rugged 0.27.7 → 0.27.10

data/vendor/libgit2/src/path.c

@@ -14,13 +14,36 @@
 #include "win32/w32_buffer.h"
 #include "win32/w32_util.h"
 #include "win32/version.h"
+#include <aclapi.h>
 #else
 #include <dirent.h>
 #endif
 #include <stdio.h>
 #include <ctype.h>
 
-#define LOOKS_LIKE_DRIVE_PREFIX(S) (git__isalpha((S)[0]) && (S)[1] == ':')
+static int dos_drive_prefix_length(const char *path)
+{
+	int i;
+
+	/*
+	 * Does it start with an ASCII letter (i.e. highest bit not set),
+	 * followed by a colon?
+	 */
+	if (!(0x80 & (unsigned char)*path))
+		return *path && path[1] == ':' ? 2 : 0;
+
+	/*
+	 * While drive letters must be letters of the English alphabet, it is
+	 * possible to assign virtually _any_ Unicode character via `subst` as
+	 * a drive letter to "virtual drives". Even `1`, or `ä`. Or fun stuff
+	 * like this:
+	 *
+	 *	subst ֍: %USERPROFILE%\Desktop
+	 */
+	for (i = 1; i < 4 && (0x80 & (unsigned char)path[i]); i++)
+		; /* skip first UTF-8 character */
+	return path[i] == ':' ? i + 1 : 0;
+}
 
 #ifdef GIT_WIN32
 static bool looks_like_network_computer_name(const char *path, int pos)
@@ -122,11 +145,11 @@ static int win32_prefix_length(const char *path, int len)
 	GIT_UNUSED(len);
 #else
 	/*
-	 * Mimic unix behavior where '/.git' returns '/': 'C:/.git' will return
-	 * 'C:/' here
+	 * Mimic unix behavior where '/.git' returns '/': 'C:/.git'
+	 * will return 'C:/' here
 	 */
-	if (len == 2 && LOOKS_LIKE_DRIVE_PREFIX(path))
-		return 2;
+	if (dos_drive_prefix_length(path) == len)
+		return len;
 
 	/*
 	 * Similarly checks if we're dealing with a network computer name
@@ -160,7 +183,13 @@ int git_path_dirname_r(git_buf *buffer, const char *path)
 	while (endp > path && *endp == '/')
 		endp--;
 
-	if ((len = win32_prefix_length(path, endp - path + 1)) > 0) {
+	if (endp - path + 1 > INT_MAX) {
+		git_error_set(GIT_ERROR_INVALID, "path too long");
+		len = -1;
+		goto Exit;
+	}
+
+	if ((len = win32_prefix_length(path, (int)(endp - path + 1))) > 0) {
 		is_prefix = 1;
 		goto Exit;
 	}
@@ -180,7 +209,13 @@ int git_path_dirname_r(git_buf *buffer, const char *path)
 		endp--;
 	} while (endp > path && *endp == '/');
 
-	if ((len = win32_prefix_length(path, endp - path + 1)) > 0) {
+	if (endp - path + 1 > INT_MAX) {
+		git_error_set(GIT_ERROR_INVALID, "path too long");
+		len = -1;
+		goto Exit;
+	}
+
+	if ((len = win32_prefix_length(path, (int)(endp - path + 1))) > 0) {
 		is_prefix = 1;
 		goto Exit;
 	}
@@ -259,11 +294,11 @@ const char *git_path_topdir(const char *path)
 
 int git_path_root(const char *path)
 {
-	int offset = 0;
+	int offset = 0, prefix_len;
 
 	/* Does the root of the path look like a windows drive ? */
-	if (LOOKS_LIKE_DRIVE_PREFIX(path))
-		offset += 2;
+	if ((prefix_len = dos_drive_prefix_length(path)))
+		offset += prefix_len;
 
 #ifdef GIT_WIN32
 	/* Are we dealing with a windows network path? */
@@ -276,9 +311,12 @@ int git_path_root(const char *path)
 		while (path[offset] && path[offset] != '/' && path[offset] != '\\')
 			offset++;
 	}
+
+	if (path[offset] == '\\')
+		return offset;
 #endif
 
