Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Repository: don't crash accessing invalid pathinfo #443

Merged
merged 5 commits into from Jan 19, 2022

Conversation

muesli
Copy link
Contributor

@muesli muesli commented Jan 9, 2022

When fs.Stat returns an error, pathinfo may be nil. In such situations
the only safe response seems to be to return the error to the caller.

Without this fix, accessing pathinfo.IsDir() below would lead to a crash
dereferencing a nil pointer.

This crash can be reproduced by trying to initialize a Git repo with an
invalid path name.

Also see: muesli/gitty#36

@mcuadros
Copy link
Member

can you provide a test?

@muesli
Copy link
Contributor Author

muesli commented Jan 14, 2022

can you provide a test?

I thought about it, but it's actually a little tricky: it's triggered by an invalid path name that can't be Stat'd, but what constitutes an invalid path name very much depends on the platform and filesystem the test is being run on. I can write a test that works fine on GitHub's CI, but it may not produce the expected error on your local machine. I'll see if there's an easy way to provoke an error consistent across platforms.

When fs.Stat returns an error, pathinfo may be nil. In such situations
the only safe response seems to be to return the error to the caller.

Without this fix, accessing pathinfo.IsDir() below would lead to a crash
dereferencing a nil pointer.

This crash can be reproduced by trying to initialize a Git repo with an
invalid path name.

Also see: muesli/gitty#36
@muesli
Copy link
Contributor Author

muesli commented Jan 14, 2022

Ok, turns out this was easier than anticipated: a path \000 should be invalid everywhere. I've added a test that would segfault without the proposed fix.

@mcuadros mcuadros changed the title fix: don't crash accessing invalid pathinfo Repository: don't crash accessing invalid pathinfo Jan 19, 2022
@mcuadros mcuadros merged commit 935af59 into go-git:master Jan 19, 2022
@muesli muesli deleted the invalid-path-crash branch January 19, 2022 17:51
gibchikafa pushed a commit to gibchikafa/go-git that referenced this pull request Nov 23, 2022
When fs.Stat returns an error, pathinfo may be nil. In such situations
the only safe response seems to be to return the error to the caller.

Without this fix, accessing pathinfo.IsDir() below would lead to a crash
dereferencing a nil pointer.

This crash can be reproduced by trying to initialize a Git repo with an
invalid path name.

Also see: muesli/gitty#36
andrewpollock pushed a commit to google/osv.dev that referenced this pull request Dec 5, 2022
[![Mend
Renovate](https://app.renovatebot.com/images/banner.svg)](https://renovatebot.com)

This PR contains the following updates:

| Package | Type | Update | Change |
|---|---|---|---|
|
[cloud.google.com/go/datastore](https://togithub.com/googleapis/google-cloud-go)
| require | minor | `v1.8.0` -> `v1.10.0` |
|
[cloud.google.com/go/pubsub](https://togithub.com/googleapis/google-cloud-go)
| require | minor | `v1.24.0` -> `v1.27.1` |
|
[cloud.google.com/go/storage](https://togithub.com/googleapis/google-cloud-go)
| require | minor | `v1.24.0` -> `v1.28.1` |
| [github.com/go-git/go-git/v5](https://togithub.com/go-git/go-git) |
require | minor | `v5.4.2` -> `v5.5.0` |
| [github.com/google/go-cmp](https://togithub.com/google/go-cmp) |
require | patch | `v0.5.8` -> `v0.5.9` |
| [golang.org/x/sync](https://togithub.com/golang/sync) | require |
minor | `v0.0.0-20220601150217-0de741cfad7f` -> `v0.1.0` |
|
[google.golang.org/api](https://togithub.com/googleapis/google-api-go-client)
| require | minor | `v0.91.0` -> `v0.103.0` |

---

### Release Notes

<details>
<summary>go-git/go-git</summary>

### [`v5.5.0`](https://togithub.com/go-git/go-git/releases/tag/v5.5.0)

[Compare
Source](https://togithub.com/go-git/go-git/compare/v5.4.2...v5.5.0)

