bug: git submodule add in of nested submodule handles relative path wrong

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

 



joey@darkstar:/tmp/empty>git init sub1
Initialized empty Git repository in /tmp/empty/sub1/.git/
joey@darkstar:/tmp/empty>git init sub2
Initialized empty Git repository in /tmp/empty/sub2/.git/
joey@darkstar:/tmp/empty>cd sub1
joey@darkstar:/tmp/empty/sub1>date > f1 ; git add f1; git commit -m add -q
joey@darkstar:/tmp/empty/sub1>cd ..
joey@darkstar:/tmp/empty>cd sub2
joey@darkstar:/tmp/empty/sub2>date > f2 ; git add f2; git commit -m add -q
joey@darkstar:/tmp/empty/sub2>cd ..
joey@darkstar:/tmp/empty>git init repo
Initialized empty Git repository in /tmp/empty/repo/.git/
joey@darkstar:/tmp/empty>cd repo
joey@darkstar:/tmp/empty/repo>git submodule add ../sub1 1
Cloning into '1'...
done.
joey@darkstar:/tmp/empty/repo>cd 1
joey@darkstar:/tmp/empty/repo/1>ls
f1
joey@darkstar:/tmp/empty/repo/1>git submodule add ../../sub2 2
fatal: repository '/tmp/sub2' does not exist
fatal: clone of '/tmp/sub2' into submodule path '2' failed

Like the bug I filed yesterday, this is caused by git submodule add's
chdir into .git/modules.

Workaround is to pass absolute paths to git submodule add.

Note that this could be an exploitable security hole under some unusual
circumstances. In the example above, any other local user could create a
/tmp/sub2 containing something nasty, and git would check it out
accidentially.

git version 2.7.0

-- 
see shy jo

Attachment: signature.asc
Description: PGP signature


[Index of Archives]     [Linux Kernel Development]     [Gcc Help]     [IETF Annouce]     [DCCP]     [Netdev]     [Networking]     [Security]     [V4L]     [Bugtraq]     [Yosemite]     [MIPS Linux]     [ARM Linux]     [Linux Security]     [Linux RAID]     [Linux SCSI]     [Fedora Users]