-	if (path[offset] == '/' || path[offset] == '\\')
+	if (path[offset] == '/')
 		return offset;
 
 	return -1;	/* Not a real error - signals that path is not rooted */
@@ -361,9 +399,9 @@ int git_path_prettify(git_buf *path_out, const char *path, const char *base)
 	}
 
 	if (p_realpath(path, buf) == NULL) {
-		/* giterr_set resets the errno when dealing with a GITERR_OS kind of error */
+		/* git_error_set resets the errno when dealing with a GIT_ERROR_OS kind of error */
 		int error = (errno == ENOENT || errno == ENOTDIR) ? GIT_ENOTFOUND : -1;
-		giterr_set(GITERR_OS, "failed to resolve path '%s'", path);
+		git_error_set(GIT_ERROR_OS, "failed to resolve path '%s'", path);
 
 		git_buf_clear(path_out);
 
@@ -436,7 +474,7 @@ append:
 
 static int error_invalid_local_file_uri(const char *uri)
 {
-	giterr_set(GITERR_CONFIG, "'%s' is not a valid local file URI", uri);
+	git_error_set(GIT_ERROR_CONFIG, "'%s' is not a valid local file URI", uri);
 	return -1;
 }
 
@@ -502,7 +540,7 @@ int git_path_walk_up(
 	if (!scan) {
 		error = cb(data, "");
 		if (error)
-			giterr_set_after_callback(error);
+			git_error_set_after_callback(error);
 		return error;
 	}
 
@@ -515,7 +553,7 @@ int git_path_walk_up(
 		iter.ptr[scan] = oldc;
 
 		if (error) {
-			giterr_set_after_callback(error);
+			git_error_set_after_callback(error);
 			break;
 		}
 
@@ -535,7 +573,7 @@ int git_path_walk_up(
 	if (!error && stop == 0 && iter.ptr[0] != '/') {
 		error = cb(data, "");
 		if (error)
-			giterr_set_after_callback(error);
+			git_error_set_after_callback(error);
 	}
 
 	return error;
@@ -638,7 +676,7 @@ bool git_path_is_empty_dir(const char *path)
 		return false;
 
 	if ((error = git_buf_sets(&dir, path)) != 0)
-		giterr_clear();
+		git_error_clear();
 	else
 		error = git_path_direach(&dir, 0, path_found_entry, NULL);
 
@@ -654,24 +692,24 @@ int git_path_set_error(int errno_value, const char *path, const char *action)
 	switch (errno_value) {
 	case ENOENT:
 	case ENOTDIR:
-		giterr_set(GITERR_OS, "could not find '%s' to %s", path, action);
+		git_error_set(GIT_ERROR_OS, "could not find '%s' to %s", path, action);
 		return GIT_ENOTFOUND;
 
 	case EINVAL:
 	case ENAMETOOLONG:
-		giterr_set(GITERR_OS, "invalid path for filesystem '%s'", path);
+		git_error_set(GIT_ERROR_OS, "invalid path for filesystem '%s'", path);
 		return GIT_EINVALIDSPEC;
 
 	case EEXIST:
-		giterr_set(GITERR_OS, "failed %s - '%s' already exists", action, path);
+		git_error_set(GIT_ERROR_OS, "failed %s - '%s' already exists", action, path);
 		return GIT_EEXISTS;
 
 	case EACCES:
-		giterr_set(GITERR_OS, "failed %s - '%s' is locked", action, path);
+		git_error_set(GIT_ERROR_OS, "failed %s - '%s' is locked", action, path);
 		return GIT_ELOCKED;
 
 	default:
-		giterr_set(GITERR_OS, "could not %s '%s'", action, path);
+		git_error_set(GIT_ERROR_OS, "could not %s '%s'", action, path);
 		return -1;
 	}
 }
@@ -751,7 +789,7 @@ int git_path_resolve_relative(git_buf *path, size_t ceiling)
 	char *base, *to, *from, *next;
 	size_t len;
 
