mirrors/jgit - jgit - source @ dussan.org

History

David Ostrovsky 8cd07cb815 Repository: Add getIdentifier() method to avoid instanceof operator This change is needed to implement permission aware ref database in Gerrit: [1], that is a pre-requisite to re-enable Git v2 protocol in Gerrit: [2]. Background: Last year Git v2 protocol was enabled in Gerrit. The fact, that JGit layer was not calling ref advertise filter for Git v2 protocol, introduced security vulnerability. The lesson learned from this security incident: Gerrit should not rely on ref advertise filter being called by JGit to implement crictical security checks. Instead, the idea is to use the same approach as currently used by Google's internal code on googlesource.com that didn't suffer from this vulnerability: provide a custom repository to JGit. The repository provides a RefDatabase that is permission-aware and will only ever return refs that the user has access to. However, due to hard coded instanceof operator usages in JGit code base, some tests in Gerrit are failing with: [1] in place. This change addresses this problem. [1] https://gerrit-review.googlesource.com/c/gerrit/+/212874 [2] https://gerrit-review.googlesource.com/c/gerrit/+/226754 Change-Id: I67c0f53ca33b149442e7ee3e51910d19e3f348d5 Signed-off-by: David Ostrovsky <david@ostrovsky.org> Signed-off-by: Matthias Sohn <matthias.sohn@sap.com>		5 years ago
..
.settings	Disable Eclipse warning about unrecognized @SuppressWarnings value	5 years ago
META-INF	Add missing source bundles and add them to a single source feature	5 years ago
resources/org/eclipse/jgit/http/server	Skip logging stack trace on corrupt objects	9 years ago
src/org/eclipse/jgit/http/server	Repository: Add getIdentifier() method to avoid instanceof operator	5 years ago
.classpath	Change JGit minimum execution environment to JavaSE-1.8	7 years ago
.fbprefs	Simple dumb HTTP server for Git	14 years ago
.gitignore	Simple dumb HTTP server for Git	14 years ago
.project	Enforce the use of Java5 API:s only (with a few exceptions)	12 years ago
BUILD	Bazel: Restrict src globs to Java source files	7 years ago
about.html	Add missing about.html files to all shipped bundles	13 years ago
build.properties	Add missing resources from source.. in build.properties	10 years ago
plugin.properties	Fix plugin provider names to conform with release train requirement	11 years ago
pom.xml	Add missing source bundles and add them to a single source feature	5 years ago