Am 26.09.2017 um 00:50 schrieb Stefan Beller:
submodule.<name>.update can be assigned an arbitrary command via setting
it to "!command". When this command is found in the regular config, Git
ought to just run that command instead of other update mechanisms.
However if that command is just found in the .gitmodules file, it is
potentially untrusted, which is why we do not run it. Add a test
confirming the behavior.
Suggested-by: Jonathan Nieder <jrnieder@xxxxxxxxx>
Signed-off-by: Stefan Beller <sbeller@xxxxxxxxxx>
---
updated to use the super robust script.
Thanks Jonathan,
Stefan
t/t7406-submodule-update.sh | 14 ++++++++++++++
1 file changed, 14 insertions(+)
diff --git a/t/t7406-submodule-update.sh b/t/t7406-submodule-update.sh
index 034914a14f..d718cb00e7 100755
--- a/t/t7406-submodule-update.sh
+++ b/t/t7406-submodule-update.sh
@@ -406,6 +406,20 @@ test_expect_success 'submodule update - command in .git/config' '
)
'
+test_expect_success 'submodule update - command in .gitmodules is ignored' '
+ test_when_finished "git -C super reset --hard HEAD^" &&
+
+ write_script must_not_run.sh <<-EOF &&
+ >$TEST_DIRECTORY/bad
+ EOF
I am pretty confident that this does not test what you intend to test.
Notice that $TEST_DIRECTORY is expanded when the script is written. But
that path contains a blank, and we have something like this in the test
script:
#!/bin/sh
>/the/build/directory/t/trash directory.t7406/bad
If you inject the bug against which this test protects into
git-submodule, you should find a file "trash" in your t directory, and
the file "bad" still absent. Not to mention that the script fails
because it cannot run "directory.t7406/bad".
To fix that, you should use and exported variable and access that from
the test script, for example:
write_script must_not_run.sh <<-\EOF &&
>"$TEST_DIRECTORY"/bad
EOF
...
(
export TEST_DIRECTORY &&
git -C super submodule update submodule
) &&
test_path_is_missing bad
+
+ git -C super config -f .gitmodules submodule.submodule.update "!$TEST_DIRECTORY/must_not_run.sh" &&
+ git -C super commit -a -m "add command to .gitmodules file" &&
+ git -C super/submodule reset --hard $submodulesha1^ &&
+ git -C super submodule update submodule &&
+ test_path_is_missing bad
+'
+
cat << EOF >expect
Execution of 'false $submodulesha1' failed in submodule path 'submodule'
EOF
-- Hannes
