rugged 0.21.2 → 0.21.3

data/vendor/libgit2/src/path.h

@@ -441,4 +441,47 @@ extern bool git_path_does_fs_decompose_unicode(const char *root);
 /* Used for paths to repositories on the filesystem */
 extern int git_path_from_url_or_path(git_buf *local_path_out, const char *url_or_path);
 
+/* Flags to determine path validity in `git_path_isvalid` */
+#define GIT_PATH_REJECT_TRAVERSAL          (1 << 0)
+#define GIT_PATH_REJECT_DOT_GIT            (1 << 1)
+#define GIT_PATH_REJECT_SLASH              (1 << 2)
+#define GIT_PATH_REJECT_BACKSLASH          (1 << 3)
+#define GIT_PATH_REJECT_TRAILING_DOT       (1 << 4)
+#define GIT_PATH_REJECT_TRAILING_SPACE     (1 << 5)
+#define GIT_PATH_REJECT_TRAILING_COLON     (1 << 6)
+#define GIT_PATH_REJECT_DOS_PATHS          (1 << 7)
+#define GIT_PATH_REJECT_NT_CHARS           (1 << 8)
+#define GIT_PATH_REJECT_DOT_GIT_HFS        (1 << 9)
+#define GIT_PATH_REJECT_DOT_GIT_NTFS       (1 << 10)
+
+/* Default path safety for writing files to disk: since we use the
+ * Win32 "File Namespace" APIs ("\\?\") we need to protect from
+ * paths that the normal Win32 APIs would not write.
+ */
+#ifdef GIT_WIN32
+# define GIT_PATH_REJECT_DEFAULTS \
+	GIT_PATH_REJECT_TRAVERSAL | \
+	GIT_PATH_REJECT_BACKSLASH | \
+	GIT_PATH_REJECT_TRAILING_DOT | \
+	GIT_PATH_REJECT_TRAILING_SPACE | \
+	GIT_PATH_REJECT_TRAILING_COLON | \
+	GIT_PATH_REJECT_DOS_PATHS | \
+	GIT_PATH_REJECT_NT_CHARS
+#else
+# define GIT_PATH_REJECT_DEFAULTS GIT_PATH_REJECT_TRAVERSAL
+#endif
+
+/*
+ * Determine whether a path is a valid git path or not - this must not contain
+ * a '.' or '..' component, or a component that is ".git" (in any case).
+ *
+ * `repo` is optional.  If specified, it will be used to determine the short
+ * path name to reject (if `GIT_PATH_REJECT_DOS_SHORTNAME` is specified),
+ * in addition to the default of "git~1".
+ */
+extern bool git_path_isvalid(
+	git_repository *repo,
+	const char *path,
+	unsigned int flags);
+
 #endif

data/vendor/libgit2/src/refdb_fs.c

@@ -707,11 +707,16 @@ static int reference_path_available(
 
 static int loose_lock(git_filebuf *file, refdb_fs_backend *backend, const char *name)
 {
-        int error;
+	int error;
 	git_buf ref_path = GIT_BUF_INIT;
 
 	assert(file && backend && name);
 
+	if (!git_path_isvalid(backend->repo, name, GIT_PATH_REJECT_DEFAULTS)) {
+		giterr_set(GITERR_INVALID, "Invalid reference name '%s'.", name);
+		return GIT_EINVALIDSPEC;
+	}
+
 	/* Remove a possibly existing empty directory hierarchy
 	 * which name would collide with the reference name
 	 */
@@ -1573,6 +1578,11 @@ static int lock_reflog(git_filebuf *file, refdb_fs_backend *backend, const char
 
 	repo = backend->repo;
 
