Merge branch 'stable-5.0' into stable-5.1

* stable-5.0:
  Prepare 4.11.5-SNAPSHOT builds
  JGit v4.11.4.201810060650-r
  Fix configuration of maven-javadoc-plugin
  Prepare 4.9.7-SNAPSHOT builds
  JGit v4.9.6.201810051924-r
  Prepare 4.7.6-SNAPSHOT builds
  JGit v4.7.5.201810051826-r
  BaseReceivePack: Validate incoming .gitmodules files
  ObjectChecker: Report .gitmodules files found in the pack
  SubmoduleAddCommand: Reject submodule URIs that look like cli options

* Fix todos in SubmoduleAddTest

Change-Id: I53272081094b8948a40a1ce409af08b6ef330c1e
Signed-off-by: Jonathan Nieder <jrn@google.com>
Signed-off-by: Matthias Sohn <matthias.sohn@sap.com>

diff --cc org.eclipse.jgit.test/tst/org/eclipse/jgit/lib/ObjectCheckerTest.java
Simple merge

diff --cc org.eclipse.jgit.test/tst/org/eclipse/jgit/submodule/SubmoduleAddTest.java
index 0676eab2d671aec97748504ded9abb4ca20fff97,57809734c3e38f9e0984ff6fcb550524bcb28403..1ff64a2e288ba9263cef25404b47b17004527ff5
--- 1/org.eclipse.jgit.test/tst/org/eclipse/jgit/submodule/SubmoduleAddTest.java
--- 2/org.eclipse.jgit.test/tst/org/eclipse/jgit/submodule/SubmoduleAddTest.java
+++ b/org.eclipse.jgit.test/tst/org/eclipse/jgit/submodule/SubmoduleAddTest.java
@@@ -225,6 -183,37 +225,34 @@@ public class SubmoduleAddTest extends R
                }
        }
  
 -              // TODO(ms) set name to a valid value in 5.1.0 and adapt expected
 -              // message below
+       @Test
+       public void addSubmoduleWithInvalidPath() throws Exception {
+               SubmoduleAddCommand command = new SubmoduleAddCommand(db);
+               command.setPath("-invalid-path");
 -                      // TODO(ms) should check for submodule path, but can't set name
 -                      // before 5.1.0
 -                      assertEquals("Invalid submodule name '-invalid-path'",
++              command.setName("sub");
+               command.setURI("http://example.com/repo/x.git");
+               try {
+                       command.call().close();
+                       fail("Exception not thrown");
+               } catch (IllegalArgumentException e) {
++                      assertEquals("Invalid submodule path '-invalid-path'",
+                                       e.getMessage());
+               }
+       }
+ 
+       @Test
+       public void addSubmoduleWithInvalidUri() throws Exception {
+               SubmoduleAddCommand command = new SubmoduleAddCommand(db);
+               command.setPath("valid-path");
+               command.setURI("-upstream");
+               try {
+                       command.call().close();
+                       fail("Exception not thrown");
+               } catch (IllegalArgumentException e) {
+                       assertEquals("Invalid submodule URL '-upstream'", e.getMessage());
+               }
+       }
+ 
        @Test
        public void addSubmoduleWithRelativeUri() throws Exception {
                try (Git git = new Git(db)) {

diff --cc org.eclipse.jgit.test/tst/org/eclipse/jgit/transport/ReceivePackAdvertiseRefsHookTest.java
Simple merge

diff --cc org.eclipse.jgit/.settings/.api_filters
index 9e56703c5798e87265ae150b7a18aaf24e53af53,089510ac51542fde4d173ee90cf2038551c8e7bf..282d7e8962cc79db3962b15631de67a73cc702e4
--- 1/org.eclipse.jgit/.settings/.api_filters
--- 2/org.eclipse.jgit/.settings/.api_filters
+++ b/org.eclipse.jgit/.settings/.api_filters
@@@ -3,14 -3,8 +3,8 @@@
      <resource path="META-INF/MANIFEST.MF">
          <filter id="924844039">
              <message_arguments>
 -                <message_argument value="5.0.4"/>
 -                <message_argument value="5.0.0"/>
++                <message_argument value="5.1.2"/>
 +                <message_argument value="5.1.0"/>
-                 <message_argument value="5.1.0"/>
-             </message_arguments>
-         </filter>
-         <filter id="924844039">
-             <message_arguments>
-                 <message_argument value="5.0.4"/>
-                 <message_argument value="5.0.0"/>
              </message_arguments>
          </filter>
      </resource>

diff --cc org.eclipse.jgit/resources/org/eclipse/jgit/internal/JGitText.properties
Simple merge

diff --cc org.eclipse.jgit/src/org/eclipse/jgit/api/SubmoduleAddCommand.java
index b8d4468a2c0c476f99e2b14ef73d110abc19dcfa,9d9626f5a499ccb41629991b8253d88f43189220..244a15686fc0cc0947f2231709c48f93f801d1ed
--- 1/org.eclipse.jgit/src/org/eclipse/jgit/api/SubmoduleAddCommand.java
--- 2/org.eclipse.jgit/src/org/eclipse/jgit/api/SubmoduleAddCommand.java
+++ b/org.eclipse.jgit/src/org/eclipse/jgit/api/SubmoduleAddCommand.java
@@@ -174,26 -161,15 +175,34 @@@ public class SubmoduleAddCommand extend
                        throw new IllegalArgumentException(JGitText.get().pathNotConfigured);
                if (uri == null || uri.length() == 0)
                        throw new IllegalArgumentException(JGitText.get().uriNotConfigured);
 +              if (name == null || name.length() == 0) {
 +                      // Use the path as the default.
 +                      name = path;
 +              }
 +              if (name.contains("/../") || name.contains("\\..\\") //$NON-NLS-1$ //$NON-NLS-2$
 +                              || name.startsWith("../") || name.startsWith("..\\") //$NON-NLS-1$ //$NON-NLS-2$
 +                              || name.endsWith("/..") || name.endsWith("\\..")) { //$NON-NLS-1$ //$NON-NLS-2$
 +                      // Submodule names are used to store the submodule repositories
 +                      // under $GIT_DIR/modules. Having ".." in submodule names makes a
 +                      // vulnerability (CVE-2018-11235
 +                      // https://bugs.eclipse.org/bugs/show_bug.cgi?id=535027#c0)
 +                      // Reject the names with them. The callers need to make sure the
 +                      // names free from these. We don't automatically replace these
 +                      // characters or canonicalize by regarding the name as a file path.
 +                      // Since Path class is platform dependent, we manually check '/' and
 +                      // '\\' patterns here.
 +                      throw new IllegalArgumentException(MessageFormat
 +                                      .format(JGitText.get().invalidNameContainsDotDot, name));
 +              }
  
 -                      SubmoduleValidator.assertValidSubmoduleName(path);
+               try {
++                      SubmoduleValidator.assertValidSubmoduleName(name);
+                       SubmoduleValidator.assertValidSubmodulePath(path);
+                       SubmoduleValidator.assertValidSubmoduleUri(uri);
+               } catch (SubmoduleValidator.SubmoduleValidationException e) {
+                       throw new IllegalArgumentException(e.getMessage());
+               }
+ 
                try {
                        if (submoduleExists())
                                throw new JGitInternalException(MessageFormat.format(

diff --cc org.eclipse.jgit/src/org/eclipse/jgit/internal/JGitText.java
Simple merge

diff --cc pom.xml
Simple merge