On Mon, Nov 25, 2024 at 10:15 AM Eric Sunshine [off-list ref] wrote:

On Mon, Nov 25, 2024 at 12:58 PM Elijah Newren via GitGitGadget
[off-list ref] wrote:

quoted

If a user specified e.g.
   M 100644 :1 ../some-file
then fast-import previously would happily create a git history where
there is a tree in the top-level directory named "..", and with a file
inside that directory named "some-file".  The top-level ".." directory
causes problems.  While git checkout will die with errors and fsck will
report hasDotdot problems, the user is going to have problems trying to
remove the problematic file.  Simply avoid creating this bad history in
the first place.

Signed-off-by: Elijah Newren <redacted>
---

diff --git a/builtin/fast-import.c b/builtin/fast-import.c

@@ -1466,6 +1466,9 @@ static int tree_content_set(
        e->name = to_atom(p, n);
+       if (!strcmp(e->name->str_dat, ".") || !strcmp(e->name->str_dat, "..")) {
+               die("path %s contains invalid component", p);
+       }

Probably not worth a reroll, but is_dot_or_dotdot() might be usable here.

(And -- style nit -- the braces could be dropped.)

Good catches, thanks.  I think they are worth a reroll; I'll send one in.