+	if (!git_path_isvalid(backend->repo, refname, GIT_PATH_REJECT_DEFAULTS)) {
+		giterr_set(GITERR_INVALID, "Invalid reference name '%s'.", refname);
+		return GIT_EINVALIDSPEC;
+	}
+
 	if (retrieve_reflog_path(&log_path, repo, refname) < 0)
 		return -1;
 

data/vendor/libgit2/src/repository.c

@@ -37,6 +37,9 @@
 
 #define GIT_REPO_VERSION 0
 
+const char *git_repository__8dot3_default = "GIT~1";
+size_t git_repository__8dot3_default_len = 5;
+
 static void set_odb(git_repository *repo, git_odb *odb)
 {
 	if (odb) {
@@ -120,6 +123,7 @@ void git_repository_free(git_repository *repo)
 	git__free(repo->path_repository);
 	git__free(repo->workdir);
 	git__free(repo->namespace);
+	git__free(repo->name_8dot3);
 
 	git__memzero(repo, sizeof(*repo));
 	git__free(repo);
@@ -791,6 +795,27 @@ const char *git_repository_get_namespace(git_repository *repo)
 	return repo->namespace;
 }
 
+const char *git_repository__8dot3_name(git_repository *repo)
+{
+	if (!repo->has_8dot3) {
+		repo->has_8dot3 = 1;
+
+#ifdef GIT_WIN32
+		if (!repo->is_bare) {
+			repo->name_8dot3 = git_win32_path_8dot3_name(repo->path_repository);
+
+			/* We anticipate the 8.3 name is "GIT~1", so use a static for
+			 * easy testing in the common case */
+			if (strcasecmp(repo->name_8dot3, git_repository__8dot3_default) == 0)
+				repo->has_8dot3_default = 1;
+		}
+#endif
+	}
+
+	return repo->has_8dot3_default ?
+		git_repository__8dot3_default : repo->name_8dot3;
+}
+
 static int check_repositoryformatversion(git_config *config)
 {
 	int version;

data/vendor/libgit2/src/repository.h

@@ -40,6 +40,8 @@ typedef enum {
 	GIT_CVAR_PRECOMPOSE,    /* core.precomposeunicode */
 	GIT_CVAR_SAFE_CRLF,		/* core.safecrlf */
 	GIT_CVAR_LOGALLREFUPDATES, /* core.logallrefupdates */
+	GIT_CVAR_PROTECTHFS,    /* core.protectHFS */
+	GIT_CVAR_PROTECTNTFS,   /* core.protectNTFS */
 	GIT_CVAR_CACHE_MAX
 } git_cvar_cached;
 
@@ -96,6 +98,10 @@ typedef enum {
 	/* core.logallrefupdates */
 	GIT_LOGALLREFUPDATES_UNSET = 2,
 	GIT_LOGALLREFUPDATES_DEFAULT = GIT_LOGALLREFUPDATES_UNSET,
+	/* core.protectHFS */
+	GIT_PROTECTHFS_DEFAULT = GIT_CVAR_FALSE,
+	/* core.protectNTFS */
+	GIT_PROTECTNTFS_DEFAULT = GIT_CVAR_FALSE,
 } git_cvar_value;
 
 /* internal repository init flags */
@@ -120,8 +126,11 @@ struct git_repository {
 	char *path_repository;
 	char *workdir;
 	char *namespace;
+	char *name_8dot3;
 
-	unsigned is_bare:1;
+	unsigned is_bare:1,
+		has_8dot3:1,
+		has_8dot3_default:1;
 	unsigned int lru_counter;
 
 	git_cvar_value cvar_cache[GIT_CVAR_CACHE_MAX];
@@ -172,4 +181,19 @@ GIT_INLINE(int) git_repository__ensure_not_bare(
 
 int git_repository__cleanup_files(git_repository *repo, const char *files[], size_t files_len);
 
