Imported Upstream version 2.3.7

diff --git a/Documentation/RelNotes/2.3.7.txt b/Documentation/RelNotes/2.3.7.txt
new file mode 100644 (file)
index 0000000..fc95812
--- /dev/null
+++ b/Documentation/RelNotes/2.3.7.txt
@@ -0,0 +1,21 @@
+Git v2.3.7 Release Notes
+========================
+
+Fixes since v2.3.6
+------------------
+
+ * An earlier update to the parser that disects a URL broke an
+   address, followed by a colon, followed by an empty string (instead
+   of the port number), e.g. ssh://example.com:/path/to/repo.
+
+ * The completion script (in contrib/) contaminated global namespace
+   and clobbered on a shell variable $x.
+
+ * The "git push --signed" protocol extension did not limit what the
+   "nonce" that is a server-chosen string can contain or how long it
+   can be, which was unnecessarily lax.  Limit both the length and the
+   alphabet to a reasonably small space that can still have enough
+   entropy.
+
+Also contains typofixes, documentation updates and trivial code
+clean-ups.

diff --git a/Documentation/git.txt b/Documentation/git.txt
index 085bc34..8704ffd 100644 (file)
--- a/Documentation/git.txt
+++ b/Documentation/git.txt
@@ -43,9 +43,10 @@ unreleased) version of Git, that is available from the 'master'
 branch of the `git.git` repository.
 Documentation for older releases are available here:
 
-* link:v2.3.6/git.html[documentation for release 2.3.6]
+* link:v2.3.7/git.html[documentation for release 2.3.7]
 
 * release notes for
+  link:RelNotes/2.3.7.txt[2.3.7],
   link:RelNotes/2.3.6.txt[2.3.6],
   link:RelNotes/2.3.5.txt[2.3.5],
   link:RelNotes/2.3.4.txt[2.3.4],

diff --git a/GIT-VERSION-GEN b/GIT-VERSION-GEN
index 3baaa9d..0c1ee67 100755 (executable)
--- a/GIT-VERSION-GEN
+++ b/GIT-VERSION-GEN
@@ -1,7 +1,7 @@
 #!/bin/sh
 
 GVF=GIT-VERSION-FILE
-DEF_VER=v2.3.6
+DEF_VER=v2.3.7
 
 LF='
 '

diff --git a/RelNotes b/RelNotes
index d92e7b8..8f376a9 120000 (symlink)
--- a/RelNotes
+++ b/RelNotes
@@ -1 +1 @@
-Documentation/RelNotes/2.3.6.txt
\ No newline at end of file
+Documentation/RelNotes/2.3.7.txt
\ No newline at end of file

diff --git a/connect.c b/connect.c
index ce0e121..14c924b 100644 (file)
--- a/connect.c
+++ b/connect.c
@@ -310,6 +310,8 @@ static void get_host_and_port(char **host, const char **port)
                if (end != colon + 1 && *end == '\0' && 0 <= portnr && portnr < 65536) {
                        *colon = 0;
                        *port = colon + 1;
+               } else if (!colon[1]) {
+                       *colon = 0;
                }
        }
 }

diff --git a/contrib/completion/git-completion.bash b/contrib/completion/git-completion.bash
index 661a829..1620546 100644 (file)
--- a/contrib/completion/git-completion.bash
+++ b/contrib/completion/git-completion.bash
@@ -186,7 +186,7 @@ fi
 
 __gitcompappend ()
 {
-       local i=${#COMPREPLY[@]}
+       local x i=${#COMPREPLY[@]}
        for x in $1; do
                if [[ "$x" == "$3"* ]]; then
                        COMPREPLY[i++]="$2$x$4"

diff --git a/send-pack.c b/send-pack.c
index 25947d7..677bac3 100644 (file)
--- a/send-pack.c
+++ b/send-pack.c
@@ -281,6 +281,28 @@ free_return:
        return update_seen;
 }
 
