joey@darkstar:/tmp/empty>git init sub1
Initialized empty Git repository in /tmp/empty/sub1/.git/
joey@darkstar:/tmp/empty>git init sub2
Initialized empty Git repository in /tmp/empty/sub2/.git/
joey@darkstar:/tmp/empty>cd sub1
joey@darkstar:/tmp/empty/sub1>date > f1 ; git add f1; git commit -m add -q
joey@darkstar:/tmp/empty/sub1>cd ..
joey@darkstar:/tmp/empty>cd sub2
joey@darkstar:/tmp/empty/sub2>date > f2 ; git add f2; git commit -m add -q
joey@darkstar:/tmp/empty/sub2>cd ..
joey@darkstar:/tmp/empty>git init repo
Initialized empty Git repository in /tmp/empty/repo/.git/
joey@darkstar:/tmp/empty>cd repo
joey@darkstar:/tmp/empty/repo>git submodule add ../sub1 1
Cloning into '1'...
done.
joey@darkstar:/tmp/empty/repo>cd 1
joey@darkstar:/tmp/empty/repo/1>ls
f1
joey@darkstar:/tmp/empty/repo/1>git submodule add ../../sub2 2
fatal: repository '/tmp/sub2' does not exist
fatal: clone of '/tmp/sub2' into submodule path '2' failed

Like the bug I filed yesterday, this is caused by git submodule add's
chdir into .git/modules.

Workaround is to pass absolute paths to git submodule add.

Note that this could be an exploitable security hole under some unusual
circumstances. In the example above, any other local user could create a
/tmp/sub2 containing something nasty, and git would check it out
accidentially.

git version 2.7.0

-- 
see shy jo

Attachment: signature.asc
Description: PGP signature

Reply via email to