+/*
+ * Gets the DOS-compatible 8.3 "short name".  This will return only the
+ * short name for the repository directory (ie, "git~1" for ".git").  This
+ * will always return a pointer to `git_repository__8dot3_default` when
+ * "GIT~1" is the short name.  This will return NULL for bare repositories,
+ * and systems that do not have a short name.
+ */
+const char *git_repository__8dot3_name(git_repository *repo);
+
+/* The default DOS-compatible 8.3 "short name" for a git repository,
+ * "GIT~1".
+ */
+extern const char *git_repository__8dot3_default;
+extern size_t git_repository__8dot3_default_len;
+
 #endif

data/vendor/libgit2/src/tree.c

@@ -55,7 +55,7 @@ static int valid_entry_name(const char *filename)
 		(*filename != '.' ||
 		 (strcmp(filename, ".") != 0 &&
 		  strcmp(filename, "..") != 0 &&
-		  strcmp(filename, DOT_GIT) != 0));
+		  strcasecmp(filename, DOT_GIT) != 0));
 }
 
 static int entry_sort_cmp(const void *a, const void *b)

data/vendor/libgit2/src/util.c

@@ -250,6 +250,21 @@ int git__prefixcmp_icase(const char *str, const char *prefix)
 	return strncasecmp(str, prefix, strlen(prefix));
 }
 
+int git__prefixncmp_icase(const char *str, size_t str_n, const char *prefix)
+{
+	int s, p;
+
+	while(str_n--) {
+		s = (unsigned char)tolower(*str++);
+		p = (unsigned char)tolower(*prefix++);
+
+		if (s != p)
+			return s - p;
+	}
+
+	return (0 - *prefix);
+}
+
 int git__suffixcmp(const char *str, const char *suffix)
 {
 	size_t a = strlen(str);
@@ -648,3 +663,79 @@ void git__insertsort_r(
 	if (freeswap)
 		git__free(swapel);
 }
+
+static const int8_t utf8proc_utf8class[256] = {
+	1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1,
+	1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1,
+	1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1,
+	1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1,
+	1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1,
+	1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1,
+	1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1,
+	1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1,
+	0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
+	0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
+	0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
+	0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
+	2, 2, 2, 2, 2, 2, 2, 2, 2, 2, 2, 2, 2, 2, 2, 2,
+	2, 2, 2, 2, 2, 2, 2, 2, 2, 2, 2, 2, 2, 2, 2, 2,
+	3, 3, 3, 3, 3, 3, 3, 3, 3, 3, 3, 3, 3, 3, 3, 3,
+	4, 4, 4, 4, 4, 4, 4, 4, 0, 0, 0, 0, 0, 0, 0, 0
+};
+
+int git__utf8_charlen(const uint8_t *str, int str_len)
+{
+	int length, i;
+
+	length = utf8proc_utf8class[str[0]];
+	if (!length)
+		return -1;
+
+	if (str_len >= 0 && length > str_len)
+		return -str_len;
+
+	for (i = 1; i < length; i++) {
+		if ((str[i] & 0xC0) != 0x80)
+			return -i;
+	}
+
+	return length;
+}
+
+int git__utf8_iterate(const uint8_t *str, int str_len, int32_t *dst)
+{
+	int length;
+	int32_t uc = -1;
+
+	*dst = -1;
+	length = git__utf8_charlen(str, str_len);
+	if (length < 0)
+		return -1;
+
+	switch (length) {
+		case 1:
+			uc = str[0];
+			break;
+		case 2:
+			uc = ((str[0] & 0x1F) <<  6) + (str[1] & 0x3F);
+			if (uc < 0x80) uc = -1;
+			break;
+		case 3:
+			uc = ((str[0] & 0x0F) << 12) + ((str[1] & 0x3F) <<  6)
+				+ (str[2] & 0x3F);
+			if (uc < 0x800 || (uc >= 0xD800 && uc < 0xE000) ||
+					(uc >= 0xFDD0 && uc < 0xFDF0)) uc = -1;
+			break;
+		case 4:
+			uc = ((str[0] & 0x07) << 18) + ((str[1] & 0x3F) << 12)
+				+ ((str[2] & 0x3F) <<  6) + (str[3] & 0x3F);
+			if (uc < 0x10000 || uc >= 0x110000) uc = -1;
+			break;
+	}
+
+	if (uc < 0 || ((uc & 0xFFFF) >= 0xFFFE))
+		return -1;
+
+	*dst = uc;
+	return length;
+}

