submodule: allow only certain protocols for submodule fetches

Some protocols (like git-remote-ext) can execute arbitrary
code found in the URL. The URLs that submodules use may come
from arbitrary sources (e.g., .gitmodules files in a remote
repository). Let's restrict submodules to fetching from a
known-good subset of protocols.

Note that we apply this restriction to all submodule
commands, whether the URL comes from .gitmodules or not.
This is more restrictive than we need to be; for example, in
the tests we run:

  git submodule add ext::...

which should be trusted, as the URL comes directly from the
command line provided by the user. But doing it this way is
simpler, and makes it much less likely that we would miss a
case. And since such protocols should be an exception
(especially because nobody who clones from them will be able
to update the submodules!), it's not likely to inconvenience
anyone in practice.

Reported-by: Blake Burkhart <bburky@bburky.com>
Signed-off-by: Jeff King <peff@peff.net>
Signed-off-by: Junio C Hamano <gitster@pobox.com>
2 files changed
tree: 1b94b1eff66ebbc258722f59b60ca64eac0c6de3
  1. .gitattributes
  2. .gitignore
  3. .mailmap
  4. COPYING
  5. Documentation/
  6. GIT-VERSION-GEN
  7. INSTALL
  8. LGPL-2.1
  9. Makefile
  10. README
  11. abspath.c
  12. aclocal.m4
  13. advice.c
  14. advice.h
  15. alias.c
  16. alloc.c
  17. archive-tar.c
  18. archive-zip.c
  19. archive.c
  20. archive.h
  21. argv-array.c
  22. argv-array.h
  23. attr.c
  24. attr.h
  25. base85.c
  26. bisect.c
  27. bisect.h
  28. blob.c
  29. blob.h
  30. block-sha1/
  31. branch.c
  32. branch.h
  33. builtin.h
  34. builtin/
  35. bulk-checkin.c
  36. bulk-checkin.h
  37. bundle.c
  38. bundle.h
  39. cache-tree.c
  40. cache-tree.h
  41. cache.h
  42. check-builtins.sh
  43. check-racy.c
  44. check_bindir
  45. color.c
  46. color.h
  47. column.c
  48. column.h
  49. combine-diff.c
  50. command-list.txt
  51. commit-slab.h
  52. commit.c
  53. commit.h
  54. compat/
  55. config.c
  56. config.mak.in
  57. config.mak.uname
  58. configure.ac
  59. connect.c
  60. connect.h
  61. connected.c
  62. connected.h
  63. contrib/
  64. convert.c
  65. convert.h
  66. copy.c
  67. credential-cache--daemon.c
  68. credential-cache.c
  69. credential-store.c
  70. credential.c
  71. credential.h
  72. csum-file.c
  73. csum-file.h
  74. ctype.c
  75. daemon.c
  76. date.c
  77. decorate.c
  78. decorate.h
  79. delta.h
  80. diff-delta.c
  81. diff-lib.c
  82. diff-no-index.c
  83. diff.c
  84. diff.h
  85. diffcore-break.c
  86. diffcore-delta.c
  87. diffcore-order.c
  88. diffcore-pickaxe.c
  89. diffcore-rename.c
  90. diffcore.h
  91. dir.c
  92. dir.h
  93. editor.c
  94. entry.c
  95. environment.c
  96. ewah/
  97. exec_cmd.c
  98. exec_cmd.h
  99. fast-import.c
  100. fetch-pack.c
  101. fetch-pack.h
  102. fmt-merge-msg.h
  103. fsck.c
  104. fsck.h
  105. generate-cmdlist.sh
  106. gettext.c
  107. gettext.h
  108. git-add--interactive.perl
  109. git-am.sh
  110. git-archimport.perl
  111. git-bisect.sh
  112. git-compat-util.h
  113. git-cvsexportcommit.perl
  114. git-cvsimport.perl
  115. git-cvsserver.perl
  116. git-difftool--helper.sh
  117. git-difftool.perl
  118. git-filter-branch.sh
  119. git-gui/
  120. git-instaweb.sh
  121. git-merge-octopus.sh
  122. git-merge-one-file.sh
  123. git-merge-resolve.sh
  124. git-mergetool--lib.sh
  125. git-mergetool.sh
  126. git-p4.py
  127. git-parse-remote.sh
  128. git-pull.sh
  129. git-quiltimport.sh
  130. git-rebase--am.sh
  131. git-rebase--interactive.sh
  132. git-rebase--merge.sh
  133. git-rebase.sh
  134. git-relink.perl
  135. git-remote-testgit.sh
  136. git-request-pull.sh
  137. git-send-email.perl
  138. git-sh-i18n.sh
  139. git-sh-setup.sh
  140. git-stash.sh
  141. git-submodule.sh
  142. git-svn.perl
  143. git-web--browse.sh
  144. git.c
  145. git.rc
  146. git.spec.in
  147. gitk-git/
  148. gitweb/
  149. gpg-interface.c
  150. gpg-interface.h
  151. graph.c
  152. graph.h
  153. grep.c
  154. grep.h
  155. hashmap.c
  156. hashmap.h
  157. help.c
  158. help.h
  159. hex.c
  160. http-backend.c
  161. http-fetch.c
  162. http-push.c
  163. http-walker.c