-	GITERR_CHECK_ALLOC_BUF(path);
+	GIT_ERROR_CHECK_ALLOC_BUF(path);
 
 	if (ceiling > path->size)
 		ceiling = path->size;
@@ -780,7 +818,7 @@ int git_path_resolve_relative(git_buf *path, size_t ceiling)
 		else if (len == 2 && from[0] == '.' && from[1] == '.') {
 			/* error out if trying to up one from a hard base */
 			if (to == base && ceiling != 0) {
-				giterr_set(GITERR_INVALID,
+				git_error_set(GIT_ERROR_INVALID,
 					"cannot strip root component off url");
 				return -1;
 			}
@@ -887,7 +925,7 @@ int git_path_make_relative(git_buf *path, const char *parent)
 	/* need at least 1 common path segment */
 	if ((p_dirsep == path->ptr || q_dirsep == parent) &&
 		(*p_dirsep != '/' || *q_dirsep != '/')) {
-		giterr_set(GITERR_INVALID,
+		git_error_set(GIT_ERROR_INVALID,
 			"%s is not a parent of %s", parent, path->ptr);
 		return GIT_ENOTFOUND;
 	}
@@ -911,10 +949,10 @@ int git_path_make_relative(git_buf *path, const char *parent)
 	for (; (q = strchr(q, '/')) && *(q + 1); q++)
 		depth++;
 
-	GITERR_CHECK_ALLOC_MULTIPLY(&newlen, depth, 3);
-	GITERR_CHECK_ALLOC_ADD(&newlen, newlen, plen);
+	GIT_ERROR_CHECK_ALLOC_MULTIPLY(&newlen, depth, 3);
+	GIT_ERROR_CHECK_ALLOC_ADD(&newlen, newlen, plen);
 
-	GITERR_CHECK_ALLOC_ADD(&alloclen, newlen, 1);
+	GIT_ERROR_CHECK_ALLOC_ADD(&alloclen, newlen, 1);
 
 	/* save the offset as we might realllocate the pointer */
 	offset = p - path->ptr;
@@ -973,7 +1011,7 @@ int git_path_iconv(git_path_iconv_t *ic, const char **in, size_t *inlen)
 	git_buf_clear(&ic->buf);
 
 	while (1) {
-		GITERR_CHECK_ALLOC_ADD(&alloclen, wantlen, 1);
+		GIT_ERROR_CHECK_ALLOC_ADD(&alloclen, wantlen, 1);
 		if (git_buf_grow(&ic->buf, alloclen) < 0)
 			return -1;
 
@@ -1010,7 +1048,7 @@ int git_path_iconv(git_path_iconv_t *ic, const char **in, size_t *inlen)
 	return 0;
 
 fail:
-	giterr_set(GITERR_OS, "unable to convert unicode path data");
+	git_error_set(GIT_ERROR_OS, "unable to convert unicode path data");
 	return -1;
 }
 
@@ -1103,7 +1141,7 @@ int git_path_direach(
 	wd_len = git_buf_len(path);
 
 	if ((dir = opendir(path->ptr)) == NULL) {
-		giterr_set(GITERR_OS, "failed to open directory '%s'", path->ptr);
+		git_error_set(GIT_ERROR_OS, "failed to open directory '%s'", path->ptr);
 		if (errno == ENOENT)
 			return GIT_ENOTFOUND;
 
@@ -1130,15 +1168,15 @@ int git_path_direach(
 		if ((error = git_buf_put(path, de_path, de_len)) < 0)
 			break;
 
-		giterr_clear();
+		git_error_clear();
 		error = fn(arg, path);
 
 		git_buf_truncate(path, wd_len); /* restore path */
 
 		/* Only set our own error if the callback did not set one already */
 		if (error != 0) {
-			if (!giterr_last())
-				giterr_set_after_callback(error);
+			if (!git_error_last())
+				git_error_set_after_callback(error);
 
 			break;
 		}
@@ -1184,13 +1222,13 @@ int git_path_diriter_init(
 	git_path_trim_slashes(&diriter->path_utf8);
 
 	if (diriter->path_utf8.size == 0) {
-		giterr_set(GITERR_FILESYSTEM, "could not open directory '%s'", path);
+		git_error_set(GIT_ERROR_FILESYSTEM, "could not open directory '%s'", path);
 		return -1;
 	}
 
 	if ((diriter->parent_len = git_win32_path_from_utf8(diriter->path, diriter->path_utf8.ptr)) < 0 ||
 			!git_win32__findfirstfile_filter(path_filter, diriter->path_utf8.ptr)) {
-		giterr_set(GITERR_OS, "could not parse the directory path '%s'", path);
+		git_error_set(GIT_ERROR_OS, "could not parse the directory path '%s'", path);
 		return -1;
 	}
 