data/vendor/libgit2/src/util.h

@@ -106,6 +106,7 @@ GIT_INLINE(void) git__free(void *ptr)
 
 extern int git__prefixcmp(const char *str, const char *prefix);
 extern int git__prefixcmp_icase(const char *str, const char *prefix);
+extern int git__prefixncmp_icase(const char *str, size_t str_n, const char *prefix);
 extern int git__suffixcmp(const char *str, const char *suffix);
 
 GIT_INLINE(int) git__signum(int val)
@@ -366,6 +367,17 @@ extern int git__date_rfc2822_fmt(char *out, size_t len, const git_time *date);
  */
 extern size_t git__unescape(char *str);
 
+/*
+ * Iterate through an UTF-8 string, yielding one
+ * codepoint at a time.
+ *
+ * @param str current position in the string
+ * @param str_len size left in the string; -1 if the string is NULL-terminated
+ * @param dst pointer where to store the current codepoint
+ * @return length in bytes of the read codepoint; -1 if the codepoint was invalid
+ */
+extern int git__utf8_iterate(const uint8_t *str, int str_len, int32_t *dst);
+
 /*
  * Safely zero-out memory, making sure that the compiler
  * doesn't optimize away the operation.

data/vendor/libgit2/src/win32/findfile.c

@@ -5,6 +5,7 @@
  * a Linking Exception. For full terms see the included COPYING file.
  */
 
+#include "path_w32.h"
 #include "utf-conv.h"
 #include "path.h"
 #include "findfile.h"

