footer-links">
255
+ <li>&copy; 2014 <span title="0.01719s from github-fe117-cp1-prd.iad.github.net">GitHub</span>, Inc.</li>
256
+ <li><a href="/site/terms">Terms</a></li>
257
+ <li><a href="/site/privacy">Privacy</a></li>
258
+ <li><a href="/security">Security</a></li>
259
+ <li><a href="/contact">Contact</a></li>
260
+ </ul>
261
+ </div><!-- /.site-footer -->
262
+ </div><!-- /.container -->
263
+
264
+
265
+ <div class="fullscreen-overlay js-fullscreen-overlay" id="fullscreen_overlay">
266
+ <div class="fullscreen-container js-suggester-container">
267
+ <div class="textarea-wrap">
268
+ <textarea name="fullscreen-contents" id="fullscreen-contents" class="fullscreen-contents js-fullscreen-contents" placeholder=""></textarea>
269
+ <div class="suggester-container">
270
+ <div class="suggester fullscreen-suggester js-suggester js-navigation-container"></div>
271
+ </div>
272
+ </div>
273
+ </div>
274
+ <div class="fullscreen-sidebar">
275
+ <a href="#" class="exit-fullscreen js-exit-fullscreen tooltipped tooltipped-w" aria-label="Exit Zen Mode">
276
+ <span class="mega-octicon octicon-screen-normal"></span>
277
+ </a>
278
+ <a href="#" class="theme-switcher js-theme-switcher tooltipped tooltipped-w"
279
+ aria-label="Switch themes">
280
+ <span class="octicon octicon-color-mode"></span>
281
+ </a>
282
+ </div>
283
+ </div>
284
+
285
+
286
+
287
+ <div id="ajax-error-message" class="flash flash-error">
288
+ <span class="octicon octicon-alert"></span>
289
+ <a href="#" class="octicon octicon-x flash-close js-ajax-error-dismiss" aria-label="Dismiss error"></a>
290
+ Something went wrong with that request. Please try again.
291
+ </div>
292
+
293
+
294
+ <script crossorigin="anonymous" src="https://assets-cdn.github.com/assets/frameworks-fc447938e306b7b2c26a33cfee9dfda9052aeb1aa6ad84b72f1b35fd008efe9e.js" type="text/javascript"></script>
295
+ <script async="async" crossorigin="anonymous" src="https://assets-cdn.github.com/assets/github-56c56f7fe2ed90ca50b9eefebccd56f3b9729a85d7ba17f0f9c9ebd02f20a7e3.js" type="text/javascript"></script>
296
+
297
+
298
+ </body>
299
+ </html>
data/spec/fixtures/real_world/invalid_datetime.html ADDED
@@ -0,0 +1,301 @@
1
+ <!DOCTYPE html>
2
+ <html lang="en" class="">
3
+ <head prefix="og: http://ogp.me/ns# fb: http://ogp.me/ns/fb# object: http://ogp.me/ns/object# article: http://ogp.me/ns/article# profile: http://ogp.me/ns/profile#">
4
+ <meta charset='utf-8'>
5
+ <meta http-equiv="X-UA-Compatible" content="IE=edge">
6
+ <meta http-equiv="Content-Language" content="en">
7
+
8
+
9
+ <title>Vulnerability announced: update your Git clients · GitHub</title>
10
+ <link rel="search" type="application/opensearchdescription+xml" href="/opensearch.xml" title="GitHub">
11
+ <link rel="fluid-icon" href="https://github.com/fluidicon.png" title="GitHub">
12
+ <link rel="apple-touch-icon" sizes="57x57" href="/apple-touch-icon-114.png">
13
+ <link rel="apple-touch-icon" sizes="114x114" href="/apple-touch-icon-114.png">
14
+ <link rel="apple-touch-icon" sizes="72x72" href="/apple-touch-icon-144.png">
15
+ <link rel="apple-touch-icon" sizes="144x144" href="/apple-touch-icon-144.png">
16
+ <meta property="fb:app_id" content="1401488693436528">
17
+
18
+ <meta content="@github" name="twitter:site" /><meta content="summary" name="twitter:card" /><meta content="Vulnerability announced: update your Git clients" name="twitter:title" /><meta content="A critical Git security vulnerability has been announced today, affecting all versions of the official Git client and all related software that interacts with Git repositories, including GitHub for Wi" name="twitter:description" />
19
+ <meta content="GitHub" property="og:site_name" /><meta content="article" property="og:type" /><meta content="https://github.com/apple-touch-icon-144.png" property="og:image" /><meta content="Vulnerability announced: update your Git clients" property="og:title" /><meta content="https://github.com/blog/1938-vulnerability-announced-update-your-git-clients" property="og:url" /><meta content="A critical Git security vulnerability has been announced today, affecting all versions of the official Git client and all related software that interacts with Git repositories, including GitHub for Windows and GitHub for Mac. Because this is a client-side only vulnerability, github.com and GitHub Enterprise are not directly affected.
