mirror of
https://github.com/libgit2/libgit2.git
synced 2026-06-22 06:26:26 +00:00
93a9044ff6
If fetching from an anonymous remote via its URL, then the URL gets written into the FETCH_HEAD reference. This is mainly done to give valuable context to some commands, like for example git-merge(1), which will put the URL into the generated MERGE_MSG. As a result, what gets written into FETCH_HEAD may become public in some cases. This is especially important considering that URLs may contain credentials, e.g. when cloning 'https://foo:bar@example.com/repo' we persist the complete URL into FETCH_HEAD and put it without any kind of sanitization into the MERGE_MSG. This is obviously bad, as your login data has now just leaked as soon as you do git-push(1). When writing the URL into FETCH_HEAD, upstream git does strip credentials first. Let's do the same by trying to parse the remote URL as a "real" URL, removing any credentials and then re-formatting the URL. In case this fails, e.g. when it's a file path or not a valid URL, we just fall back to using the URL as-is without any sanitization. Add tests to verify our behaviour.
Writing Clar tests for libgit2
For information on the Clar testing framework and a detailed introduction please visit:
-
Write your modules and tests. Use good, meaningful names.
-
Make sure you actually build the tests by setting:
cmake -DBUILD_CLAR=ON build/ -
Test:
./build/libgit2_clar -
Make sure everything is fine.
-
Send your pull request. That's it.
Memory leak checks
These are automatically run as part of CI, but if you want to check locally:
Linux
Uses valgrind:
$ cmake -DBUILD_CLAR=ON -DVALGRIND=ON ..
$ cmake --build .
$ valgrind --leak-check=full --show-reachable=yes --num-callers=50 --suppressions=../libgit2_clar.supp \
./libgit2_clar
macOS
Uses leaks, which requires XCode installed:
$ MallocStackLogging=1 MallocScribble=1 MallocLogFile=/dev/null CLAR_AT_EXIT="leaks -quiet \$PPID" \
./libgit2_clar