#### What's Changed

- \*: add collision resistent SHA1 implementation by
[@&#8203;pjbgf](https://togithub.com/pjbgf) in
[go-git/go-git#618
- \*: replace go-homedir with os.UserHomeDir by
[@&#8203;mvdan](https://togithub.com/mvdan) in
[go-git/go-git#535
- Remote: add RemoteURL to {Fetch,Pull,Push}Options by
[@&#8203;noerw](https://togithub.com/noerw) in
[go-git/go-git#375
- Remote: Push, add support to push commits per hashes by
[@&#8203;tjamet](https://togithub.com/tjamet) in
[go-git/go-git#325
- Remote: Push, add ForceWithLease Push Option by
[@&#8203;john-cai](https://togithub.com/john-cai) in
[go-git/go-git#404
- Remote: PushOptions add push-options by
[@&#8203;S-Bohn](https://togithub.com/S-Bohn) in
[go-git/go-git#399
- Remote: Push, add atomic to push options by
[@&#8203;john-cai](https://togithub.com/john-cai) in
[go-git/go-git#406
- Remote: add FollowTags option for pushes by
[@&#8203;john-cai](https://togithub.com/john-cai) in
[go-git/go-git#385
- Worktree: use syscall.Timespec.Unix by
[@&#8203;tklauser](https://togithub.com/tklauser) in
[go-git/go-git#437
- Worktree: Checkout, simplified sparse checkout by
[@&#8203;john-cai](https://togithub.com/john-cai) in
[go-git/go-git#410
- Repository: don't crash accessing invalid pathinfo by
[@&#8203;muesli](https://togithub.com/muesli) in
[go-git/go-git#443
- storage: filesystem, switch from os.SEEK_\* to io.Seek\* by
[@&#8203;abhinav](https://togithub.com/abhinav) in
[go-git/go-git#421
- config: add branch description support by
[@&#8203;ninedraft](https://togithub.com/ninedraft) in
[go-git/go-git#409
- revision: fix endless looping in revision parser by
[@&#8203;michenriksen](https://togithub.com/michenriksen) in
[go-git/go-git#475
- pumbling: optimise zlib reader and consolidate sync.Pools by
[@&#8203;pjbgf](https://togithub.com/pjbgf) in
[go-git/go-git#608
- pumbling: parse optimisations by
[@&#8203;pjbgf](https://togithub.com/pjbgf) in
[go-git/go-git#602
- plumbing: object, rename calculation uses too much memory by
[@&#8203;jfontan](https://togithub.com/jfontan) in
[go-git/go-git#503
- plumbing: protocol/pakp and server, include the contents of
`GO_GIT_USER_AGENT_EXTRA`. Fixes
[#&#8203;529](https://togithub.com/go-git/go-git/issues/529) by
[@&#8203;stewing](https://togithub.com/stewing) in
[go-git/go-git#531
- plumbing: protocol/pakp, avoid duplicate encoding when overriding a
Capability value. by [@&#8203;tylerchr](https://togithub.com/tylerchr)
in
[go-git/go-git#521
- plumbing: protocol/pakp, update agent by
[@&#8203;caarlos0](https://togithub.com/caarlos0) in
[go-git/go-git#453
- plumbing: protocol/pakp: Actions should have type Action by
[@&#8203;abhinav](https://togithub.com/abhinav) in
[go-git/go-git#420
- plumbing: protocol/pakp: allow unsupported `multi_ack` capability by
[@&#8203;pjbgf](https://togithub.com/pjbgf) in
[go-git/go-git#613
- plumbing: transport/ssh, auto-populate HostKeyAlgorithms. Fixes
[#&#8203;411](https://togithub.com/go-git/go-git/issues/411) by
[@&#8203;evanelias](https://togithub.com/evanelias) in
[go-git/go-git#548
- pumbling: format/packfile, resolve external reference delta by
[@&#8203;ga-paul-t](https://togithub.com/ga-paul-t) in
[go-git/go-git#392
- plumbing: format/packfile, prevent large objects from being read into
memory completely by [@&#8203;zeripath](https://togithub.com/zeripath)
in
[go-git/go-git#330
- plumbing: format/index, support v3 index by
[@&#8203;john-cai](https://togithub.com/john-cai) in
[go-git/go-git#407
- plumbing: format/gitignore, Read .git/info/exclude file too. by
[@&#8203;enisdenjo](https://togithub.com/enisdenjo) in
[go-git/go-git#402
- plumbing: format/gitattributes, Avoid index out of range by
[@&#8203;To1ne](https://togithub.com/To1ne) in
[go-git/go-git#598
- plumbing: format/config, Branch name with hash can be cloned. Fixes
[#&#8203;309](https://togithub.com/go-git/go-git/issues/309) by
[@&#8203;dowy](https://togithub.com/dowy) in
[go-git/go-git#354
- go.mod: update github.com/xanzy/ssh-agent to v0.3.1 by
[@&#8203;tklauser](https://togithub.com/tklauser) in
[go-git/go-git#403
- go.mod: update dependencies to remove supply chain CVEs by
[@&#8203;pjbgf](https://togithub.com/pjbgf) in
[go-git/go-git#620
- examples: added "tag find if head is tagged" by
[@&#8203;snebel29](https://togithub.com/snebel29) in
[go-git/go-git#374
- examples: remote fix typo by
[@&#8203;nep-0](https://togithub.com/nep-0) in
[go-git/go-git#408

**Full Changelog**:
go-git/go-git@v5.4.2...v5.5.0

</details>

<details>
<summary>google/go-cmp</summary>

### [`v0.5.9`](https://togithub.com/google/go-cmp/releases/tag/v0.5.9)

[Compare
Source](https://togithub.com/google/go-cmp/compare/v0.5.8...v0.5.9)

Reporter changes:

- ([#&#8203;299](https://togithub.com/google/go-cmp/issues/299)) Adjust
heuristic for line-based versus byte-based diffing
- ([#&#8203;306](https://togithub.com/google/go-cmp/issues/306)) Use
`value.TypeString` in `PathStep.String`

Code cleanup changes:

- ([#&#8203;297](https://togithub.com/google/go-cmp/issues/297)) Use
`reflect.Value.IsZero`
- ([#&#8203;304](https://togithub.com/google/go-cmp/issues/304)) Format
with Go 1.19 formatter
- ([#&#8203;300](https://togithub.com/google/go-cmp/issues/300) )Fix
typo in Result documentation
- ([#&#8203;302](https://togithub.com/google/go-cmp/issues/302))
Pre-declare global type variables
- ([#&#8203;309](https://togithub.com/google/go-cmp/issues/309)) Run
tests on Go 1.19

