Skip to content

Commit

Permalink
Merge pull request #128 from CocoaPods/validate_before_dl
Browse files Browse the repository at this point in the history
Ensure that the git pre-processor doesn't accidentally bail also
  • Loading branch information
dnkoutso authored Mar 31, 2022
2 parents 3adfe1f + d27c983 commit 52a0d54
Show file tree
Hide file tree
Showing 2 changed files with 12 additions and 0 deletions.
6 changes: 6 additions & 0 deletions lib/cocoapods-downloader/git.rb
Original file line number Diff line number Diff line change
Expand Up @@ -23,9 +23,15 @@ def checkout_options
def self.preprocess_options(options)
return options unless options[:branch]

input = [options[:git], options[:commit]].map(&:to_s)
invalid = input.compact.any? { |value| value.start_with?('--') || value.include?(' --') }
raise DownloaderError, "Provided unsafe input for git #{options}." if invalid

command = ['ls-remote',
'--',
options[:git],
options[:branch]]

output = Git.execute_command('git', command)
match = commit_from_ls_remote output, options[:branch]

Expand Down
6 changes: 6 additions & 0 deletions spec/git_spec.rb
Original file line number Diff line number Diff line change
Expand Up @@ -289,6 +289,12 @@ def ensure_only_one_ref(folder)
new_options = Downloader.preprocess_options(options)
new_options[:branch].should == 'aaaa'
end

it 'throws when proving an invalid input' do
options = { :git => '--upload-pack=touch ./HELLO1;', :branch => 'foo' }
e = lambda { Downloader.preprocess_options(options) }.should.raise DownloaderError
e.message.should.match /Provided unsafe input/
end
end

describe ':bad input' do
Expand Down

0 comments on commit 52a0d54

Please sign in to comment.