changeset & lint

Author: steveukx

.changeset/pink-and-gold.md

@@ -0,0 +1,5 @@
+---
+'simple-git': minor
+---
+
+Adds vulnerability detection to prevent use of `--upload-pack` and `--receive-pack` without explicitly opting in. 

simple-git/test/unit/plugin.unsafe.spec.ts

@@ -1,16 +1,20 @@
-import { promiseError } from "@kwsites/promise-result";
-import { assertExecutedCommands, assertGitError, closeWithSuccess, newSimpleGit } from "./__fixtures__";
-
-describe("blockUnsafeOperationsPlugin", () => {
-
+import { promiseError } from '@kwsites/promise-result';
+import {
+   assertExecutedCommands,
+   assertGitError,
+   closeWithSuccess,
+   newSimpleGit,
+} from './__fixtures__';
+
+describe('blockUnsafeOperationsPlugin', () => {
    it.each([
-      ["cmd", "--upload-pack=touch /tmp/pwn0"],
-      ["cmd", "--receive-pack=touch /tmp/pwn1"],
-      ["clone", "-u touch /tmp/pwn"]
-   ])("allows %s %s only when using override", async (cmd, option) => {
+      ['cmd', '--upload-pack=touch /tmp/pwn0'],
+      ['cmd', '--receive-pack=touch /tmp/pwn1'],
+      ['clone', '-u touch /tmp/pwn'],
+   ])('allows %s %s only when using override', async (cmd, option) => {
       assertGitError(
          await promiseError(newSimpleGit({ unsafe: {} }).raw(cmd, option)),
-         "allowUnsafePack"
+         'allowUnsafePack'
       );
 
       const err = promiseError(
@@ -22,76 +26,63 @@ describe("blockUnsafeOperationsPlugin", () => {
       assertExecutedCommands(cmd, option);
    });
 
-   it("allows -u for non-clone commands", async () => {
+   it('allows -u for non-clone commands', async () => {
       const git = newSimpleGit({ unsafe: {} });
-      const err = promiseError(
-         git.raw("push", "-u", "origin/main")
-      );
+      const err = promiseError(git.raw('push', '-u', 'origin/main'));
 
       await closeWithSuccess();
       expect(await err).toBeUndefined();
-      assertExecutedCommands("push", "-u", "origin/main");
+      assertExecutedCommands('push', '-u', 'origin/main');
    });
 
-   it("blocks -u for clone command", async () => {
+   it('blocks -u for clone command', async () => {
       const git = newSimpleGit({ unsafe: {} });
-      const err = promiseError(
-         git.clone("-u touch /tmp/pwn", "file:///tmp/zero12")
-      );
+      const err = promiseError(git.clone('-u touch /tmp/pwn', 'file:///tmp/zero12'));
 
-      assertGitError(await err, "allowUnsafePack");
+      assertGitError(await err, 'allowUnsafePack');
    });
 
-   it("allows -u for clone command with override", async () => {
+   it('allows -u for clone command with override', async () => {
       const git = newSimpleGit({ unsafe: { allowUnsafePack: true } });
-      const err = promiseError(
-         git.clone("-u touch /tmp/pwn", "file:///tmp/zero12")
-      );
+      const err = promiseError(git.clone('-u touch /tmp/pwn', 'file:///tmp/zero12'));
 
       await closeWithSuccess();
       expect(await err).toBeUndefined();
-      assertExecutedCommands("clone", "-u touch /tmp/pwn", "file:///tmp/zero12");
+      assertExecutedCommands('clone', '-u touch /tmp/pwn', 'file:///tmp/zero12');
    });
 
-   it("blocks pull --upload-pack", async () => {
+   it('blocks pull --upload-pack', async () => {
       const git = newSimpleGit({ unsafe: {} });
-      const err = await promiseError(
-         git.pull("--upload-pack=touch /tmp/pwn0", "master")
-      );
+      const err = await promiseError(git.pull('--upload-pack=touch /tmp/pwn0', 'master'));
 
-      assertGitError(err, "allowUnsafePack");
+      assertGitError(err, 'allowUnsafePack');
    });
 
-   it("blocks push --receive-pack", async () => {
+   it('blocks push --receive-pack', async () => {
       const git = newSimpleGit({ unsafe: {} });
-      const err = await promiseError(
-         git.push("--receive-pack=touch /tmp/pwn1", "master")
-      );
+      const err = await promiseError(git.push('--receive-pack=touch /tmp/pwn1', 'master'));
 
-      assertGitError(err, "allowUnsafePack");
+      assertGitError(err, 'allowUnsafePack');
    });
 
-   it("blocks raw --upload-pack", async () => {
+   it('blocks raw --upload-pack', async () => {
       const git = newSimpleGit({ unsafe: {} });
-      const err = await promiseError(git.raw("pull", `--upload-pack=touch /tmp/pwn0`));
+      const err = await promiseError(git.raw('pull', `--upload-pack=touch /tmp/pwn0`));
 
-      assertGitError(err, "allowUnsafePack");
+      assertGitError(err, 'allowUnsafePack');
    });
 
-   it("blocks raw --receive-pack", async () => {
+   it('blocks raw --receive-pack', async () => {
       const git = newSimpleGit({ unsafe: {} });
-      const err = await promiseError(git.raw("push", `--receive-pack=touch /tmp/pwn1`));
+      const err = await promiseError(git.raw('push', `--receive-pack=touch /tmp/pwn1`));
 
-      assertGitError(err, "allowUnsafePack");
+      assertGitError(err, 'allowUnsafePack');
    });
 
-   it("blocks listRemote --upload-pack", async () => {
+   it('blocks listRemote --upload-pack', async () => {
       const git = newSimpleGit({ unsafe: {} });
-      const err = await promiseError(
-         git.listRemote(["--upload-pack=touch /tmp/pwn2", "main"])
-      );
+      const err = await promiseError(git.listRemote(['--upload-pack=touch /tmp/pwn2', 'main']));
 
-      assertGitError(err, "allowUnsafePack");
+      assertGitError(err, 'allowUnsafePack');
    });
-
 });