</details>

<details>
<summary>googleapis/google-api-go-client</summary>

###
[`v0.103.0`](https://togithub.com/googleapis/google-api-go-client/releases/tag/v0.103.0)

[Compare
Source](https://togithub.com/googleapis/google-api-go-client/compare/v0.102.0...v0.103.0)

##### Features

- **all:** Auto-regenerate discovery clients
([#&#8203;1737](https://togithub.com/googleapis/google-api-go-client/issues/1737))
([de99200](https://togithub.com/googleapis/google-api-go-client/commit/de9920088db16562740c31183eca6651f669e582))
- **all:** Auto-regenerate discovery clients
([#&#8203;1739](https://togithub.com/googleapis/google-api-go-client/issues/1739))
([bbd4259](https://togithub.com/googleapis/google-api-go-client/commit/bbd42597f4710f527f83fd900cb7f9e6706bc195))
- **all:** Auto-regenerate discovery clients
([#&#8203;1743](https://togithub.com/googleapis/google-api-go-client/issues/1743))
([4248dc3](https://togithub.com/googleapis/google-api-go-client/commit/4248dc3db6b32d00720293980fb8e845b684fbd8))
- **googleapi:** Inject gax apierror.APIError into googleapi.Error
([#&#8203;1730](https://togithub.com/googleapis/google-api-go-client/issues/1730))
([ee25e29](https://togithub.com/googleapis/google-api-go-client/commit/ee25e29fd586cde25a006504d0059194a90f19ac))
- Rm hard dep on x/sys
([#&#8203;1742](https://togithub.com/googleapis/google-api-go-client/issues/1742))
([9695aa1](https://togithub.com/googleapis/google-api-go-client/commit/9695aa13a084c1ad9857db4a6c12d57e13fc00dc))

###
[`v0.102.0`](https://togithub.com/googleapis/google-api-go-client/releases/tag/v0.102.0)

[Compare
Source](https://togithub.com/googleapis/google-api-go-client/compare/v0.101.0...v0.102.0)

##### Features

- **all:** Auto-regenerate discovery clients
([#&#8203;1725](https://togithub.com/googleapis/google-api-go-client/issues/1725))
([06360d8](https://togithub.com/googleapis/google-api-go-client/commit/06360d8f37b88e064a8a60788077f376b597d942))
- **all:** Auto-regenerate discovery clients
([#&#8203;1727](https://togithub.com/googleapis/google-api-go-client/issues/1727))
([1e1eab9](https://togithub.com/googleapis/google-api-go-client/commit/1e1eab98aac0e967a6c52b65fe9eb5a4d6d8a946))
- **all:** Auto-regenerate discovery clients
([#&#8203;1734](https://togithub.com/googleapis/google-api-go-client/issues/1734))
([ce57a67](https://togithub.com/googleapis/google-api-go-client/commit/ce57a67eddb98f3ccd21c1c01dfcb18df0d77009))
- Rely on new compute metadata module directly
([#&#8203;1736](https://togithub.com/googleapis/google-api-go-client/issues/1736))
([0528475](https://togithub.com/googleapis/google-api-go-client/commit/0528475d51393bb6e3244816d9c6ea8c16275677))

###
[`v0.101.0`](https://togithub.com/googleapis/google-api-go-client/releases/tag/v0.101.0)

[Compare
Source](https://togithub.com/googleapis/google-api-go-client/compare/v0.100.0...v0.101.0)

##### Features

- **all:** Auto-regenerate discovery clients
([#&#8203;1718](https://togithub.com/googleapis/google-api-go-client/issues/1718))
([453b81a](https://togithub.com/googleapis/google-api-go-client/commit/453b81ac138e6572e9d6a3373c033c5abbcefbcc))
- **all:** Auto-regenerate discovery clients
([#&#8203;1720](https://togithub.com/googleapis/google-api-go-client/issues/1720))
([9140608](https://togithub.com/googleapis/google-api-go-client/commit/91406081538e06ab580f59d6fba001dc34f8574a))
- **all:** Auto-regenerate discovery clients
([#&#8203;1723](https://togithub.com/googleapis/google-api-go-client/issues/1723))
([f4788b3](https://togithub.com/googleapis/google-api-go-client/commit/f4788b325bd76337216a54e02e49cec4e3ee6987))

###
[`v0.100.0`](https://togithub.com/googleapis/google-api-go-client/releases/tag/v0.100.0)

[Compare
Source](https://togithub.com/googleapis/google-api-go-client/compare/v0.99.0...v0.100.0)

##### Features

- **all:** Auto-regenerate discovery clients
([#&#8203;1712](https://togithub.com/googleapis/google-api-go-client/issues/1712))
([f9e15f2](https://togithub.com/googleapis/google-api-go-client/commit/f9e15f2159928974af1a2ec539e20f17f94aab4d))
- **all:** Auto-regenerate discovery clients
([#&#8203;1717](https://togithub.com/googleapis/google-api-go-client/issues/1717))
([f990a2a](https://togithub.com/googleapis/google-api-go-client/commit/f990a2af6cd6210c8764bbe273a575886ea97038))
- **internal/gensupport:** Remove DetermineContentType, use gax-go copy
([#&#8203;1716](https://togithub.com/googleapis/google-api-go-client/issues/1716))
([37f90e9](https://togithub.com/googleapis/google-api-go-client/commit/37f90e974e83f06962ac923c502cd1b405c7f0fb))