@@ -1203,7 +1241,7 @@ int git_path_diriter_init(
 		is_win7_or_later ? FIND_FIRST_EX_LARGE_FETCH : 0);
 
 	if (diriter->handle == INVALID_HANDLE_VALUE) {
-		giterr_set(GITERR_OS, "could not open directory '%s'", path);
+		git_error_set(GIT_ERROR_OS, "could not open directory '%s'", path);
 		return -1;
 	}
 
@@ -1223,7 +1261,7 @@ static int diriter_update_paths(git_path_diriter *diriter)
 		return -1;
 
 	if (path_len > GIT_WIN_PATH_UTF16) {
-		giterr_set(GITERR_FILESYSTEM,
+		git_error_set(GIT_ERROR_FILESYSTEM,
 			"invalid path '%.*ls\\%ls' (path too long)",
 			diriter->parent_len, diriter->path, diriter->current.cFileName);
 		return -1;
@@ -1333,14 +1371,14 @@ int git_path_diriter_init(
 	git_path_trim_slashes(&diriter->path);
 
 	if (diriter->path.size == 0) {
-		giterr_set(GITERR_FILESYSTEM, "could not open directory '%s'", path);
+		git_error_set(GIT_ERROR_FILESYSTEM, "could not open directory '%s'", path);
 		return -1;
 	}
 
 	if ((diriter->dir = opendir(diriter->path.ptr)) == NULL) {
 		git_buf_dispose(&diriter->path);
 
-		giterr_set(GITERR_OS, "failed to open directory '%s'", path);
+		git_error_set(GIT_ERROR_OS, "failed to open directory '%s'", path);
 		return -1;
 	}
 
@@ -1372,7 +1410,7 @@ int git_path_diriter_next(git_path_diriter *diriter)
 			if (!errno)
 				return GIT_ITEROVER;
 
-			giterr_set(GITERR_OS,
+			git_error_set(GIT_ERROR_OS,
 				"could not read directory '%s'", diriter->path.ptr);
 			return -1;
 		}
@@ -1477,7 +1515,7 @@ int git_path_dirload(
 		assert(name_len > prefix_len);
 
 		dup = git__strndup(name + prefix_len, name_len - prefix_len);
-		GITERR_CHECK_ALLOC(dup);
+		GIT_ERROR_CHECK_ALLOC(dup);
 
 		if ((error = git_vector_insert(contents, dup)) < 0)
 			break;
@@ -1608,8 +1646,12 @@ GIT_INLINE(bool) verify_dotgit_ntfs(git_repository *repo, const char *path, size
 	if (!start)
 		return true;
 
-	/* Reject paths like ".git\" */
-	if (path[start] == '\\')
+	/*
+	 * Reject paths that start with Windows-style directory separators
+	 * (".git\") or NTFS alternate streams (".git:") and could be used
+	 * to write to the ".git" directory on Windows platforms.
+	 */
+	if (path[start] == '\\' || path[start] == ':')
 		return false;
 
 	/* Reject paths like '.git ' or '.git.' */
@@ -1621,12 +1663,21 @@ GIT_INLINE(bool) verify_dotgit_ntfs(git_repository *repo, const char *path, size
 	return false;
 }
 