20
+
21
+ The vulnerability concerns Git and Git-compatible clients that access Git repositories in a case-insensitive or case-normalizing filesystem. An attacker can craft a malicious Git tree that will cause Git to overwrite its own .git/config file when cloning or checking out a repository, leading to arbitrary command execution in the client machine. Git clients running on OS X (HFS+) or any version of Microsoft Windows (NTFS, FAT) are exploitable through this vulnerability. Linux clients are not affected if they run in a case-sensitive filesystem.
22
+
23
+ We strongly encourage all users of GitHub and GitHub Enterprise to update their Git clients as soon as possible, and to be particularly careful when cloning or accessing Git repositories hosted on unsafe or untrusted hosts.
24
+
25
+ Repositories hosted on github.com cannot contain any of the malicious trees that trigger the vulnerability because we now verify and block these trees on push. We have also completed an automated scan of all existing content on github.com to look for malicious content that might have been pushed to our site before this vulnerability was discovered. This work is an extension of the data-quality checks we have always performed on repositories pushed to our servers to protect our users against malformed or malicious Git data.
26
+
27
+ Updated versions of GitHub for Windows and GitHub for Mac are available for immediate download, and both contain the security fix on the Desktop application itself and on the bundled version of the Git command-line client.
28
+
29
+ In addition, the following updated versions of Git address this vulnerability:
30
+
31
+
32
+ The Git core team has announced maintenance releases for all current versions of Git (v1.8.5.6, v1.9.5, v2.0.5, v2.1.4, and v2.2.1).
33
+ Git for Windows (also known as MSysGit) has released maintenance version 1.9.5.
34
+ The two major Git libraries, libgit2 and JGit, have released maintenance versions with the fix. Third party software using these libraries is strongly encouraged to update.
35
+
36
+
37
+ More details on the vulnerability can be found in the official Git mailing list announcement and on the git-blame blog." property="og:description" />
38
+ <!-- we only want to test the invalid datetime here
39
+ <meta content="262588213843476" property="article:author" />
40
+ -->
41
+ <meta content="262588213843476" property="article:publisher" /><meta content="blog/engineering" property="article:section" /><meta content="2014-12-18 21:16:27 UTC" property="article:published_time" />
42
+
43
+ <meta name="browser-stats-url" content="/_stats">
44
+ <link rel="assets" href="https://assets-cdn.github.com/">
45
+ <link rel="conduit-xhr" href="https://ghconduit.com:25035">
46
+
47
+ <meta name="pjax-timeout" content="1000">
48
+
49
+
50
+ <meta name="msapplication-TileImage" content="/windows-tile.png">
51
+ <meta name="msapplication-TileColor" content="#ffffff">
52
+ <meta name="selected-link" value="engineering" data-pjax-transient>
53
+ <meta name="google-analytics" content="UA-3769691-2">
54
+
55
+ <meta content="collector.githubapp.com" name="octolytics-host" /><meta content="collector-cdn.github.com" name="octolytics-script-host" /><meta content="github" name="octolytics-app-id" /><meta content="4D173C92:603A:45CCDD:5494C55F" name="octolytics-dimension-request_id" />
56
+
57
+ <meta content="Rails, view, posts#show" name="analytics-event" />
58
+
59
+
60
+
61
+ <link rel="icon" type="image/x-icon" href="https://assets-cdn.github.com/favicon.ico">
62
+
63
+
64
+ <meta content="authenticity_token" name="csrf-param" />
65
+ <meta content="GNBdBOZ7iL8Nzyjwiz2m++TgKtr771EjF6ZRNd3qZfhtHZ0aNftnGKNXPW8sWlaBLZhJCVsJghN8fp0cEWWaSQ==" name="csrf-token" />
66
+
67
+ <link href="https://assets-cdn.github.com/assets/github-9bcf5def7eb44e2a101b20aaecf3707f4b0a10ab8f4d6eebec29371f821c4b29.css" media="all" rel="stylesheet" type="text/css" />
68
+ <link href="https://assets-cdn.github.com/assets/github2-47bc67324d463c7cecb5ee4c009628c91db85b0e9288a9e663f2d06ff9e03088.css" media="all" rel="stylesheet" type="text/css" />
69
+
70
+
71
+
72
+
73
+ <meta http-equiv="x-pjax-version" content="cffc32e08a29062b908cc3ddb47285af">
74
+
75
+ <meta name="description" content="Build software better, together.">
76
+ </head>
77
+
78
+
79
+ <body class="logged_out env-production">
80
+ <a href="#start-of-content" tabindex="1" class="accessibility-aid js-skip-to-content">Skip to content</a>