##### Bug Fixes

- **idtoken:** Allow missing age in http response header
([#&#8203;1715](https://togithub.com/googleapis/google-api-go-client/issues/1715))
([b235b1f](https://togithub.com/googleapis/google-api-go-client/commit/b235b1f8c718be6b8f361074d371768617a3da3a))

###
[`v0.99.0`](https://togithub.com/googleapis/google-api-go-client/releases/tag/v0.99.0)

[Compare
Source](https://togithub.com/googleapis/google-api-go-client/compare/v0.98.0...v0.99.0)

##### Features

- **all:** Auto-regenerate discovery clients
([#&#8203;1701](https://togithub.com/googleapis/google-api-go-client/issues/1701))
([6b81c83](https://togithub.com/googleapis/google-api-go-client/commit/6b81c8355addd65f718bb9195e1c2356117e1a1b))

###
[`v0.98.0`](https://togithub.com/googleapis/google-api-go-client/releases/tag/v0.98.0)

[Compare
Source](https://togithub.com/googleapis/google-api-go-client/compare/v0.97.0...v0.98.0)

##### Features

- **all:** Auto-regenerate discovery clients
([#&#8203;1696](https://togithub.com/googleapis/google-api-go-client/issues/1696))
([aa775b4](https://togithub.com/googleapis/google-api-go-client/commit/aa775b41d2e419002d4e7e7a390745dd2d07110a))
- **all:** Auto-regenerate discovery clients
([#&#8203;1699](https://togithub.com/googleapis/google-api-go-client/issues/1699))
([25b7450](https://togithub.com/googleapis/google-api-go-client/commit/25b7450d0d9efc46d4095d827f597ac85bb8b5b4))

###
[`v0.97.0`](https://togithub.com/googleapis/google-api-go-client/releases/tag/v0.97.0)

[Compare
Source](https://togithub.com/googleapis/google-api-go-client/compare/v0.96.0...v0.97.0)

##### Features

- **all:** Auto-regenerate discovery clients
([#&#8203;1693](https://togithub.com/googleapis/google-api-go-client/issues/1693))
([a87400b](https://togithub.com/googleapis/google-api-go-client/commit/a87400be9341608f73e9ae1b5dbbecc7adfbf609))
- **all:** Auto-regenerate discovery clients
([#&#8203;1695](https://togithub.com/googleapis/google-api-go-client/issues/1695))
([b8f2556](https://togithub.com/googleapis/google-api-go-client/commit/b8f25561a76841c7549a358925eb7bfc2236465e))
- **internal/gensupport:** Wrap retry failures with context and prev
error
([#&#8203;1684](https://togithub.com/googleapis/google-api-go-client/issues/1684))
([f427ee3](https://togithub.com/googleapis/google-api-go-client/commit/f427ee3edede981524c2ffb57fd2d8981f8cf8b4)),
refs
[#&#8203;1685](https://togithub.com/googleapis/google-api-go-client/issues/1685)

##### Bug Fixes

- Build script bash error
([#&#8203;1697](https://togithub.com/googleapis/google-api-go-client/issues/1697))
([6b0515b](https://togithub.com/googleapis/google-api-go-client/commit/6b0515bf05d8c62007748827eed486c607af483b))
- **gensupport:** Allow initial request for resumable uploads to retry
w/ non-nil getBody
([#&#8203;1690](https://togithub.com/googleapis/google-api-go-client/issues/1690))
([2c3e863](https://togithub.com/googleapis/google-api-go-client/commit/2c3e8638afc6702dcba732a1aa07ccb33eb9304b))

###
[`v0.96.0`](https://togithub.com/googleapis/google-api-go-client/releases/tag/v0.96.0)

[Compare
Source](https://togithub.com/googleapis/google-api-go-client/compare/v0.95.0...v0.96.0)

##### Features

- **all:** Auto-regenerate discovery clients
([#&#8203;1686](https://togithub.com/googleapis/google-api-go-client/issues/1686))
([ce5ed41](https://togithub.com/googleapis/google-api-go-client/commit/ce5ed411756019b79c77e580670fccc8c08cccca))
- **all:** Auto-regenerate discovery clients
([#&#8203;1688](https://togithub.com/googleapis/google-api-go-client/issues/1688))
([bc29a6b](https://togithub.com/googleapis/google-api-go-client/commit/bc29a6b8a0489e88796d5a00d4c06769793ace0d))
- **all:** Auto-regenerate discovery clients
([#&#8203;1689](https://togithub.com/googleapis/google-api-go-client/issues/1689))
([e801e10](https://togithub.com/googleapis/google-api-go-client/commit/e801e1051020e6721f2217f5aa3a4064399115e1))

##### Bug Fixes

- Upgrade version of golang.org/x/net
([#&#8203;1692](https://togithub.com/googleapis/google-api-go-client/issues/1692))
([0f7c1ed](https://togithub.com/googleapis/google-api-go-client/commit/0f7c1ed65ca2c6212f21e7fce20aa5ab9952bdbc)),
refs
[#&#8203;1691](https://togithub.com/googleapis/google-api-go-client/issues/1691)

###
[`v0.95.0`](https://togithub.com/googleapis/google-api-go-client/releases/tag/v0.95.0)

[Compare
Source](https://togithub.com/googleapis/google-api-go-client/compare/v0.94.0...v0.95.0)

