mirror of
https://git.yoctoproject.org/poky
synced 2026-09-20 12:49:33 +02:00
7be1953871
This patch applies the upstream 3.1.49 backport for CVE-2026-44244. The upstream fix merge is referenced in [1], and the public CVE advisory is referenced in [2]. The individual backported commits are referenced in [3] and [4]. [1]b049a13105[2] https://nvd.nist.gov/vuln/detail/CVE-2026-44244 [3]c417af469f[4]8e24503b42(From OE-Core rev: 9aaa23d4f6c04049fcdb532f6a83c654e8e6e15d) Signed-off-by: Darsh Kelaiya <dkelaiya@cisco.com> Signed-off-by: Yoann Congal <yoann.congal@smile.fr> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
105 lines
4.0 KiB
Diff
105 lines
4.0 KiB
Diff
From 19e86eacc9471f2c3ef6f6a55dcaed40e5e139a0 Mon Sep 17 00:00:00 2001
|
|
From: "GPT 5.5" <codex@openai.com>
|
|
Date: Wed, 29 Apr 2026 05:47:57 +0800
|
|
Subject: [PATCH] reject control chars in written values in configuration
|
|
|
|
Reject CR, LF, and NUL in GitConfigParser values before writing them
|
|
to git config files (which also is a deviation from Git which escapes them).
|
|
|
|
GitConfigParser._write() serializes embedded newlines as indented
|
|
continuation lines by replacing "\n" with "\n\t". Git itself skips
|
|
leading whitespace before parsing config tokens, so an injected value
|
|
such as:
|
|
|
|
foo
|
|
[core]
|
|
hooksPath=/tmp/hooks
|
|
|
|
is written in a form where the indented "[core]" line is still parsed by
|
|
Git as a real section header. This lets attacker-controlled input passed
|
|
to config_writer().set_value() poison repository config, including
|
|
core.hooksPath, and redirect hook execution for later Git operations.
|
|
|
|
Fail closed instead of stripping or normalizing these characters. Silent
|
|
normalization can hide unsanitized caller input, and GitPython does not
|
|
currently round-trip Git-style escaped values such as "\n" as embedded
|
|
newlines.
|
|
|
|
Apply the validation to set_value(), add_value(), and the public set()
|
|
path so callers cannot bypass the safer helper API. Add regression tests
|
|
for the advisory payload and for CR, LF, NUL, and bytes values.
|
|
|
|
This preserves existing read behavior for config files that already
|
|
contain multiline values while preventing GitPython from writing new
|
|
unsafe values.
|
|
|
|
CVE: CVE-2026-44244
|
|
Upstream-Status: Backport [https://github.com/gitpython-developers/GitPython/commit/c417af469f9aa3da8dfef78f996c0fb8c5d1f4c2]
|
|
|
|
Backport Changes:
|
|
- Omit regression tests because the Scarthgap PyPI source
|
|
archive does not include the upstream test suite.
|
|
|
|
Co-authored-by: Sebastian Thiel <sebastian.thiel@icloud.com>
|
|
(cherry picked from commit c417af469f9aa3da8dfef78f996c0fb8c5d1f4c2)
|
|
Signed-off-by: Darsh Kelaiya <dkelaiya@cisco.com>
|
|
---
|
|
git/config.py | 24 ++++++++++++++++++++++--
|
|
1 file changed, 22 insertions(+), 2 deletions(-)
|
|
|
|
diff --git a/git/config.py b/git/config.py
|
|
index 85f75419..ce307110 100644
|
|
--- a/git/config.py
|
|
+++ b/git/config.py
|
|
@@ -841,6 +841,24 @@ class GitConfigParser(cp.RawConfigParser, metaclass=MetaParserBuilder):
|
|
return str(value)
|
|
return force_text(value)
|
|
|
|
+ def _value_to_string_safe(self, value: Union[str, bytes, int, float, bool]) -> str:
|
|
+ value_str = self._value_to_string(value)
|
|
+ if re.search(r"[\r\n\x00]", value_str):
|
|
+ raise ValueError("Git config values must not contain CR, LF, or NUL")
|
|
+ return value_str
|
|
+
|
|
+ @needs_values
|
|
+ @set_dirty_and_flush_changes
|
|
+ def set(
|
|
+ self,
|
|
+ section: str,
|
|
+ option: str,
|
|
+ value: Union[str, bytes, int, float, bool, None] = None,
|
|
+ ) -> None:
|
|
+ if value is not None:
|
|
+ value = self._value_to_string_safe(value)
|
|
+ return super().set(section, option, value)
|
|
+
|
|
@needs_values
|
|
@set_dirty_and_flush_changes
|
|
def set_value(self, section: str, option: str, value: Union[str, bytes, int, float, bool]) -> "GitConfigParser":
|
|
@@ -855,9 +873,10 @@ class GitConfigParser(cp.RawConfigParser, metaclass=MetaParserBuilder):
|
|
a string.
|
|
:return: This instance
|
|
"""
|
|
+ value_str = self._value_to_string_safe(value)
|
|
if not self.has_section(section):
|
|
self.add_section(section)
|
|
- self.set(section, option, self._value_to_string(value))
|
|
+ self.set(section, option, value_str)
|
|
return self
|
|
|
|
@needs_values
|
|
@@ -875,9 +894,10 @@ class GitConfigParser(cp.RawConfigParser, metaclass=MetaParserBuilder):
|
|
to a string
|
|
:return: This instance
|
|
"""
|
|
+ value_str = self._value_to_string_safe(value)
|
|
if not self.has_section(section):
|
|
self.add_section(section)
|
|
- self._sections[section].add(option, self._value_to_string(value))
|
|
+ self._sections[section].add(option, value_str)
|
|
return self
|
|
|
|
def rename_section(self, section: str, new_name: str) -> "GitConfigParser":
|
|
--
|
|
2.35.6
|