]> source.dussan.org Git - jgit.git/commit
Make Config.readIncludedConfig a noop by default 71/113371/2
authorShawn Pearce <spearce@spearce.org>
Thu, 14 Dec 2017 01:35:38 +0000 (17:35 -0800)
committerShawn Pearce <spearce@spearce.org>
Thu, 14 Dec 2017 01:50:52 +0000 (17:50 -0800)
commit3a7704638abf5d221a05509291e7c49ad1ac63ba
treeebcde3951a6e156f4ccf9a003cb9a91a342b2ae7
parentf635aa51f8d6d0aaa11679605cfbb4c720567baf
Make Config.readIncludedConfig a noop by default

The Config class must be safe to run against untrusted input files.
Reading arbitrary local system paths using include.path is risky for
servers, including Gerrit Code Review.  Return null by default to
incide the include should be ignored.

Only FileBasedConfig which originated from local disk should be trying
to read local system paths.  FileBasedConfig already overrides this
method with its own implementation.

Change-Id: I2ff31753868aa1bbac4a6843a4c23e50bd6f46f3
org.eclipse.jgit.test/tst/org/eclipse/jgit/lib/ConfigTest.java
org.eclipse.jgit/src/org/eclipse/jgit/lib/Config.java