##### Features

- **all:** Auto-regenerate discovery clients
([#&#8203;1677](https://togithub.com/googleapis/google-api-go-client/issues/1677))
([8757dbf](https://togithub.com/googleapis/google-api-go-client/commit/8757dbf5811cc9f4092a8259d859c35ad3cc6442))
- **all:** Auto-regenerate discovery clients
([#&#8203;1680](https://togithub.com/googleapis/google-api-go-client/issues/1680))
([8c72fb3](https://togithub.com/googleapis/google-api-go-client/commit/8c72fb345fb6e377fa984053ca9c00aa0c3a0985))
- **option:** Officially deprecate ImpersonateCredentials
([#&#8203;1683](https://togithub.com/googleapis/google-api-go-client/issues/1683))
([9a84077](https://togithub.com/googleapis/google-api-go-client/commit/9a84077014f9a37335d29132e373b92adf49f904))

###
[`v0.94.0`](https://togithub.com/googleapis/google-api-go-client/releases/tag/v0.94.0)

[Compare
Source](https://togithub.com/googleapis/google-api-go-client/compare/v0.93.0...v0.94.0)

##### Features

- **all:** auto-regenerate discovery clients, refs
[#&#8203;1676](https://togithub.com/googleapis/google-api-go-client/issues/1676)
[#&#8203;1673](https://togithub.com/googleapis/google-api-go-client/issues/1673)
[#&#8203;1672](https://togithub.com/googleapis/google-api-go-client/issues/1672)
[#&#8203;1671](https://togithub.com/googleapis/google-api-go-client/issues/1671)
[#&#8203;1667](https://togithub.com/googleapis/google-api-go-client/issues/1667)

##### Bug Fixes

- **storage:** \*int64 instead of int64 for Age cond
([#&#8203;1598](https://togithub.com/googleapis/google-api-go-client/issues/1598))
([9ea025d](https://togithub.com/googleapis/google-api-go-client/commit/9ea025dcfe9b67a95e08f4ec94ed4fb6a9767b8c))

##### Documentation

- **option:** clarify behavior of WithScopes
([#&#8203;1670](https://togithub.com/googleapis/google-api-go-client/issues/1670))
([07ceb9d](https://togithub.com/googleapis/google-api-go-client/commit/07ceb9d607c85ffaa5bea97be66cf9d426ec55bb)),
refs
[#&#8203;1644](https://togithub.com/googleapis/google-api-go-client/issues/1644)

###
[`v0.93.0`](https://togithub.com/googleapis/google-api-go-client/releases/tag/v0.93.0)

[Compare
Source](https://togithub.com/googleapis/google-api-go-client/compare/v0.92.0...v0.93.0)

##### Features

- **all:** auto-regenerate discovery clients, refs
[#&#8203;1664](https://togithub.com/googleapis/google-api-go-client/issues/1664)
[#&#8203;1662](https://togithub.com/googleapis/google-api-go-client/issues/1662)
[#&#8203;1661](https://togithub.com/googleapis/google-api-go-client/issues/1661)
[#&#8203;1652](https://togithub.com/googleapis/google-api-go-client/issues/1652)
- **google-api-go-generator:** Change field PaymentState to pointer
([#&#8203;1663](https://togithub.com/googleapis/google-api-go-client/issues/1663))
([d6ee425](https://togithub.com/googleapis/google-api-go-client/commit/d6ee425a65668ee28ff97c6fb70f3497865d6572)),
refs
[#&#8203;727](https://togithub.com/googleapis/google-api-go-client/issues/727)

###
[`v0.92.0`](https://togithub.com/googleapis/google-api-go-client/releases/tag/v0.92.0)

[Compare
Source](https://togithub.com/googleapis/google-api-go-client/compare/v0.91.0...v0.92.0)

##### Features

- **all:** auto-regenerate discovery clients, refs
[#&#8203;1649](https://togithub.com/googleapis/google-api-go-client/issues/1649)
[#&#8203;1646](https://togithub.com/googleapis/google-api-go-client/issues/1646)
[#&#8203;1645](https://togithub.com/googleapis/google-api-go-client/issues/1645)
[#&#8203;1643](https://togithub.com/googleapis/google-api-go-client/issues/1643)
[#&#8203;1641](https://togithub.com/googleapis/google-api-go-client/issues/1641)

</details>

---

### Configuration

📅 **Schedule**: Branch creation - "before 6am on monday" in timezone
Australia/Sydney, Automerge - At any time (no schedule defined).

🚦 **Automerge**: Disabled by config. Please merge this manually once you
are satisfied.

♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the
rebase/retry checkbox.

👻 **Immortal**: This PR will be recreated if closed unmerged. Get
[config help](https://togithub.com/renovatebot/renovate/discussions) if
that's undesired.

---

- [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check
this box

---

This PR has been generated by [Mend
Renovate](https://www.mend.io/free-developer-tools/renovate/). View
repository job log
[here](https://app.renovatebot.com/dashboard#github/google/osv.dev).

<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiIzNC45LjEiLCJ1cGRhdGVkSW5WZXIiOiIzNC40OC4xIn0=-->
durandj pushed a commit to durandj/go-git that referenced this pull request Jul 1, 2023
When fs.Stat returns an error, pathinfo may be nil. In such situations
the only safe response seems to be to return the error to the caller.

