isomorphic-git 1.42.1 → 1.42.3

package/managers/index.cjs

@@ -7,6 +7,7 @@ function _interopDefault (ex) { return (ex && (typeof ex === 'object') && 'defau
 var ignore = _interopDefault(require('ignore'));
 var Hash = _interopDefault(require('sha.js/sha1.js'));
 var AsyncLock = _interopDefault(require('async-lock'));
+var cleanGitRef = _interopDefault(require('clean-git-ref'));
 var crc32 = _interopDefault(require('crc-32'));
 var pako = _interopDefault(require('pako'));
 var crypto$1 = require('crypto');
@@ -1883,6 +1884,22 @@ function compareRefNames(a, b) {
   return tmp
 }
 
+/*
+Adapted from is-git-ref-name-valid
+SPDX-License-Identifier: MIT
+Copyright © Vincent Weevers
+*/
+
+// eslint-disable-next-line no-control-regex
+const bad = /(^|[/.])([/.]|$)|^@$|@{|[\x00-\x20\x7f~^:?*[\\]|\.lock(\/|$)/;
+
+function isValidRef(name, onelevel) {
+  if (typeof name !== 'string')
+    throw new TypeError('Reference name must be a string')
+
+  return !bad.test(name) && (!!onelevel || name.includes('/'))
+}
+
 // @see https://git-scm.com/docs/git-rev-parse.html#_specifying_revisions
 const refpaths = ref => [
   `${ref}`,
@@ -1904,6 +1921,13 @@ function assertWritableRef(ref) {
   if (GIT_FILES.includes(ref)) {
     throw new InvalidRefNameError(ref, `refs/heads/${ref}`)
   }
+  // A ref name is joined onto gitdir with `join()`, which collapses `..`
+  // exactly like `path.join`. A server-supplied ref/tag name or the wildcard
+  // capture of a refspec can therefore climb out of gitdir, or anywhere
+  // beneath it, entirely unvalidated up to this point. See GHSA-h3c3-jh3g-8hcc.
+  if (!isValidRef(ref, true)) {
+    throw new InvalidRefNameError(ref, cleanGitRef.clean(ref))
+  }
 }
 
 /**
@@ -1963,21 +1987,39 @@ class GitRefManager {
     ])) {
       const symtarget = refspec.translateOne(symrefs.get(serverRef));
       if (symtarget) {
+        // The destination (translatedRef) is validated below, but the target
+        // a symref points at is server-supplied too (the wire parser accepts
+        // `symref=HEAD:(.*)` unrestricted) and only ever passed through the
+        // refspec's plain string substitution, never checked. Left alone, a
+        // `..`-laden target is written into the file content as-is and later
+        // drives an out-of-gitdir read the next time something resolves it.
+        // See GHSA-h3c3-jh3g-8hcc.
+        assertWritableRef(symtarget);
         symrefTranslations.push([translatedRef, `ref: ${symtarget}`]);
       }
     }
+    // Tags aren't translated by a refspec, but they are still a server-supplied
+    // name written straight to gitdir below, so they need the same check.
+    // Computed here (pure, no I/O) so it can be validated up front and then
+    // reused unchanged in the write step further down.
+    const tagRefsToWrite = tags
+      ? [...refs.keys()].filter(
+          serverRef =>
+            serverRef.startsWith('refs/tags') && !serverRef.endsWith('^{}')
+        )
+      : [];
     // The local side of a refspec is whatever `remote.<name>.fetch` says, so a
     // config like `+refs/heads/main:index` lands a write on `.git/index`.
     // Refuse it here rather than at the write loop: `pruneTags` and `prune`
     // delete refs in between, so a later throw leaves the repository pruned
-    // and not updated. The tags added below are always `refs/tags/...`, which
-    // is never a system file, so nothing is missed by checking this early.
+    // and not updated.
     for (const [, translatedRef] of refTranslations) {
       assertWritableRef(translatedRef);
     }
     for (const [translatedRef] of symrefTranslations) {
       assertWritableRef(translatedRef);
     }
+    tagRefsToWrite.forEach(assertWritableRef);
     // Delete all current tags if the pruneTags argument is true.
     if (pruneTags) {
       const tags = await GitRefManager.listRefs({
@@ -1992,16 +2034,12 @@ class GitRefManager {
       });
     }
     // Add all tags if the fetch tags argument is true.
-    if (tags) {
-      for (const serverRef of refs.keys()) {
-        if (serverRef.startsWith('refs/tags') && !serverRef.endsWith('^{}')) {
-          // Git's behavior is to only fetch tags that do not conflict with tags already present.
-          if (!(await GitRefManager.exists({ fs, gitdir, ref: serverRef }))) {
-            // Always use the object id of the tag itself, and not the peeled object id.
-            const oid = refs.get(serverRef);
-            actualRefsToWrite.set(serverRef, oid);
-          }
-        }
+    for (const serverRef of tagRefsToWrite) {
+      // Git's behavior is to only fetch tags that do not conflict with tags already present.
+      if (!(await GitRefManager.exists({ fs, gitdir, ref: serverRef }))) {
+        // Always use the object id of the tag itself, and not the peeled object id.
+        const oid = refs.get(serverRef);
+        actualRefsToWrite.set(serverRef, oid);
       }
     }
     // Combine refs and symrefs giving symrefs priority

package/managers/index.js

@@ -1,6 +1,7 @@
 import ignore from 'ignore';
 import Hash from 'sha.js/sha1.js';
 import AsyncLock from 'async-lock';
+import cleanGitRef from 'clean-git-ref';
 import crc32 from 'crc-32';
 import pako from 'pako';
 