data/vendor/libgit2/src/win32/path_w32.c

@@ -0,0 +1,305 @@
+/*
+ * Copyright (C) the libgit2 contributors. All rights reserved.
+ *
+ * This file is part of libgit2, distributed under the GNU GPL v2 with
+ * a Linking Exception. For full terms see the included COPYING file.
+ */
+
+#include "common.h"
+#include "path.h"
+#include "path_w32.h"
+#include "utf-conv.h"
+
+#define PATH__NT_NAMESPACE     L"\\\\?\\"
+#define PATH__NT_NAMESPACE_LEN 4
+
+#define PATH__ABSOLUTE_LEN     3
+
+#define path__is_dirsep(p) ((p) == '/' || (p) == '\\')
+
+#define path__is_absolute(p) \
+	(git__isalpha((p)[0]) && (p)[1] == ':' && ((p)[2] == '\\' || (p)[2] == '/'))
+
+#define path__is_nt_namespace(p) \
+	(((p)[0] == '\\' && (p)[1] == '\\' && (p)[2] == '?' && (p)[3] == '\\') || \
+	 ((p)[0] == '/' && (p)[1] == '/' && (p)[2] == '?' && (p)[3] == '/'))
+
+#define path__is_unc(p) \
+	(((p)[0] == '\\' && (p)[1] == '\\') || ((p)[0] == '/' && (p)[1] == '/'))
+
+GIT_INLINE(int) path__cwd(wchar_t *path, int size)
+{
+	int len;
+
+	if ((len = GetCurrentDirectoryW(size, path)) == 0) {
+		errno = GetLastError() == ERROR_ACCESS_DENIED ? EACCES : ENOENT;
+		return -1;
+	} else if (len > size) {
+		errno = ENAMETOOLONG;
+		return -1;
+	}
+
+	/* The Win32 APIs may return "\\?\" once you've used it first.
+	 * But it may not.  What a gloriously predictible API!
+	 */
+	if (wcsncmp(path, PATH__NT_NAMESPACE, PATH__NT_NAMESPACE_LEN))
+		return len;
+
+	len -= PATH__NT_NAMESPACE_LEN;
+
+	memmove(path, path + PATH__NT_NAMESPACE_LEN, sizeof(wchar_t) * len);
+	return len;
+}
+
+static wchar_t *path__skip_server(wchar_t *path)
+{
+	wchar_t *c;
+
+	for (c = path; *c; c++) {
+		if (path__is_dirsep(*c))
+			return c + 1;
+	}
+
+	return c;
+}
+
+static wchar_t *path__skip_prefix(wchar_t *path)
+{
+	if (path__is_nt_namespace(path)) {
+		path += PATH__NT_NAMESPACE_LEN;
+
+		if (wcsncmp(path, L"UNC\\", 4) == 0)
+			path = path__skip_server(path + 4);
+		else if (path__is_absolute(path))
+			path += PATH__ABSOLUTE_LEN;
+	} else if (path__is_absolute(path)) {
+		path += PATH__ABSOLUTE_LEN;
+	} else if (path__is_unc(path)) {
+		path = path__skip_server(path + 2);
+	}
+
+	return path;
+}
+
+int git_win32_path_canonicalize(git_win32_path path)
+{
+	wchar_t *base, *from, *to, *next;
+	size_t len;
+
+	base = to = path__skip_prefix(path);
+
+	/* Unposixify if the prefix */
+	for (from = path; from < to; from++) {
+		if (*from == L'/')
+			*from = L'\\';
+	}
+
+	while (*from) {
+		for (next = from; *next; ++next) {
+			if (*next == L'/') {
+				*next = L'\\';
+				break;
+			}
+
+			if (*next == L'\\')
+				break;
+		}
+
+		len = next - from;
+
+		if (len == 1 && from[0] == L'.')
+			/* do nothing with singleton dot */;
+
+		else if (len == 2 && from[0] == L'.' && from[1] == L'.') {
+			if (to == base) {
+				/* no more path segments to strip, eat the "../" */
+				if (*next == L'\\')
+					len++;
+
+				base = to;
+			} else {
+				/* back up a path segment */
+				while (to > base && to[-1] == L'\\') to--;
+				while (to > base && to[-1] != L'\\') to--;
+			}
+		} else {
+			if (*next == L'\\' && *from != L'\\')
+				len++;
+
+			if (to != from)
+				memmove(to, from, sizeof(wchar_t) * len);
+
+			to += len;
+		}
+
+		from += len;
+
+		while (*from == L'\\') from++;
+	}
+
+	/* Strip trailing backslashes */
+	while (to > base && to[-1] == L'\\') to--;
+
+	*to = L'\0';
+
+	return (to - path);
+}
+
+int git_win32_path__cwd(wchar_t *out, size_t len)
+{
+	int cwd_len;
+
+	if ((cwd_len = path__cwd(out, len)) < 0)
+		return -1;
+
+	/* UNC paths */
+	if (wcsncmp(L"\\\\", out, 2) == 0) {
+		/* Our buffer must be at least 5 characters larger than the
