git style filename quoting for giveup
When the filenames are part of the git repository or other files that might have attacker-controlled names, quote them in error messages. This is fairly complete, although I didn't do the one in Utility.DirWatcher.INotify.hs because that doesn't have access to Git.Filename or Annex. But it's also quite possible I missed some. And also while scanning for these, I found giveup used with other things that could be attacker controlled to contain control characters (eg Keys). So, I'm thinking it would also be good for giveup to just filter out control characters. This commit is then not the only line of defence, but just good formatting when git-annex displays a filename in an error message. Sponsored-by: Kevin Mueller on Patreon
This commit is contained in:
parent
da83652c76
commit
063c00e4f7
8 changed files with 79 additions and 30 deletions
|
@ -5,6 +5,8 @@
|
|||
- Licensed under the GNU AGPL version 3 or higher.
|
||||
-}
|
||||
|
||||
{-# LANGUAGE OverloadedStrings #-}
|
||||
|
||||
module Command.Add where
|
||||
|
||||
import Command
|
||||
|
@ -23,6 +25,7 @@ import Messages.Progress
|
|||
import Git.FilePath
|
||||
import Git.Types
|
||||
import Git.UpdateIndex
|
||||
import Git.Filename
|
||||
import Config.GitConfig
|
||||
import Utility.OptParse
|
||||
import Utility.InodeCache
|
||||
|
@ -160,7 +163,10 @@ addFile smallorlarge file s = do
|
|||
then hashBlob =<< liftIO (R.readSymbolicLink file)
|
||||
else if isRegularFile s
|
||||
then hashFile file
|
||||
else giveup $ fromRawFilePath file ++ " is not a regular file"
|
||||
else do
|
||||
qp <- coreQuotePath <$> Annex.getGitConfig
|
||||
giveup $ decodeBS $ quote qp $
|
||||
file <> " is not a regular file"
|
||||
let treetype = if isSymbolicLink s
|
||||
then TreeSymlink
|
||||
else if intersectFileModes ownerExecuteMode (fileMode s) /= 0
|
||||
|
|
Loading…
Add table
Add a link
Reference in a new issue