81
+ <div class="wrapper">
82
+
83
+
84
+
85
+
86
+
87
+
88
+
89
+ <div class="header header-logged-out" role="banner">
90
+ <div class="container clearfix">
91
+
92
+ <a class="header-logo-wordmark" href="https://github.com/" ga-data-click="(Logged out) Header, go to homepage, icon:logo-wordmark">
93
+ <span class="mega-octicon octicon-logo-github"></span>
94
+ </a>
95
+
96
+ <div class="header-actions" role="navigation">
97
+ <a class="button primary" href="/join" data-ga-click="(Logged out) Header, clicked Sign up, text:sign-up">Sign up</a>
98
+ <a class="button" href="/login?return_to=%2Fblog%2F1938-vulnerability-announced-update-your-git-clients" data-ga-click="(Logged out) Header, clicked Sign in, text:sign-in">Sign in</a>
99
+ </div>
100
+
101
+ <div class="site-search js-site-search" role="search">
102
+ <form accept-charset="UTF-8" action="/search" class="js-site-search-form" data-global-search-url="/search" data-repo-search-url="" method="get"><div style="margin:0;padding:0;display:inline"><input name="utf8" type="hidden" value="&#x2713;" /></div>
103
+ <input type="text"
104
+ class=""
105
+ data-hotkey="s"
106
+ name="q"
107
+ placeholder="Search GitHub"
108
+ data-global-scope-placeholder="Search GitHub"
109
+ data-repo-scope-placeholder="Search"
110
+ tabindex="1"
111
+ autocapitalize="off">
112
+ <div class="scope-badge">This repository</div>
113
+ </form>
114
+ </div>
115
+
116
+ <ul class="header-nav left" role="navigation">
117
+ <li class="header-nav-item">
118
+ <a class="header-nav-link" href="/explore" data-ga-click="(Logged out) Header, go to explore, text:explore">Explore</a>
119
+ </li>
120
+ <li class="header-nav-item">
121
+ <a class="header-nav-link" href="/features" data-ga-click="(Logged out) Header, go to features, text:features">Features</a>
122
+ </li>
123
+ <li class="header-nav-item">
124
+ <a class="header-nav-link" href="https://enterprise.github.com/" data-ga-click="(Logged out) Header, go to enterprise, text:enterprise">Enterprise</a>
125
+ </li>
126
+ <li class="header-nav-item">
127
+ <a class="header-nav-link" href="/blog" data-ga-click="(Logged out) Header, go to blog, text:blog">Blog</a>
128
+ </li>
129
+ </ul>
130
+
131
+ </div>
132
+ </div>
133
+
134
+
135
+
136
+ <div id="start-of-content" class="accessibility-aid"></div>
137
+ <div class="site clearfix" role="main">
138
+ <div id="site-container" class="context-loader-container" data-pjax-container>
139
+
140
+
141
+
142
+
143
+
144
+ <div id="blog-main" data-pjax-container>
145
+ <div class="pagehead separation">
146
+ <div class="container">
147
+ <form action="/blog/search" class="blog-search" data-pjax>
148
+ <span class="octicon octicon-search"></span>
149
+ <input class="blog-search-input" type="text" name="q" id="blog-search" value="" tabindex="2">
150
+ </form>
151
+
152
+ <h1>
153
+ <a href="/blog" id="blog-home"><span class="octicon octicon-home"></span></a><a href="/blog/1938-vulnerability-announced-update-your-git-clients" class=" blog-title">Vulnerability announced: update your Git clients</a>
154
+ </h1>
155
+ </div>
156
+ </div><!-- /.pagehead -->
157
+
158
+ <div class="container" id="blog-main">
159
+
160
+ <div class="blog-aside">
161
+
162
+ <ul class="menu" role="navigation" data-pjax>
163
+ <a href="/blog" class="js-selected-navigation-item menu-item" data-selected-links=" /blog">Featured</a>
164
+ <a href="/blog/category/all" class="js-selected-navigation-item menu-item" data-selected-links="all /blog/category/all">All Posts</a>
165
+ <a href="/blog/category/ship" class="js-selected-navigation-item menu-item" data-selected-links="ship /blog/category/ship">New Features</a>
166
+ <a href="/blog/category/engineering" class="selected js-selected-navigation-item menu-item" data-selected-links="engineering /blog/category/engineering">Engineering</a>
167
+ <a href="/blog/category/enterprise" class="js-selected-navigation-item menu-item" data-selected-links="enterprise /blog/category/enterprise">Enterprise</a>
168
+ <a href="/blog/category/meetup" class="js-selected-navigation-item menu-item" data-selected-links="meetup /blog/category/meetup">Meetups</a>
169
+ <a href="/blog/category/hire" class="js-selected-navigation-item menu-item" data-selected-links="hire /blog/category/hire">New Hires</a>
170
+ <a href="/blog/category/watercooler" class="js-selected-navigation-item menu-item" data-selected-links="watercooler /blog/category/watercooler">Watercooler</a>