+		 * current working directory:  we swallow one of the leading
+		 * '\'s, but we we add a 'UNC' specifier to the path, plus
+		 * a trailing directory separator, plus a NUL.
+		 */
+		if (cwd_len > MAX_PATH - 4) {
+			errno = ENAMETOOLONG;
+			return -1;
+		}
+
+		memmove(out+2, out, sizeof(wchar_t) * cwd_len);
+		out[0] = L'U';
+		out[1] = L'N';
+		out[2] = L'C';
+
+		cwd_len += 2;
+	}
+
+	/* Our buffer must be at least 2 characters larger than the current
+	 * working directory.  (One character for the directory separator,
+	 * one for the null.
+	 */
+	else if (cwd_len > MAX_PATH - 2) {
+		errno = ENAMETOOLONG;
+		return -1;
+	}
+
+	return cwd_len;
+}
+
+int git_win32_path_from_utf8(git_win32_path out, const char *src)
+{
+	wchar_t *dest = out;
+
+	/* All win32 paths are in NT-prefixed format, beginning with "\\?\". */
+	memcpy(dest, PATH__NT_NAMESPACE, sizeof(wchar_t) * PATH__NT_NAMESPACE_LEN);
+	dest += PATH__NT_NAMESPACE_LEN;
+
+	/* See if this is an absolute path (beginning with a drive letter) */
+	if (path__is_absolute(src)) {
+		if (git__utf8_to_16(dest, MAX_PATH, src) < 0)
+			return -1;
+	}
+	/* File-prefixed NT-style paths beginning with \\?\ */
+	else if (path__is_nt_namespace(src)) {
+		/* Skip the NT prefix, the destination already contains it */
+		if (git__utf8_to_16(dest, MAX_PATH, src + PATH__NT_NAMESPACE_LEN) < 0)
+			return -1;
+	}
+	/* UNC paths */
+	else if (path__is_unc(src)) {
+		memcpy(dest, L"UNC\\", sizeof(wchar_t) * 4);
+		dest += 4;
+
+		/* Skip the leading "\\" */
+		if (git__utf8_to_16(dest, MAX_PATH - 2, src + 2) < 0)
+			return -1;
+	}
+	/* Absolute paths omitting the drive letter */
+	else if (src[0] == '\\' || src[0] == '/') {
+		if (path__cwd(dest, MAX_PATH) < 0)
+			return -1;
+
+		if (!path__is_absolute(dest)) {
+			errno = ENOENT;
+			return -1;
+		}
+
+		/* Skip the drive letter specification ("C:") */	
+		if (git__utf8_to_16(dest + 2, MAX_PATH - 2, src) < 0)
+			return -1;
+	}
+	/* Relative paths */
+	else {
+		int cwd_len;
+
+		if ((cwd_len = git_win32_path__cwd(dest, MAX_PATH)) < 0)
+			return -1;
+
+		dest[cwd_len++] = L'\\';
+
+		if (git__utf8_to_16(dest + cwd_len, MAX_PATH - cwd_len, src) < 0)
+			return -1;
+	}
+
+	return git_win32_path_canonicalize(out);
+}
+
+int git_win32_path_to_utf8(git_win32_utf8_path dest, const wchar_t *src)
+{
+	char *out = dest;
+	int len;
+
+	/* Strip NT namespacing "\\?\" */
+	if (path__is_nt_namespace(src)) {
+		src += 4;
+
+		/* "\\?\UNC\server\share" -> "\\server\share" */
+		if (wcsncmp(src, L"UNC\\", 4) == 0) {
+			src += 4;
+
+			memcpy(dest, "\\\\", 2);
+			out = dest + 2;
+		}
+	}
+
+	if ((len = git__utf16_to_8(out, GIT_WIN_PATH_UTF8, src)) < 0)
+		return len;
+
+	git_path_mkposix(dest);
+
+	return len;
+}
+
+char *git_win32_path_8dot3_name(const char *path)
+{
+	git_win32_path longpath, shortpath;
+	wchar_t *start;
+	char *shortname;
+	int len, namelen = 1;
+
+	if (git_win32_path_from_utf8(longpath, path) < 0)
+		return NULL;
+
+	len = GetShortPathNameW(longpath, shortpath, GIT_WIN_PATH_UTF16);
+
+	while (len && shortpath[len-1] == L'\\')
+		shortpath[--len] = L'\0';
+
+	if (len == 0 || len >= GIT_WIN_PATH_UTF16)
+		return NULL;
+
+	for (start = shortpath + (len - 1);
+		start > shortpath && *(start-1) != '/' && *(start-1) != '\\';
+		start--)
+		namelen++;
+
+	/* We may not have actually been given a short name.  But if we have,
+	 * it will be in the ASCII byte range, so we don't need to worry about
+	 * multi-byte sequences and can allocate naively.
+	 */
+	if (namelen > 12 || (shortname = git__malloc(namelen + 1)) == NULL)
+		return NULL;
+
+	if ((len = git__utf16_to_8(shortname, namelen + 1, start)) < 0)
+		return NULL;
+
+	return shortname;
+}