-GIT_INLINE(bool) only_spaces_and_dots(const char *path)
+/*
+ * Windows paths that end with spaces and/or dots are elided to the
+ * path without them for backward compatibility.  That is to say
+ * that opening file "foo ", "foo." or even "foo . . ." will all
+ * map to a filename of "foo".  This function identifies spaces and
+ * dots at the end of a filename, whether the proper end of the
+ * filename (end of string) or a colon (which would indicate a
+ * Windows alternate data stream.)
+ */
+GIT_INLINE(bool) ntfs_end_of_filename(const char *path)
 {
 	const char *c = path;
 
 	for (;; c++) {
-		if (*c == '\0')
+		if (*c == '\0' || *c == ':')
 			return true;
 		if (*c != ' ' && *c != '.')
 			return false;
@@ -1641,13 +1692,13 @@ GIT_INLINE(bool) verify_dotgit_ntfs_generic(const char *name, size_t len, const
 
 	if (name[0] == '.' && len >= dotgit_len &&
 	    !strncasecmp(name + 1, dotgit_name, dotgit_len)) {
-		return !only_spaces_and_dots(name + dotgit_len + 1);
+		return !ntfs_end_of_filename(name + dotgit_len + 1);
 	}
 
 	/* Detect the basic NTFS shortname with the first six chars */
 	if (!strncasecmp(name, dotgit_name, 6) && name[6] == '~' &&
 	    name[7] >= '1' && name[7] <= '4')
-		return !only_spaces_and_dots(name + 8);
+		return !ntfs_end_of_filename(name + 8);
 
 	/* Catch fallback names */
 	for (i = 0, saw_tilde = 0; i < 8; i++) {
@@ -1662,14 +1713,14 @@ GIT_INLINE(bool) verify_dotgit_ntfs_generic(const char *name, size_t len, const
 			saw_tilde = 1;
 		} else if (i >= 6) {
 			return true;
-		} else if (name[i] < 0) {
+		} else if ((unsigned char)name[i] > 127) {
 			return true;
 		} else if (git__tolower(name[i]) != shortname_pfix[i]) {
 			return true;
 		}
 	}
 
-	return !only_spaces_and_dots(name + i);
+	return !ntfs_end_of_filename(name + i);
 }
 
 GIT_INLINE(bool) verify_char(unsigned char c, unsigned int flags)
@@ -1803,7 +1854,7 @@ GIT_INLINE(unsigned int) dotgit_flags(
 	git_repository *repo,
 	unsigned int flags)
 {
-	int protectHFS = 0, protectNTFS = 0;
+	int protectHFS = 0, protectNTFS = 1;
 	int error = 0;
 
 	flags |= GIT_PATH_REJECT_DOT_GIT_LITERAL;
@@ -1812,17 +1863,13 @@ GIT_INLINE(unsigned int) dotgit_flags(
 	protectHFS = 1;
 #endif
 
-#ifdef GIT_WIN32
-	protectNTFS = 1;
-#endif
-
 	if (repo && !protectHFS)
-		error = git_repository__cvar(&protectHFS, repo, GIT_CVAR_PROTECTHFS);
+		error = git_repository__configmap_lookup(&protectHFS, repo, GIT_CONFIGMAP_PROTECTHFS);
 	if (!error && protectHFS)
 		flags |= GIT_PATH_REJECT_DOT_GIT_HFS;
 
-	if (repo && !protectNTFS)
-		error = git_repository__cvar(&protectNTFS, repo, GIT_CVAR_PROTECTNTFS);
+	if (repo)
+		error = git_repository__configmap_lookup(&protectNTFS, repo, GIT_CONFIGMAP_PROTECTNTFS);
 	if (!error && protectNTFS)
 		flags |= GIT_PATH_REJECT_DOT_GIT_NTFS;
 
@@ -1887,8 +1934,8 @@ extern int git_path_is_gitfile(const char *path, size_t pathlen, git_path_gitfil
 	const char *file, *hash;
 	size_t filelen;
 
-	if (gitfile < 0 && gitfile >= ARRAY_SIZE(gitfiles)) {
-		giterr_set(GITERR_OS, "invalid gitfile for path validation");
+	if (!(gitfile >= GIT_PATH_GITFILE_GITIGNORE && gitfile < ARRAY_SIZE(gitfiles))) {
+		git_error_set(GIT_ERROR_OS, "invalid gitfile for path validation");
 		return -1;
 	}
 