  164. http.c
  165. http.h
  166. ident.c
  167. imap-send.c
  168. khash.h
  169. kwset.c
  170. kwset.h
  171. levenshtein.c
  172. levenshtein.h
  173. line-log.c
  174. line-log.h
  175. line-range.c
  176. line-range.h
  177. list-objects.c
  178. list-objects.h
  179. ll-merge.c
  180. ll-merge.h
  181. lockfile.c
  182. lockfile.h
  183. log-tree.c
  184. log-tree.h
  185. mailmap.c
  186. mailmap.h
  187. match-trees.c
  188. merge-blobs.c
  189. merge-blobs.h
  190. merge-recursive.c
  191. merge-recursive.h
  192. merge.c
  193. mergesort.c
  194. mergesort.h
  195. mergetools/
  196. name-hash.c
  197. notes-cache.c
  198. notes-cache.h
  199. notes-merge.c
  200. notes-merge.h
  201. notes-utils.c
  202. notes-utils.h
  203. notes.c
  204. notes.h
  205. object.c
  206. object.h
  207. pack-bitmap-write.c
  208. pack-bitmap.c
  209. pack-bitmap.h
  210. pack-check.c
  211. pack-objects.c
  212. pack-objects.h
  213. pack-revindex.c
  214. pack-revindex.h
  215. pack-write.c
  216. pack.h
  217. pager.c
  218. parse-options-cb.c
  219. parse-options.c
  220. parse-options.h
  221. patch-delta.c
  222. patch-ids.c
  223. patch-ids.h
  224. path.c
  225. pathspec.c
  226. pathspec.h
  227. perl/
  228. pkt-line.c
  229. pkt-line.h
  230. po/
  231. ppc/
  232. preload-index.c
  233. pretty.c
  234. prio-queue.c
  235. prio-queue.h
  236. progress.c
  237. progress.h
  238. prompt.c
  239. prompt.h
  240. quote.c
  241. quote.h
  242. reachable.c
  243. reachable.h
  244. read-cache.c
  245. reflog-walk.c
  246. reflog-walk.h
  247. refs.c
  248. refs.h
  249. remote-curl.c
  250. remote-testsvn.c
  251. remote.c
  252. remote.h
  253. replace_object.c
  254. rerere.c
  255. rerere.h
  256. resolve-undo.c
  257. resolve-undo.h
  258. revision.c
  259. revision.h
  260. run-command.c
  261. run-command.h
  262. send-pack.c
  263. send-pack.h
  264. sequencer.c
  265. sequencer.h
  266. server-info.c
  267. setup.c
  268. sh-i18n--envsubst.c
  269. sha1-array.c
  270. sha1-array.h
  271. sha1-lookup.c
  272. sha1-lookup.h
  273. sha1_file.c
  274. sha1_name.c
  275. shallow.c
  276. shell.c
  277. shortlog.h
  278. show-index.c
  279. sideband.c
  280. sideband.h
  281. sigchain.c
  282. sigchain.h
  283. split-index.c
  284. split-index.h
  285. strbuf.c
  286. strbuf.h
  287. streaming.c
  288. streaming.h
  289. string-list.c
  290. string-list.h
  291. submodule.c
  292. submodule.h
  293. symlinks.c
  294. t/
  295. tag.c
  296. tag.h
  297. tar.h
  298. templates/
  299. test-chmtime.c
  300. test-config.c
  301. test-ctype.c
  302. test-date.c
  303. test-delta.c
  304. test-dump-cache-tree.c
  305. test-dump-split-index.c
  306. test-genrandom.c
  307. test-hashmap.c
  308. test-index-version.c
  309. test-line-buffer.c
  310. test-match-trees.c
  311. test-mergesort.c
  312. test-mktemp.c
  313. test-parse-options.c
  314. test-path-utils.c
  315. test-prio-queue.c
  316. test-read-cache.c
  317. test-regex.c
  318. test-revision-walking.c
  319. test-run-command.c
  320. test-scrap-cache-tree.c
  321. test-sha1-array.c
  322. test-sha1.c
  323. test-sha1.sh
  324. test-sigchain.c
  325. test-string-list.c
  326. test-subprocess.c
  327. test-svn-fe.c
  328. test-urlmatch-normalization.c
  329. test-wildmatch.c
  330. thread-utils.c
  331. thread-utils.h
  332. trace.c
  333. trace.h
  334. trailer.c
  335. trailer.h
  336. transport-helper.c
  337. transport.c
  338. transport.h
  339. tree-diff.c
  340. tree-walk.c
  341. tree-walk.h
  342. tree.c
  343. tree.h
  344. unicode_width.h
  345. unimplemented.sh
  346. unix-socket.c
  347. unix-socket.h
  348. unpack-trees.c
  349. unpack-trees.h
  350. update_unicode.sh
  351. upload-pack.c
  352. url.c
  353. url.h
  354. urlmatch.c
  355. urlmatch.h
  356. usage.c
  357. userdiff.c
  358. userdiff.h
  359. utf8.c
  360. utf8.h
  361. varint.c
  362. varint.h
  363. vcs-svn/
  364. version.c
  365. version.h
  366. versioncmp.c
  367. walker.c
  368. walker.h
  369. wildmatch.c
  370. wildmatch.h
  371. wrap-for-bin.sh
  372. wrapper.c
  373. write_or_die.c
  374. ws.c
  375. wt-status.c
  376. wt-status.h
  377. xdiff-interface.c
  378. xdiff-interface.h
  379. xdiff/
  380. zlib.c