Backport fixes for CVE 2018-11235#4659

Merged

ethomson merged 22 commits intomaint/v0.27from

ethomson/submodule-0_27

May 29, 2018

Commits on May 29, 2018

submodule: add a failing test for a submodule escaping .git/modules

carlosmn
authored and
pks-t
committed
submodule: ignore submodules which include path traversal in their name

carlosmn
authored and
pks-t
committed
submodule: also validate Windows-separated paths for validity

carlosmn
authored and
pks-t
committed
path: provide a generic dogit checking function for HFS

carlosmn
authored and
pks-t
committed
path: provide a generic function for checking dogit files on NTFS

carlosmn
authored and
pks-t
committed
path: add a function to detect an .gitmodules file

carlosmn
authored and
pks-t
committed
path: add functions to detect .gitconfig and .gitattributes

carlosmn
authored and
pks-t
committed
path: hide the dotgit file functions

carlosmn
authored and
pks-t
committed
path: expose dotgit detection functions per filesystem

carlosmn
authored and
pks-t
committed
checkout: add a failing test for refusing a symlinked .gitmodules

carlosmn
authored and
pks-t
committed
path: accept the name length as a parameter

carlosmn
authored and
pks-t
committed
index: stat before creating the entry

carlosmn
authored and
pks-t
committed
path: reject .gitmodules as a symlink

carlosmn
authored and
pks-t
committed
checkout: change symlinked .gitmodules file test to expect failure

carlosmn
authored and
pks-t
committed
path: check for a symlinked .gitmodules in fs-agnostic code

carlosmn
authored and
pks-t
committed
submodule: the repostiory for _name_is_valid should not be const

carlosmn
authored and
pks-t
committed
submodule: replace index with strchr which exists on Windows

carlosmn
authored and
pks-t
committed
submodule: plug leaks from the escape detection

carlosmn
authored and
pks-t
committed
path: hand-code the zero-width joiner as UTF-8

carlosmn
authored and
pks-t
committed
CHANGELOG: update for v0.27.1
pks-t
committed
version: bump library version to 0.27.1

pks-t
authored and
carlosmn
committed
CHANGELOG: mention CVE-2018-11235 is covered by v0.27.1

carlosmn
authored and
ethomson
committed

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

Backport fixes for CVE 2018-11235#4659

Backport fixes for CVE 2018-11235#4659
ethomson merged 22 commits intomaint/v0.27from
ethomson/submodule-0_27

Commits on May 29, 2018

submodule: add a failing test for a submodule escaping .git/modules

submodule: ignore submodules which include path traversal in their name

submodule: also validate Windows-separated paths for validity

path: provide a generic dogit checking function for HFS

path: provide a generic function for checking dogit files on NTFS

path: add a function to detect an .gitmodules file

path: add functions to detect .gitconfig and .gitattributes

path: hide the dotgit file functions

path: expose dotgit detection functions per filesystem

checkout: add a failing test for refusing a symlinked .gitmodules

path: accept the name length as a parameter

index: stat before creating the entry

path: reject .gitmodules as a symlink

checkout: change symlinked .gitmodules file test to expect failure

path: check for a symlinked .gitmodules in fs-agnostic code

submodule: the repostiory for _name_is_valid should not be const

submodule: replace index with strchr which exists on Windows

submodule: plug leaks from the escape detection

path: hand-code the zero-width joiner as UTF-8

CHANGELOG: update for v0.27.1

version: bump library version to 0.27.1

CHANGELOG: mention CVE-2018-11235 is covered by v0.27.1

Backport fixes for CVE 2018-11235#4659ethomson merged 22 commits intomaint/v0.27libgit2/libgit2:maint/v0.27from ethomson/submodule-0_27libgit2/libgit2:ethomson/submodule-0_27Copy head branch name to clipboard

Commits

Commits on May 29, 2018

Backport fixes for CVE 2018-11235#4659
ethomson merged 22 commits intomaint/v0.27from
ethomson/submodule-0_27