@@ -1905,7 +1952,105 @@ extern int git_path_is_gitfile(const char *path, size_t pathlen, git_path_gitfil
 	case GIT_PATH_FS_HFS:
 		return !verify_dotgit_hfs_generic(path, pathlen, file, filelen);
 	default:
-		giterr_set(GITERR_OS, "invalid filesystem for path validation");
+		git_error_set(GIT_ERROR_OS, "invalid filesystem for path validation");
+		return -1;
+	}
+}
+
+bool git_path_supports_symlinks(const char *dir)
+{
+	git_buf path = GIT_BUF_INIT;
+	bool supported = false;
+	struct stat st;
+	int fd;
+
+	if ((fd = git_futils_mktmp(&path, dir, 0666)) < 0 ||
+	    p_close(fd) < 0 ||
+	    p_unlink(path.ptr) < 0 ||
+	    p_symlink("testing", path.ptr) < 0 ||
+	    p_lstat(path.ptr, &st) < 0)
+		goto done;
+
+	supported = (S_ISLNK(st.st_mode) != 0);
+done:
+	if (path.size)
+		(void)p_unlink(path.ptr);
+	git_buf_dispose(&path);
+	return supported;
+}
+
+int git_path_validate_system_file_ownership(const char *path)
+{
+#ifndef GIT_WIN32
+	GIT_UNUSED(path);
+	return GIT_OK;
+#else
+	git_win32_path buf;
+	PSID owner_sid;
+	PSECURITY_DESCRIPTOR descriptor = NULL;
+	HANDLE token;
+	TOKEN_USER *info = NULL;
+	DWORD err, len;
+	int ret;
+
+	if (git_win32_path_from_utf8(buf, path) < 0)
 		return -1;
+
+	err = GetNamedSecurityInfoW(buf, SE_FILE_OBJECT,
+				    OWNER_SECURITY_INFORMATION |
+					    DACL_SECURITY_INFORMATION,
+				    &owner_sid, NULL, NULL, NULL, &descriptor);
+
+	if (err == ERROR_FILE_NOT_FOUND || err == ERROR_PATH_NOT_FOUND) {
+		ret = GIT_ENOTFOUND;
+		goto cleanup;
+	}
+
+	if (err != ERROR_SUCCESS) {
+		git_error_set(GIT_ERROR_OS, "failed to get security information");
+		ret = GIT_ERROR;
+		goto cleanup;
+	}
+
+	if (!IsValidSid(owner_sid)) {
+		git_error_set(GIT_ERROR_INVALID, "programdata configuration file owner is unknown");
+		ret = GIT_ERROR;
+		goto cleanup;
+	}
+
+	if (IsWellKnownSid(owner_sid, WinBuiltinAdministratorsSid) ||
+	    IsWellKnownSid(owner_sid, WinLocalSystemSid)) {
+		ret = GIT_OK;
+		goto cleanup;
+	}
+
+	/* Obtain current user's SID */
+	if (OpenProcessToken(GetCurrentProcess(), TOKEN_QUERY, &token) &&
+	    !GetTokenInformation(token, TokenUser, NULL, 0, &len)) {
+		info = git__malloc(len);
+		GIT_ERROR_CHECK_ALLOC(info);
+		if (!GetTokenInformation(token, TokenUser, info, len, &len)) {
+			git__free(info);
+			info = NULL;
+		}
 	}
+
+	/*
+	 * If the file is owned by the same account that is running the current
+	 * process, it's okay to read from that file.
+	 */
+	if (info && EqualSid(owner_sid, info->User.Sid))
+		ret = GIT_OK;
+	else {
+		git_error_set(GIT_ERROR_INVALID, "programdata configuration file owner is not valid");
+		ret = GIT_ERROR;
+	}
+	free(info);
+
+cleanup:
+	if (descriptor)
+		LocalFree(descriptor);
+
+	return ret;
+#endif
 }

data/vendor/libgit2/src/path.h

@@ -647,4 +647,18 @@ extern bool git_path_isvalid(
  */
 int git_path_normalize_slashes(git_buf *out, const char *path);
 
+bool git_path_supports_symlinks(const char *dir);
+
+/**
+ * Validate a system file's ownership
+ *
+ * Verify that the file in question is owned by an administrator or system
+ * account, or at least by the current user.
+ *
+ * This function returns 0 if successful. If the file is not owned by any of
+ * these, or any other if there have been problems determining the file
+ * ownership, it returns -1.
+ */
+int git_path_validate_system_file_ownership(const char *path);
+
 #endif