@@ -1876,6 +1877,22 @@ function compareRefNames(a, b) {
   return tmp
 }
 
+/*
+Adapted from is-git-ref-name-valid
+SPDX-License-Identifier: MIT
+Copyright © Vincent Weevers
+*/
+
+// eslint-disable-next-line no-control-regex
+const bad = /(^|[/.])([/.]|$)|^@$|@{|[\x00-\x20\x7f~^:?*[\\]|\.lock(\/|$)/;
+
+function isValidRef(name, onelevel) {
+  if (typeof name !== 'string')
+    throw new TypeError('Reference name must be a string')
+
+  return !bad.test(name) && (!!onelevel || name.includes('/'))
+}
+
 // @see https://git-scm.com/docs/git-rev-parse.html#_specifying_revisions
 const refpaths = ref => [
   `${ref}`,
@@ -1897,6 +1914,13 @@ function assertWritableRef(ref) {
   if (GIT_FILES.includes(ref)) {
     throw new InvalidRefNameError(ref, `refs/heads/${ref}`)
   }
+  // A ref name is joined onto gitdir with `join()`, which collapses `..`
+  // exactly like `path.join`. A server-supplied ref/tag name or the wildcard
+  // capture of a refspec can therefore climb out of gitdir, or anywhere
+  // beneath it, entirely unvalidated up to this point. See GHSA-h3c3-jh3g-8hcc.
+  if (!isValidRef(ref, true)) {
+    throw new InvalidRefNameError(ref, cleanGitRef.clean(ref))
+  }
 }
 
 /**
@@ -1956,21 +1980,39 @@ class GitRefManager {
     ])) {
       const symtarget = refspec.translateOne(symrefs.get(serverRef));
       if (symtarget) {
+        // The destination (translatedRef) is validated below, but the target
+        // a symref points at is server-supplied too (the wire parser accepts
+        // `symref=HEAD:(.*)` unrestricted) and only ever passed through the
+        // refspec's plain string substitution, never checked. Left alone, a
+        // `..`-laden target is written into the file content as-is and later
+        // drives an out-of-gitdir read the next time something resolves it.
+        // See GHSA-h3c3-jh3g-8hcc.
+        assertWritableRef(symtarget);
         symrefTranslations.push([translatedRef, `ref: ${symtarget}`]);
       }
     }
+    // Tags aren't translated by a refspec, but they are still a server-supplied
+    // name written straight to gitdir below, so they need the same check.
+    // Computed here (pure, no I/O) so it can be validated up front and then
+    // reused unchanged in the write step further down.
+    const tagRefsToWrite = tags
+      ? [...refs.keys()].filter(
+          serverRef =>
+            serverRef.startsWith('refs/tags') && !serverRef.endsWith('^{}')
+        )
+      : [];
     // The local side of a refspec is whatever `remote.<name>.fetch` says, so a
     // config like `+refs/heads/main:index` lands a write on `.git/index`.
     // Refuse it here rather than at the write loop: `pruneTags` and `prune`
     // delete refs in between, so a later throw leaves the repository pruned
-    // and not updated. The tags added below are always `refs/tags/...`, which
-    // is never a system file, so nothing is missed by checking this early.
+    // and not updated.
     for (const [, translatedRef] of refTranslations) {
       assertWritableRef(translatedRef);
     }
     for (const [translatedRef] of symrefTranslations) {
       assertWritableRef(translatedRef);
     }
+    tagRefsToWrite.forEach(assertWritableRef);
     // Delete all current tags if the pruneTags argument is true.
     if (pruneTags) {
       const tags = await GitRefManager.listRefs({
@@ -1985,16 +2027,12 @@ class GitRefManager {
       });
     }
     // Add all tags if the fetch tags argument is true.
-    if (tags) {
-      for (const serverRef of refs.keys()) {
-        if (serverRef.startsWith('refs/tags') && !serverRef.endsWith('^{}')) {
-          // Git's behavior is to only fetch tags that do not conflict with tags already present.
-          if (!(await GitRefManager.exists({ fs, gitdir, ref: serverRef }))) {
-            // Always use the object id of the tag itself, and not the peeled object id.
-            const oid = refs.get(serverRef);
-            actualRefsToWrite.set(serverRef, oid);
-          }
-        }
+    for (const serverRef of tagRefsToWrite) {
+      // Git's behavior is to only fetch tags that do not conflict with tags already present.
+      if (!(await GitRefManager.exists({ fs, gitdir, ref: serverRef }))) {
+        // Always use the object id of the tag itself, and not the peeled object id.
+        const oid = refs.get(serverRef);
+        actualRefsToWrite.set(serverRef, oid);
       }
     }
     // Combine refs and symrefs giving symrefs priority