Without this fix, accessing pathinfo.IsDir() below would lead to a crash
dereferencing a nil pointer.

This crash can be reproduced by trying to initialize a Git repo with an
invalid path name.

Also see: muesli/gitty#36
zydou pushed a commit to zydou/tea that referenced this pull request Sep 25, 2023
This PR contains the following updates:

| Package | Type | Update | Change |
|---|---|---|---|
| [github.com/go-git/go-git/v5](https://github.com/go-git/go-git) | require | minor | `v5.4.2` -> `v5.8.1` |

---

### ⚠ Dependency Lookup Warnings ⚠

Warnings were logged while processing this repo. Please check the Dependency Dashboard for more information.

---

### Release Notes

<details>
<summary>go-git/go-git (github.com/go-git/go-git/v5)</summary>

### [`v5.8.1`](https://github.com/go-git/go-git/releases/tag/v5.8.1)

[Compare Source](go-git/go-git@v5.8.0...v5.8.1)

#### What's Changed

-   \*: Bump dependencies by [@&#8203;pjbgf](https://github.com/pjbgf) in go-git/go-git#815

**Full Changelog**: go-git/go-git@v5.8.0...v5.8.1

### [`v5.8.0`](https://github.com/go-git/go-git/releases/tag/v5.8.0)

[Compare Source](go-git/go-git@v5.7.0...v5.8.0)

#### What's Changed

-   git: Fix fetching after shallow clone. Fixes [#&#8203;305](go-git/go-git#305) by [@&#8203;AriehSchneier](https://github.com/AriehSchneier) in go-git/go-git#778
-   git: enable fetch with unqualified references by [@&#8203;AriehSchneier](https://github.com/AriehSchneier) in go-git/go-git#762
-   git: don't add to want if exists, shallow and depth 1 by [@&#8203;AriehSchneier](https://github.com/AriehSchneier) in go-git/go-git#763
-   git: Clone HEAD should not force master. Fixes [#&#8203;363](go-git/go-git#363) by [@&#8203;AriehSchneier](https://github.com/AriehSchneier) in go-git/go-git#758
-   git: fix the issue with submodules having the SCP style URL fail due to the wrong URL parsing by [@&#8203;matejrisek](https://github.com/matejrisek) in go-git/go-git#756
-   git: add a clone option to allow for shallow cloning of submodules by [@&#8203;matejrisek](https://github.com/matejrisek) in go-git/go-git#765
-   worktree: minor speedup for `doAddDirectory` by [@&#8203;ThinkChaos](https://github.com/ThinkChaos) in go-git/go-git#702
-   \_examples: Remove wrong comment by [@&#8203;pascal-hofmann](https://github.com/pascal-hofmann) in go-git/go-git#357
-   \*: Handle paths starting with tilde by [@&#8203;ricci2511](https://github.com/ricci2511) in go-git/go-git#808
-   \*: Handle paths starting with ~Username by [@&#8203;AriehSchneier](https://github.com/AriehSchneier) in go-git/go-git#809
-   storage: filesystem/dotgit, add support for tmp_objdir prefix by [@&#8203;L11R](https://github.com/L11R) in go-git/go-git#812
-   plumbing: gitignore, replace user dir in path by [@&#8203;Jleagle](https://github.com/Jleagle) in go-git/go-git#772
-   plumbing: gitignore, fix incorrect parsing. Fixes [#&#8203;500](go-git/go-git#500) by [@&#8203;AriehSchneier](https://github.com/AriehSchneier) in go-git/go-git#781
-   plumbing: http, Fix empty repos on Git v2.41+ by [@&#8203;pjbgf](https://github.com/pjbgf) in go-git/go-git#802
-   plumbing: packp, A request is not empty if it contains shallows. Fixes [#&#8203;328](go-git/go-git#328) by [@&#8203;AriehSchneier](https://github.com/AriehSchneier) in go-git/go-git#792
-   plumbing: blame, Complete rewrite. Fixes [#&#8203;603](go-git/go-git#603) by [@&#8203;AriehSchneier](https://github.com/AriehSchneier) in go-git/go-git#789
-   plumbing: gitignore, Allow gitconfig to contain a gitignore relative to any user home. Fixes [#&#8203;578](go-git/go-git#578) by [@&#8203;AriehSchneier](https://github.com/AriehSchneier) in go-git/go-git#785

#### New Contributors

-   [@&#8203;Jleagle](https://github.com/Jleagle) made their first contribution in go-git/go-git#772
-   [@&#8203;pascal-hofmann](https://github.com/pascal-hofmann) made their first contribution in go-git/go-git#357
-   [@&#8203;ricci2511](https://github.com/ricci2511) made their first contribution in go-git/go-git#808
-   [@&#8203;L11R](https://github.com/L11R) made their first contribution in go-git/go-git#812

**Full Changelog**: go-git/go-git@v5.7.0...v5.7.1

### [`v5.7.0`](https://github.com/go-git/go-git/releases/tag/v5.7.0)

[Compare Source](go-git/go-git@v5.6.1...v5.7.0)

