Repository navigation
Commit 61d1fba
committed
Mark unsafe-options "allowed" tests xfail on Windows
The tests of unsafe options are among those introduced originally
in #1521. They are regression tests for #1515 (CVE-2022-24439).
The unsafe options tests are paired: a test for the usual, default
behavior of forbidding the option, and a test for the behavior when
the option is explicitly allowed. In each such pair, both tests use
a payload that is intended to produce the side effect of a file of
a specific name being created in a temporary directory.
All the tests work on Unix-like systems. On Windows, the tests of
the *allowed* cases are broken, and this commit marks them xfail.
However, this has implications for the tests of the default, secure
behavior, because until the "allowed" versions work on Windows, it
will be unclear if either are using a payload that is effective and
that corresponds to the way its effect is examined.
What *seems* to happen is this: The "\" characters in the path are
treated as shell escape characters rather than literally, with the
effect of disappearing in most paths since most letters lack
special meaning when escaped. Also, "touch" is not a native Windows
command, and the "touch" command provided by Git for Windows is
linked against MSYS2 libraries, causing it to map (some?)
occurrences of ":" in filenames to a separate code point in the
Private Use Area of the Basic Multilingual Plane. The result is a
path with no directory separators or drive letter. It denotes a
file of an unintended name in the current directory, which is never
the intended location. The current directory depends on GitPython
implementation details, but at present it's the top-level directory
of the rw_repo working tree. A new unstaged file, named like
"C\357\200\272UsersekAppDataLocalTemptmpc7x4xik5pwn", can be
observed there (this is how "git status" will format the name).
Fortunately, this and all related tests are working on other OSes,
and the affected code under test does not appear highly dependent
on OS. So the fix is *probably* fully working on Windows as well.1 parent b284ad7 commit 61d1fba
2 files changed
Lines changed: 45 additions & 0 deletions
| Original file line number | Diff line number | Diff line change | |
|---|---|---|---|
@@ -831,6 +831,15 @@ def test_fetch_unsafe_options(self, rw_repo): | |||
| 831 | 831 | remote.fetch(**unsafe_option) | |
| 832 | 832 | assert not tmp_file.exists() | |
| 833 | 833 | ||
| 834 | + @pytest.mark.xfail( | ||
| 835 | + os.name == "nt", | ||
| 836 | + reason=( | ||
| 837 | + "File not created. A separate Windows command may be needed. This and the " | ||
| 838 | + "currently passing test test_fetch_unsafe_options must be adjusted in the " | ||
| 839 | + "same way. Until then, test_fetch_unsafe_options is unreliable on Windows." | ||
| 840 | + ), | ||
| 841 | + raises=AssertionError, | ||
| 842 | + ) | ||
| 834 | 843 | @with_rw_repo("HEAD") | |
| 835 | 844 | def test_fetch_unsafe_options_allowed(self, rw_repo): | |
| 836 | 845 | with tempfile.TemporaryDirectory() as tdir: | |
@@ -890,6 +899,15 @@ def test_pull_unsafe_options(self, rw_repo): | |||
| 890 | 899 | remote.pull(**unsafe_option) | |
| 891 | 900 | assert not tmp_file.exists() | |
| 892 | 901 | ||
| 902 | + @pytest.mark.xfail( | ||
| 903 | + os.name == "nt", | ||
| 904 | + reason=( | ||
| 905 | + "File not created. A separate Windows command may be needed. This and the " | ||
| 906 | + "currently passing test test_pull_unsafe_options must be adjusted in the " | ||
| 907 | + "same way. Until then, test_pull_unsafe_options is unreliable on Windows." | ||
| 908 | + ), | ||
| 909 | + raises=AssertionError, | ||
| 910 | + ) | ||
| 893 | 911 | @with_rw_repo("HEAD") | |
| 894 | 912 | def test_pull_unsafe_options_allowed(self, rw_repo): | |
| 895 | 913 | with tempfile.TemporaryDirectory() as tdir: | |
@@ -955,6 +973,15 @@ def test_push_unsafe_options(self, rw_repo): | |||
| 955 | 973 | remote.push(**unsafe_option) | |
| 956 | 974 | assert not tmp_file.exists() | |
| 957 | 975 | ||
| 976 | + @pytest.mark.xfail( | ||
| 977 | + os.name == "nt", | ||
| 978 | + reason=( | ||
| 979 | + "File not created. A separate Windows command may be needed. This and the " | ||
| 980 | + "currently passing test test_push_unsafe_options must be adjusted in the " | ||
| 981 | + "same way. Until then, test_push_unsafe_options is unreliable on Windows." | ||
| 982 | + ), | ||
| 983 | + raises=AssertionError, | ||
| 984 | + ) | ||
| 958 | 985 | @with_rw_repo("HEAD") | |
| 959 | 986 | def test_push_unsafe_options_allowed(self, rw_repo): | |
| 960 | 987 | with tempfile.TemporaryDirectory() as tdir: | |
| Original file line number | Diff line number | Diff line change | |
|---|---|---|---|
@@ -294,6 +294,15 @@ def test_clone_unsafe_options(self, rw_repo): | |||
| 294 | 294 | rw_repo.clone(tmp_dir, **unsafe_option) | |
| 295 | 295 | assert not tmp_file.exists() | |
| 296 | 296 | ||
| 297 | + @pytest.mark.xfail( | ||
| 298 | + os.name == "nt", | ||
| 299 | + reason=( | ||
| 300 | + "File not created. A separate Windows command may be needed. This and the " | ||
| 301 | + "currently passing test test_clone_unsafe_options must be adjusted in the " | ||
| 302 | + "same way. Until then, test_clone_unsafe_options is unreliable on Windows." | ||
| 303 | + ), | ||
| 304 | + raises=AssertionError, | ||
| 305 | + ) | ||
| 297 | 306 | @with_rw_repo("HEAD") | |
| 298 | 307 | def test_clone_unsafe_options_allowed(self, rw_repo): | |
| 299 | 308 | with tempfile.TemporaryDirectory() as tdir: | |
@@ -364,6 +373,15 @@ def test_clone_from_unsafe_options(self, rw_repo): | |||
| 364 | 373 | Repo.clone_from(rw_repo.working_dir, tmp_dir, **unsafe_option) | |
| 365 | 374 | assert not tmp_file.exists() | |
| 366 | 375 | ||
| 376 | + @pytest.mark.xfail( | ||
| 377 | + os.name == "nt", | ||
| 378 | + reason=( | ||
| 379 | + "File not created. A separate Windows command may be needed. This and the " | ||
| 380 | + "currently passing test test_clone_from_unsafe_options must be adjusted in the " | ||
| 381 | + "same way. Until then, test_clone_from_unsafe_options is unreliable on Windows." | ||
| 382 | + ), | ||
| 383 | + raises=AssertionError, | ||
| 384 | + ) | ||
| 367 | 385 | @with_rw_repo("HEAD") | |
| 368 | 386 | def test_clone_from_unsafe_options_allowed(self, rw_repo): | |
| 369 | 387 | with tempfile.TemporaryDirectory() as tdir: | |
0 commit comments