GeezerVison

The World Wide Web, restored to 800 pixels of glory.

Home|About|Gaming cabinet|Archives|How it works|Starter sites

GeezerVison is showing github.com — use tempfile.TemporaryDirectory & fix clone_from_unsafe_protocol tests by obfusk · Pull Request #1531 · gitpython-developers/GitPython

Conversation

obfusk commented Jan 8, 2023

Copy link

Copy Markdown

Contributor

uses tempfile.TemporaryDirectory() instead of tempfile.mkdtemp() to not leave temporary files behind (though that still happens in some other tests that are harder to fix);
fixes a typo (procol instead of protocol);
replaces /tmp/pwn w/ {tmp_file};
clones into tmp_dir / "repo" instead of tmp_dir, since tmp_dir / "pwn" will never exist afterwards otherwise;
adds a test w/ ext::sh that actually allows the protocol, to ensure we're not missing anything in the other tests.

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.

All reactions

obfusk added 2 commits

January 8, 2023 05:42


          replace tempfile.mkdtemp w/ tempfile.TemporaryDirectory

36cf7c1


          fix clone_from_unsafe_protocol tests

8f41a39

Byron added this to the v3.1.31 - Bugfixes milestone

Byron commented Jan 8, 2023

Copy link

Copy Markdown

Member

Thanks a lot for your contribution, it's much appreciated!

All reactions

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.

Byron merged commit 27a283b into gitpython-developers:main

EliahKagan added a commit to EliahKagan/GitPython that referenced this pull request


          Mark test_clone_command_injection xfail on Windows

d53a9db

This other GitCommandError on Windows is not related to
IndexFile.from_tree whose 8 related failing tests were marked
xfail in the preceding commit.

In addition, test_clone_command_injection should not be confused
with test_clone_test_clone_from_command_injection, which passes on
all platforms.

The problem here appears to be that, on Windows, the path of the
directory GitPython is intended to clone to (when the possible
security vulnerability this test checks for is *absent*) is not
valid. So this is a test bug, and it *appears* that the code under
test does not have the vulnerability being checked for.

This doesn't appear to be reported as a bug, but some general
context about the current implementation of this test can be
examined in gitpython-developers#1531 where the last major change to it was done.

When the test is fixed, that will become more clear. At that time,
this commit can be reverted to remove the xfail mark.

EliahKagan added a commit to EliahKagan/GitPython that referenced this pull request


          Mark test_clone_command_injection xfail on Windows

16c2a43

This other GitCommandError on Windows is not related to
IndexFile.from_tree whose 8 related failing tests were marked
xfail in the preceding commit.

Also, test_clone_command_injection should not be confused with
test_clone_from_command_injection, which passes on all platforms.

The problem here appears to be that, on Windows, the path of the
directory GitPython is intended to clone to (when the possible
security vulnerability this test checks for is *absent*) is not
valid. Although this suggest the bug may only be in the test and
that the code under test may be working on Windows, but the test
does not establish that, for which it would need to test with a
payload clearly capable of creating a file unexpected_path points
to when run on its own. I am unsure if that is the case, given
that the "touch" command is used.

This doesn't appear to be reported as a bug, but some general
context about the current implementation of this test can be
examined in gitpython-developers#1531 where the last major change to it was done.

When the test is fixed, that will become more clear. At that time,
this commit can be reverted to remove the xfail mark.

EliahKagan added a commit to EliahKagan/GitPython that referenced this pull request


          Mark test_clone_command_injection xfail on Windows

beee08f

This other GitCommandError on Windows is not related to
IndexFile.from_tree whose 8 related failing tests were marked
xfail in the preceding commit.

Also, test_clone_command_injection should not be confused with
test_clone_from_command_injection, which passes on all platforms.

The problem here appears to be that, on Windows, the path of the
directory GitPython is intended to clone to (when the possible
security vulnerability this test checks for is *absent*) is not
valid. Although this suggest the bug may only be in the test and
that the code under test may be working on Windows, but the test
does not establish that, for which it would need to test with a
payload clearly capable of creating a file unexpected_path points
to when run on its own. I am unsure if that is the case, given
that the "touch" command is used.

This doesn't appear to be reported as a bug, but some general
context about the implementation can be examined in gitpython-developers#1518 where it
was introduced, and gitpython-developers#1531 where it was modified.

EliahKagan added a commit to EliahKagan/GitPython that referenced this pull request


          Mark test_clone_command_injection xfail on Windows

70753f3

This other GitCommandError on Windows is not related to
IndexFile.from_tree whose 8 related failing tests were marked xfail
in the preceding commit.

Also, test_clone_command_injection should not be confused with
test_clone_from_command_injection, which passes on all platforms.

The problem here appears to be that, on Windows, the path of the
directory GitPython is intended to clone to -- when the possible
security vulnerability this test checks for is absent -- is not
valid. This suggests the bug may only be in the test and that the
code under test may be working on Windows. But the test does not
establish that, for which it would need to test with a payload
clearly capable of creating the file unexpected_path refers to when
run on its own. (The "\" characters in the path seem to be treated
as escape characters rather than literally. Also, "touch" is not a
native Windows command, and the "touch" command in Git for Windows
maps disallowed occurrences of ":" in filenames to a separate code
point in the Private Use Area of the Basic Multilingual Plane.)

This doesn't currently seem to be reported as a bug, but some
general context about the implementation can be examined in gitpython-developers#1518
where it was introduced, and gitpython-developers#1531 where it was modified.

EliahKagan added a commit to EliahKagan/GitPython that referenced this pull request


          Mark test_clone_command_injection xfail on Windows

cd9d7a9

This other GitCommandError on Windows is not related to
IndexFile.from_tree whose 8 related failing tests were marked xfail
in the preceding commit.

Also, test_clone_command_injection should not be confused with
test_clone_from_command_injection, which passes on all platforms.

The problem here appears to be that, on Windows, the path of the
directory GitPython is intended to clone to -- when the possible
security vulnerability this test checks for is absent -- is not
valid. This suggests the bug may only be in the test and that the
code under test may be working on Windows. But the test does not
establish that, for which it would need to test with a payload
clearly capable of creating the file unexpected_path refers to when
run on its own.

This doesn't currently seem to be reported as a bug, but some
general context about the implementation can be examined in gitpython-developers#1518
where it was introduced, and gitpython-developers#1531 where it was modified.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Uh oh!

There was an error while loading. Please reload this page.

Assignees

No one assigned

Labels

None yet

Milestone

v3.1.31 - Bugfixes

Development

Successfully merging this pull request may close these issues.

Uh oh!

There was an error while loading. Please reload this page.

2 participants

Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.

You are visitor 01402503 — GeezerVison does not store the pages you look up.
Best viewed with Netscape Navigator 4.7 or Internet Explorer 6 at 800×600. No cookies required.