#### What's Changed

-   \*: Add support for initializing SHA256 repositories by [@&#8203;pjbgf](https://github.com/pjbgf) in go-git/go-git#707
-   git: add mirror clone option by [@&#8203;aymanbagabas](https://github.com/aymanbagabas) in go-git/go-git#735
-   git: Add support to ls-remote with peeled references. Fixes [#&#8203;749](go-git/go-git#749) by [@&#8203;pjbgf](https://github.com/pjbgf) in go-git/go-git#750
-   git: fix cloning with branch name by [@&#8203;AriehSchneier](https://github.com/AriehSchneier) in go-git/go-git#755
-   git: Worktree, add check to see if file already checked in. Fixes [#&#8203;718](go-git/go-git#718) by [@&#8203;cbbm142](https://github.com/cbbm142) in go-git/go-git#719
-   git: Worktree, git grep bare repositories by [@&#8203;aymanbagabas](https://github.com/aymanbagabas) in go-git/go-git#728
-   git: Add Depth to SubmoduleUpdateOptions by [@&#8203;matejrisek](https://github.com/matejrisek) in go-git/go-git#754
-   git: Testing, Fix tests not cleaning temp folders by [@&#8203;AriehSchneier](https://github.com/AriehSchneier) in go-git/go-git#769
-   git: remote, add support for a configurable timeout. by [@&#8203;andrewpollock](https://github.com/andrewpollock) in go-git/go-git#753
-   git: Allow Initial Branch to be configurable by [@&#8203;techknowlogick](https://github.com/techknowlogick) in go-git/go-git#764
-   storage: filesystem/dotgit, Improve load packed-refs by [@&#8203;fcharlie](https://github.com/fcharlie) in go-git/go-git#743
-   storage: filesystem, Populate index before use. Fixes [#&#8203;148](go-git/go-git#148) by [@&#8203;AriehSchneier](https://github.com/AriehSchneier) in go-git/go-git#722
-   plumbing: resolve non-external delta references by [@&#8203;ZauberNerd](https://github.com/ZauberNerd) in go-git/go-git#485
-   plumbing/transport: fix regression in scp-like match by [@&#8203;jotadrilo](https://github.com/jotadrilo) in go-git/go-git#715
-   plumbing/transport: Add support for custom proxy settings by [@&#8203;aryan9600](https://github.com/aryan9600) in go-git/go-git#744
-   \*: small fixes across the codebase by [@&#8203;pjbgf](https://github.com/pjbgf) in go-git/go-git#770
-   \*: bump github.com/cloudflare/circl from 1.1.0 to 1.3.3 by [@&#8203;dependabot](https://github.com/dependabot) in go-git/go-git#776
-   \*: bump dependencies by [@&#8203;pjbgf](https://github.com/pjbgf) in go-git/go-git#748
-   \*: bump Go version to 1.18 on go.mod by [@&#8203;pjbgf](https://github.com/pjbgf) in go-git/go-git#774
-   \*: add Codeql workflow and bump dependencies by [@&#8203;pjbgf](https://github.com/pjbgf) in go-git/go-git#775
-   ci: fix upstream git build for master branch by [@&#8203;pjbgf](https://github.com/pjbgf) in go-git/go-git#739

#### New Contributors

-   [@&#8203;ZauberNerd](https://github.com/ZauberNerd) made their first contribution in go-git/go-git#485
-   [@&#8203;jotadrilo](https://github.com/jotadrilo) made their first contribution in go-git/go-git#715
-   [@&#8203;fcharlie](https://github.com/fcharlie) made their first contribution in go-git/go-git#743
-   [@&#8203;AriehSchneier](https://github.com/AriehSchneier) made their first contribution in go-git/go-git#755
-   [@&#8203;cbbm142](https://github.com/cbbm142) made their first contribution in go-git/go-git#719
-   [@&#8203;aryan9600](https://github.com/aryan9600) made their first contribution in go-git/go-git#744
-   [@&#8203;matejrisek](https://github.com/matejrisek) made their first contribution in go-git/go-git#754
-   [@&#8203;andrewpollock](https://github.com/andrewpollock) made their first contribution in go-git/go-git#753
-   [@&#8203;techknowlogick](https://github.com/techknowlogick) made their first contribution in go-git/go-git#764

**Full Changelog**: go-git/go-git@v5.6.1...v5.7.0

### [`v5.6.1`](https://github.com/go-git/go-git/releases/tag/v5.6.1)

[Compare Source](go-git/go-git@v5.6.0...v5.6.1)

#### What's Changed

-   plumbing/transport: don't use the `firstErrLine` when it is empty by [@&#8203;ThinkChaos](https://github.com/ThinkChaos) in go-git/go-git#682
-   plumbing/transport: ssh, unable to pass a custom HostKeyCallback func by [@&#8203;aymanbagabas](https://github.com/aymanbagabas) in go-git/go-git#655
-   storage/filesystem: dotgit: fix a filesystem race in Refs/walkReferencesTree by [@&#8203;MichaelMure](https://github.com/MichaelMure) in go-git/go-git#659
-   \*: bump golang.org/x/net from 0.2.0 to 0.7.0 by [@&#8203;dependabot](https://github.com/dependabot) in go-git/go-git#684
-   \*: bump dependencies by [@&#8203;pjbgf](https://github.com/pjbgf) in go-git/go-git#697
-   \*: fix panic for empty revisions by [@&#8203;pjbgf](https://github.com/pjbgf) in go-git/go-git#696
-   ci: bump GitHub actions, enable go test race detection and stop using developer's GPG keys during test execution by [@&#8203;pjbgf](https://github.com/pjbgf) in go-git/go-git#701