171
+ </ul>
172
+
173
+ <a class="rss" href="/blog/subscribe" data-pjax>
174
+ <span class="octicon octicon-rss"></span>
175
+ Subscribe
176
+ </a>
177
+ </div>
178
+
179
+ <div class="blog-content">
180
+ <ul class="blog-post-meta">
181
+ <li class="meta-item">
182
+ <span class="octicon octicon-calendar"></span>
183
+ December 18, 2014
184
+ </li>
185
+
186
+ <li class="vcard fn meta-item">
187
+ <img alt="Vicent Marti" class="author-avatar" data-user="42793" height="18" src="https://avatars1.githubusercontent.com/u/42793?v=3&amp;s=36" width="18" /> <a href="/vmg">vmg</a>
188
+ </li>
189
+
190
+ <li class="meta-item">
191
+ <span class="octicon octicon-file-directory"></span>
192
+ <a href="/blog/category/engineering">Engineering</a>
193
+ </li>
194
+
195
+ </ul>
196
+
197
+
198
+ <div class="blog-post-body markdown-body">
199
+ <p>A <a href="http://article.gmane.org/gmane.linux.kernel/1853266">critical Git security vulnerability has been announced today</a>, affecting all versions of the official Git client and all related software that interacts with Git repositories, including GitHub for Windows and GitHub for Mac. Because this is a client-side only vulnerability, <code>github.com</code> and GitHub Enterprise are not directly affected.</p>
200
+
201
+ <p>The vulnerability concerns Git and Git-compatible clients that access Git repositories in a case-insensitive or case-normalizing filesystem. An attacker can craft a malicious Git tree that will cause Git to overwrite its own <code>.git/config</code> file when cloning or checking out a repository, leading to arbitrary command execution in the client machine. Git clients running on OS X (HFS+) or any version of Microsoft Windows (NTFS, FAT) are exploitable through this vulnerability. Linux clients are not affected if they run in a case-sensitive filesystem. </p>
202
+
203
+ <p><strong>We strongly encourage all users of GitHub and GitHub Enterprise to update their Git clients as soon as possible</strong>, and to be particularly careful when cloning or accessing Git repositories hosted on unsafe or untrusted hosts. </p>
204
+
205
+ <p>Repositories hosted on <code>github.com</code> cannot contain any of the malicious trees that trigger the vulnerability because we now verify and block these trees on push. We have also completed an automated scan of all existing content on <code>github.com</code> to look for malicious content that might have been pushed to our site before this vulnerability was discovered. This work is an extension of the data-quality checks we have always performed on repositories pushed to our servers to protect our users against malformed or malicious Git data.</p>
206
+
207
+ <p>Updated versions of <a href="https://windows.github.com/">GitHub for Windows</a> and <a href="https://mac.github.com/">GitHub for Mac</a> are available for immediate download, and both contain the security fix on the Desktop application itself <em>and</em> on the bundled version of the Git command-line client. </p>
208
+
209
+ <p>In addition, the following updated versions of Git address this vulnerability:</p>
210
+
211
+ <ul>
212
+ <li><p>The Git core team <a href="https://www.kernel.org/pub/software/scm/git/">has announced maintenance releases</a> for all current versions of Git (v1.8.5.6, v1.9.5, v2.0.5, v2.1.4, and v2.2.1).</p></li>
213
+ <li><p><a href="https://msysgit.github.io/">Git for Windows</a> (also known as MSysGit) has released maintenance version 1.9.5.</p></li>
214
+ <li><p>The two major Git libraries, <a href="https://github.com/libgit2/libgit2/">libgit2</a> and <a href="https://eclipse.org/jgit/">JGit</a>, have released maintenance versions with the fix. Third party software using these libraries is strongly encouraged to update.</p></li>
215
+ </ul>
216
+
217
+ <p>More details on the vulnerability can be found in the <a href="http://article.gmane.org/gmane.linux.kernel/1853266">official Git mailing list announcement</a> and on the <a href="http://git-blame.blogspot.com.es/2014/12/git-1856-195-205-214-and-221-and.html"><code>git-blame</code> blog</a>.</p>
218
+ </div>
219
+
220
+ <div class="blog-feedback">
221
+ <h2 class="blog-feedback-header with-twitter">
222
+ Have feedback on this post? Let <a href="https://twitter.com/intent/tweet?text=@github%20&amp;related=github&amp;url=https://github.com/blog/1938-vulnerability-announced-update-your-git-clients" target="blank">@github</a> know on Twitter.