+#define NONCE_LEN_LIMIT 256
+
+static void reject_invalid_nonce(const char *nonce, int len)
+{
+       int i = 0;
+
+       if (NONCE_LEN_LIMIT <= len)
+               die("the receiving end asked to sign an invalid nonce <%.*s>",
+                   len, nonce);
+
+       for (i = 0; i < len; i++) {
+               int ch = nonce[i] & 0xFF;
+               if (isalnum(ch) ||
+                   ch == '-' || ch == '.' ||
+                   ch == '/' || ch == '+' ||
+                   ch == '=' || ch == '_')
+                       continue;
+               die("the receiving end asked to sign an invalid nonce <%.*s>",
+                   len, nonce);
+       }
+}
+
 int send_pack(struct send_pack_args *args,
              int fd[], struct child_process *conn,
              struct ref *remote_refs,
@@ -323,6 +345,7 @@ int send_pack(struct send_pack_args *args,
                push_cert_nonce = server_feature_value("push-cert", &len);
                if (!push_cert_nonce)
                        die(_("the receiving end does not support --signed push"));
+               reject_invalid_nonce(push_cert_nonce, len);
                push_cert_nonce = xmemdupz(push_cert_nonce, len);
        }
 

diff --git a/t/t5500-fetch-pack.sh b/t/t5500-fetch-pack.sh
index bd37f04..ed40407 100755 (executable)
--- a/t/t5500-fetch-pack.sh
+++ b/t/t5500-fetch-pack.sh
@@ -576,13 +576,16 @@ do
        do
                for h in host user@host user@[::1] user@::1
                do
-                       test_expect_success "fetch-pack --diag-url $p://$h/$r" '
-                               check_prot_host_port_path $p://$h/$r $p "$h" NONE "/$r"
-                       '
-                       # "/~" -> "~" conversion
-                       test_expect_success "fetch-pack --diag-url $p://$h/~$r" '
-                               check_prot_host_port_path $p://$h/~$r $p "$h" NONE "~$r"
-                       '
+                       for c in "" :
+                       do
+                               test_expect_success "fetch-pack --diag-url $p://$h$c/$r" '
+                                       check_prot_host_port_path $p://$h/$r $p "$h" NONE "/$r"
+                               '
+                               # "/~" -> "~" conversion
+                               test_expect_success "fetch-pack --diag-url $p://$h$c/~$r" '
+                                       check_prot_host_port_path $p://$h/~$r $p "$h" NONE "~$r"
+                               '
+                       done
                done
                for h in host User@host User@[::1]
                do

diff --git a/t/t5601-clone.sh b/t/t5601-clone.sh
index 02b40b1..1befc45 100755 (executable)
--- a/t/t5601-clone.sh
+++ b/t/t5601-clone.sh
@@ -387,14 +387,17 @@ do
 done
 
 #with ssh:// scheme
-test_expect_success 'clone ssh://host.xz/home/user/repo' '
-       test_clone_url "ssh://host.xz/home/user/repo" host.xz "/home/user/repo"
-'
-
-# from home directory
-test_expect_success 'clone ssh://host.xz/~repo' '
-       test_clone_url "ssh://host.xz/~repo" host.xz "~repo"
+#ignore trailing colon
+for tcol in "" :
+do
+       test_expect_success "clone ssh://host.xz$tcol/home/user/repo" '
+               test_clone_url "ssh://host.xz$tcol/home/user/repo" host.xz /home/user/repo
+       '
+       # from home directory
+       test_expect_success "clone ssh://host.xz$tcol/~repo" '
+       test_clone_url "ssh://host.xz$tcol/~repo" host.xz "~repo"
 '
+done
 
 # with port number
 test_expect_success 'clone ssh://host.xz:22/home/user/repo' '
@@ -407,9 +410,9 @@ test_expect_success 'clone ssh://host.xz:22/~repo' '
 '
 
 #IPv6
-for tuah in ::1 [::1] user@::1 user@[::1] [user@::1]
+for tuah in ::1 [::1] [::1]: user@::1 user@[::1] user@[::1]: [user@::1] [user@::1]:
 do
-       ehost=$(echo $tuah | tr -d "[]")
+       ehost=$(echo $tuah | sed -e "s/1]:/1]/ "| tr -d "[]")
        test_expect_success "clone ssh://$tuah/home/user/repo" "
          test_clone_url ssh://$tuah/home/user/repo $ehost /home/user/repo
        "