Fossil SCM
Additional defenses against doing "fossil add" of files that are beneath symlinks.
Commit
928b023cb7d101b057a9c325b3c5ec8db75bb94cdd06cea0e2699a0d2ee2639b
Parent
f63297b2c521f48…
1 file changed
+11
-5
+11
-5
| --- src/add.c | ||
| +++ src/add.c | ||
| @@ -156,10 +156,11 @@ | ||
| 156 | 156 | */ |
| 157 | 157 | static int add_one_file( |
| 158 | 158 | const char *zPath, /* Tree-name of file to add. */ |
| 159 | 159 | int vid /* Add to this VFILE */ |
| 160 | 160 | ){ |
| 161 | + int doSkip = 0; | |
| 161 | 162 | if( !file_is_simple_pathname(zPath, 1) ){ |
| 162 | 163 | fossil_warning("filename contains illegal characters: %s", zPath); |
| 163 | 164 | return 0; |
| 164 | 165 | } |
| 165 | 166 | if( db_exists("SELECT 1 FROM vfile" |
| @@ -168,17 +169,22 @@ | ||
| 168 | 169 | " WHERE pathname=%Q %s AND deleted", |
| 169 | 170 | zPath, filename_collation()); |
| 170 | 171 | }else{ |
| 171 | 172 | char *zFullname = mprintf("%s%s", g.zLocalRoot, zPath); |
| 172 | 173 | int isExe = file_isexe(zFullname, RepoFILE); |
| 173 | - db_multi_exec( | |
| 174 | - "INSERT INTO vfile(vid,deleted,rid,mrid,pathname,isexe,islink,mhash)" | |
| 175 | - "VALUES(%d,0,0,0,%Q,%d,%d,NULL)", | |
| 176 | - vid, zPath, isExe, file_islink(0)); | |
| 174 | + if( file_nondir_objects_on_path(g.zLocalRoot, zFullname) ){ | |
| 175 | + /* Do not add unsafe files to the vfile */ | |
| 176 | + doSkip = 1; | |
| 177 | + }else{ | |
| 178 | + db_multi_exec( | |
| 179 | + "INSERT INTO vfile(vid,deleted,rid,mrid,pathname,isexe,islink,mhash)" | |
| 180 | + "VALUES(%d,0,0,0,%Q,%d,%d,NULL)", | |
| 181 | + vid, zPath, isExe, file_islink(0)); | |
| 182 | + } | |
| 177 | 183 | fossil_free(zFullname); |
| 178 | 184 | } |
| 179 | - if( db_changes() ){ | |
| 185 | + if( db_changes() && !doSkip ){ | |
| 180 | 186 | fossil_print("ADDED %s\n", zPath); |
| 181 | 187 | return 1; |
| 182 | 188 | }else{ |
| 183 | 189 | fossil_print("SKIP %s\n", zPath); |
| 184 | 190 | return 0; |
| 185 | 191 |
| --- src/add.c | |
| +++ src/add.c | |
| @@ -156,10 +156,11 @@ | |
| 156 | */ |
| 157 | static int add_one_file( |
| 158 | const char *zPath, /* Tree-name of file to add. */ |
| 159 | int vid /* Add to this VFILE */ |
| 160 | ){ |
| 161 | if( !file_is_simple_pathname(zPath, 1) ){ |
| 162 | fossil_warning("filename contains illegal characters: %s", zPath); |
| 163 | return 0; |
| 164 | } |
| 165 | if( db_exists("SELECT 1 FROM vfile" |
| @@ -168,17 +169,22 @@ | |
| 168 | " WHERE pathname=%Q %s AND deleted", |
| 169 | zPath, filename_collation()); |
| 170 | }else{ |
| 171 | char *zFullname = mprintf("%s%s", g.zLocalRoot, zPath); |
| 172 | int isExe = file_isexe(zFullname, RepoFILE); |
| 173 | db_multi_exec( |
| 174 | "INSERT INTO vfile(vid,deleted,rid,mrid,pathname,isexe,islink,mhash)" |
| 175 | "VALUES(%d,0,0,0,%Q,%d,%d,NULL)", |
| 176 | vid, zPath, isExe, file_islink(0)); |
| 177 | fossil_free(zFullname); |
| 178 | } |
| 179 | if( db_changes() ){ |
| 180 | fossil_print("ADDED %s\n", zPath); |
| 181 | return 1; |
| 182 | }else{ |
| 183 | fossil_print("SKIP %s\n", zPath); |
| 184 | return 0; |
| 185 |
| --- src/add.c | |
| +++ src/add.c | |
| @@ -156,10 +156,11 @@ | |
| 156 | */ |
| 157 | static int add_one_file( |
| 158 | const char *zPath, /* Tree-name of file to add. */ |
| 159 | int vid /* Add to this VFILE */ |
| 160 | ){ |
| 161 | int doSkip = 0; |
| 162 | if( !file_is_simple_pathname(zPath, 1) ){ |
| 163 | fossil_warning("filename contains illegal characters: %s", zPath); |
| 164 | return 0; |
| 165 | } |
| 166 | if( db_exists("SELECT 1 FROM vfile" |
| @@ -168,17 +169,22 @@ | |
| 169 | " WHERE pathname=%Q %s AND deleted", |
| 170 | zPath, filename_collation()); |
| 171 | }else{ |
| 172 | char *zFullname = mprintf("%s%s", g.zLocalRoot, zPath); |
| 173 | int isExe = file_isexe(zFullname, RepoFILE); |
| 174 | if( file_nondir_objects_on_path(g.zLocalRoot, zFullname) ){ |
| 175 | /* Do not add unsafe files to the vfile */ |
| 176 | doSkip = 1; |
| 177 | }else{ |
| 178 | db_multi_exec( |
| 179 | "INSERT INTO vfile(vid,deleted,rid,mrid,pathname,isexe,islink,mhash)" |
| 180 | "VALUES(%d,0,0,0,%Q,%d,%d,NULL)", |
| 181 | vid, zPath, isExe, file_islink(0)); |
| 182 | } |
| 183 | fossil_free(zFullname); |
| 184 | } |
| 185 | if( db_changes() && !doSkip ){ |
| 186 | fossil_print("ADDED %s\n", zPath); |
| 187 | return 1; |
| 188 | }else{ |
| 189 | fossil_print("SKIP %s\n", zPath); |
| 190 | return 0; |
| 191 |