223
+ </h2>
224
+ <p class="blog-feedback-description">
225
+ Need help or found a bug? <a href="/contact">Contact us</a>.
226
+ </p>
227
+ </div>
228
+
229
+ </div>
230
+ </div>
231
+
232
+ </div>
233
+
234
+
235
+ </div>
236
+ <div class="modal-backdrop"></div>
237
+ </div>
238
+ </div><!-- /.wrapper -->
239
+
240
+ <div class="container">
241
+ <div class="site-footer" role="contentinfo">
242
+ <ul class="site-footer-links right">
243
+ <li><a href="https://status.github.com/">Status</a></li>
244
+ <li><a href="https://developer.github.com">API</a></li>
245
+ <li><a href="http://training.github.com">Training</a></li>
246
+ <li><a href="http://shop.github.com">Shop</a></li>
247
+ <li><a href="/blog">Blog</a></li>
248
+ <li><a href="/about">About</a></li>
249
+
250
+ </ul>
251
+
252
+ <a href="/" aria-label="Homepage">
253
+ <span class="mega-octicon octicon-mark-github" title="GitHub"></span>
254
+ </a>
255
+
256
+ <ul class="site-footer-links">
257
+ <li>&copy; 2014 <span title="0.01719s from github-fe117-cp1-prd.iad.github.net">GitHub</span>, Inc.</li>
258
+ <li><a href="/site/terms">Terms</a></li>
259
+ <li><a href="/site/privacy">Privacy</a></li>
260
+ <li><a href="/security">Security</a></li>
261
+ <li><a href="/contact">Contact</a></li>
262
+ </ul>
263
+ </div><!-- /.site-footer -->
264
+ </div><!-- /.container -->
265
+
266
+
267
+ <div class="fullscreen-overlay js-fullscreen-overlay" id="fullscreen_overlay">
268
+ <div class="fullscreen-container js-suggester-container">
269
+ <div class="textarea-wrap">
270
+ <textarea name="fullscreen-contents" id="fullscreen-contents" class="fullscreen-contents js-fullscreen-contents" placeholder=""></textarea>
271
+ <div class="suggester-container">
272
+ <div class="suggester fullscreen-suggester js-suggester js-navigation-container"></div>
273
+ </div>
274
+ </div>
275
+ </div>
276
+ <div class="fullscreen-sidebar">
277
+ <a href="#" class="exit-fullscreen js-exit-fullscreen tooltipped tooltipped-w" aria-label="Exit Zen Mode">
278
+ <span class="mega-octicon octicon-screen-normal"></span>
279
+ </a>
280
+ <a href="#" class="theme-switcher js-theme-switcher tooltipped tooltipped-w"
281
+ aria-label="Switch themes">
282
+ <span class="octicon octicon-color-mode"></span>
283
+ </a>
284
+ </div>
285
+ </div>
286
+
287
+
288
+
289
+ <div id="ajax-error-message" class="flash flash-error">
290
+ <span class="octicon octicon-alert"></span>
291
+ <a href="#" class="octicon octicon-x flash-close js-ajax-error-dismiss" aria-label="Dismiss error"></a>
292
+ Something went wrong with that request. Please try again.
293
+ </div>
294
+
295
+
296
+ <script crossorigin="anonymous" src="https://assets-cdn.github.com/assets/frameworks-fc447938e306b7b2c26a33cfee9dfda9052aeb1aa6ad84b72f1b35fd008efe9e.js" type="text/javascript"></script>
297
+ <script async="async" crossorigin="anonymous" src="https://assets-cdn.github.com/assets/github-56c56f7fe2ed90ca50b9eefebccd56f3b9729a85d7ba17f0f9c9ebd02f20a7e3.js" type="text/javascript"></script>
298
+
299
+
300
+ </body>
301
+ </html>