config: reject bogus section names for --rename-section

You can feed junk to "git config --rename-section", which
will result in a config file that git will not even parse
(so you cannot fix it with git-config). We already have
syntactic sanity checks when setting a variable; let's do
the same for section names.

Signed-off-by: Jeff King <peff@peff.net>
Signed-off-by: Junio C Hamano <gitster@pobox.com>

diff --git a/config.c b/config.c
index 68d32940f3f8f1512fa36702beb98c2457ca5d46..9ef947e073f487c035d0317572fe3733de8f0ad5 100644 (file)
--- a/config.c
+++ b/config.c
@@ -1552,20 +1552,42 @@ static int section_name_match (const char *buf, const char *name)
        return 0;
 }
 
+static int section_name_is_ok(const char *name)
+{
+       /* Empty section names are bogus. */
+       if (!*name)
+               return 0;
+
+       /*
+        * Before a dot, we must be alphanumeric or dash. After the first dot,
+        * anything goes, so we can stop checking.
+        */
+       for (; *name && *name != '.'; name++)
+               if (*name != '-' && !isalnum(*name))
+                       return 0;
+       return 1;
+}
+
 /* if new_name == NULL, the section is removed instead */
 int git_config_rename_section_in_file(const char *config_filename,
                                      const char *old_name, const char *new_name)
 {
        int ret = 0, remove = 0;
        char *filename_buf = NULL;
-       struct lock_file *lock = xcalloc(sizeof(struct lock_file), 1);
+       struct lock_file *lock;
        int out_fd;
        char buf[1024];
        FILE *config_file;
 
+       if (new_name && !section_name_is_ok(new_name)) {
+               ret = error("invalid section name: %s", new_name);
+               goto out;
+       }
+
        if (!config_filename)
                config_filename = filename_buf = git_pathdup("config");
 
+       lock = xcalloc(sizeof(struct lock_file), 1);
        out_fd = hold_lock_file_for_update(lock, config_filename, 0);
        if (out_fd < 0) {
                ret = error("could not lock config file %s", config_filename);

diff --git a/t/t1300-repo-config.sh b/t/t1300-repo-config.sh
index 36e227b3bb25cb17dabc5e205e63056e7fd0b370..a477453e2ef8ffedafb2dd05e00f507cd112bc97 100755 (executable)
--- a/t/t1300-repo-config.sh
+++ b/t/t1300-repo-config.sh
@@ -550,6 +550,14 @@ EOF
 
 test_expect_success "rename succeeded" "test_cmp expect .git/config"
 
+test_expect_success 'renaming empty section name is rejected' '
+       test_must_fail git config --rename-section branch.zwei ""
+'
+
+test_expect_success 'renaming to bogus section is rejected' '
+       test_must_fail git config --rename-section branch.zwei "bogus name"
+'
+
 cat >> .git/config << EOF
   [branch "zwei"] a = 1 [branch "vier"]
 EOF