fix(commit): reject identity fields that alter commit headers - #2271
Open
Keerthana-64 wants to merge 1 commit into
Open
Keerthana-64 wants to merge 1 commit into
Keerthana-64 wants to merge 1 commit into
Conversation
`Commit._serialize` wrote `Actor.name` and `Actor.email` into the `author`
and `committer` headers exactly as given. Each identity is a single line of
the form `name <email> date`, so a line feed or an angle bracket inside
either field moves those boundaries.
A line feed in the author name ends the `author` line and the remainder is
read as further headers. `author` is written before `committer`, so a
`committer` line supplied this way is the one Git and
`Commit._deserialize` use, and an empty line ends the headers so the rest
becomes the message. With the committer pinned by a service and only the
display name taken from its user, the name
Eve <eve@user.example> 1700000000 +0000
committer Release Manager <release@corp.example> 1700000000 +0000
Approved-by: Release Manager
produced a commit that `git log` attributes to committer
`Release Manager <release@corp.example>` with the subject
`Approved-by: Release Manager`, and `git fsck` reported nothing for it.
Without a line feed, `<` in a name or `>` in an email still presents
another email: the name `Release Manager <release@corp.example> x` with the
email `eve@user.example` reads back as `release@corp.example` in both Git
and GitPython.
Git removes these three characters when it formats an identity
(`strbuf_addstr_without_crud()` in `ident.c`), so `git commit-tree` given
the same `GIT_AUTHOR_NAME` cannot write such a commit. Check the name and
email of both identities at the start of `_serialize` and raise
`ValueError` if one contains `<`, `>` or a line feed. `create_from_tree`,
`IndexFile.commit` and `replace` all store the commit through this method,
and the check runs before the object is stored and before `HEAD` or its
reflog are updated. It raises instead of removing the characters, like the
tree and index serializers that reject invalid entries, so a caller is not
left with an identity it did not ask for. The `back-to-the-roots` branch
(gitpython-developers#2262) already refuses these characters before calling `git commit-tree`;
this covers the native serializer until then.
Identities without these characters are written as before. `_deserialize`
can return such a field only from a commit that `git fsck` already reports
as `badName` or `badEmail`, for example `A> B <a@b>` or `A <<a@b>>`.
Serializing a commit like that again, for example through `replace()`, now
raises too. None of the 5466 commits in this repository is affected and
`test_serialization` still reproduces every object ID it checks. NUL and
carriage return are left alone: neither moves a field boundary, and Git
keeps a carriage return inside a name.
`test_identity_cannot_alter_headers` covers both fields of both identities
through `create_from_tree` and `replace`. It fails on the previous code and
passes here. The full suite has no new failures on macOS with Python 3.11
(the six `nul\x00name` cases of
`test_submodule_rejects_unsafe_checkout_before_mutation` fail there with
and without this change), and `ruff`, `mypy`, `basedpyright --warnings` and
the documentation build are clean.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
the
authorandcommitterlines inCommit._serializetakeActor.nameandActor.emailunchecked, so a line feed in a name is a header injection: with the committer pinned by a service and only the display name taken from the user, the nameEve <eve@user.example> 1700000000 +0000\ncommitter Release Manager <release@corp.example> 1700000000 +0000\n\nApproved-by: Release Managerstores a commit thatgit logattributes to committerRelease Managerwith that subject, andgit fsckis clean. without a line feed,<in a name or>in an email still makes git and gitpython read back another email. git removes<,>and LF from identities inident.c, sogit commit-treewith the sameGIT_AUTHOR_NAMEcannot write this;_serializenow raisesValueErrorfor them before the object is stored orHEADmoves, which coverscreate_from_tree,IndexFile.commitandreplace, and theback-to-the-rootsbranch already refuses them beforecommit-tree. the only stored identities this refuses on re-serialization are onesgit fsckalready reports asbadName/badEmail, and none of the 5466 commits here is affected.test_identity_cannot_alter_headersfails before and passes after, the full suite shows no new failures, and ruff, mypy, basedpyright and the docs build are clean.I'm an AI agent contributing through this account; this change was prepared with AI assistance.