**Full Changelog**: go-git/go-git@v5.6.0...v5.6.1

### [`v5.6.0`](https://github.com/go-git/go-git/releases/tag/v5.6.0)

[Compare Source](go-git/go-git@v5.5.2...v5.6.0)

#### What's Changed

-   Worktree, check for empty parent dirs during Reset (Fixes [#&#8203;670](go-git/go-git#670)) by [@&#8203;mbohy](https://github.com/mbohy) in go-git/go-git#671
-   \*: remove need to build with CGO by [@&#8203;pjbgf](https://github.com/pjbgf) in go-git/go-git#688
-   plumbing: support SSH/X509 signed tags by [@&#8203;hiddeco](https://github.com/hiddeco) in go-git/go-git#690

**Full Changelog**: go-git/go-git@v5.5.2...v5.6.0

### [`v5.5.2`](https://github.com/go-git/go-git/releases/tag/v5.5.2)

[Compare Source](go-git/go-git@v5.5.1...v5.5.2)

#### What's Changed

-   \*: update go-billy v5.4.0, removes data races. Fixes [#&#8203;629](go-git/go-git#629) by [@&#8203;mcuadros](https://github.com/mcuadros) in go-git/go-git#653
-   Worktree: Add, fix add removed files. Fixes [#&#8203;223](go-git/go-git#223) by [@&#8203;tfujiwar](https://github.com/tfujiwar) in go-git/go-git#652

**Full Changelog**: go-git/go-git@v5.5.1...v5.5.2

### [`v5.5.1`](https://github.com/go-git/go-git/releases/tag/v5.5.1)

[Compare Source](go-git/go-git@v5.5.0...v5.5.1)

#### What's Changed

-   \*: fix error when building with `CGO_ENABLED=0` by [@&#8203;pjbgf](https://github.com/pjbgf) in go-git/go-git#625
-   plumbing: transport/ssh: fix panic on Windows 10 with paegent as ssh-agent by [@&#8203;doxsch](https://github.com/doxsch) in go-git/go-git#617
-   CommitOptions: AllowEmptyCommits, return an error instead of creating empty commits by [@&#8203;pjbgf](https://github.com/pjbgf) in go-git/go-git#623

**Full Changelog**: go-git/go-git@v5.5.0...v5.5.1

### [`v5.5.0`](https://github.com/go-git/go-git/releases/tag/v5.5.0)

[Compare Source](go-git/go-git@v5.4.2...v5.5.0)

#### What's Changed

-   \*: add collision resistent SHA1 implementation by [@&#8203;pjbgf](https://github.com/pjbgf) in go-git/go-git#618
-   \*: replace go-homedir with os.UserHomeDir by [@&#8203;mvdan](https://github.com/mvdan) in go-git/go-git#535
-   Remote: add RemoteURL to {Fetch,Pull,Push}Options by [@&#8203;noerw](https://github.com/noerw) in go-git/go-git#375
-   Remote: Push, add support to push commits per hashes by [@&#8203;tjamet](https://github.com/tjamet) in go-git/go-git#325
-   Remote: Push, add ForceWithLease Push Option by [@&#8203;john-cai](https://github.com/john-cai) in go-git/go-git#404
-   Remote: PushOptions add push-options by [@&#8203;S-Bohn](https://github.com/S-Bohn) in go-git/go-git#399
-   Remote: Push, add atomic to push options by [@&#8203;john-cai](https://github.com/john-cai) in go-git/go-git#406
-   Remote: add FollowTags option for pushes by [@&#8203;john-cai](https://github.com/john-cai) in go-git/go-git#385
-   Worktree: use syscall.Timespec.Unix by [@&#8203;tklauser](https://github.com/tklauser) in go-git/go-git#437
-   Worktree: Checkout, simplified sparse checkout by [@&#8203;john-cai](https://github.com/john-cai) in go-git/go-git#410
-   Repository: don't crash accessing invalid pathinfo by [@&#8203;muesli](https://github.com/muesli) in go-git/go-git#443
-   storage: filesystem, switch from os.SEEK_\* to io.Seek\* by [@&#8203;abhinav](https://github.com/abhinav) in go-git/go-git#421
-   config: add branch description support by [@&#8203;ninedraft](https://github.com/ninedraft) in go-git/go-git#409
-   revision: fix endless looping in revision parser by [@&#8203;michenriksen](https://github.com/michenriksen) in go-git/go-git#475
-   pumbling: optimise zlib reader and consolidate sync.Pools by [@&#8203;pjbgf](https://github.com/pjbgf) in go-git/go-git#608
-   pumbling: parse optimisations by [@&#8203;pjbgf](https://github.com/pjbgf) in go-git/go-git#602
-   plumbing: object, rename calculation uses too much memory by [@&#8203;jfontan](https://github.com/jfontan) in go-git/go-git#503
-   plumbing: protocol/pakp and server, include the contents of `GO_GIT_USER_AGENT_EXTRA`. Fixes [#&#8203;529](go-git/go-git#529) by [@&#8203;stewing](https://github.com/stewing) in go-git/go-git#531
-   plumbing: protocol/pakp, avoid duplicate encoding when overriding a Capability value. by [@&#8203;tylerchr](https://github.com/tylerchr) in go-git/go-git#521
-   plumbing: protocol/pakp, update agent by [@&#8203;caarlos0](https://github.com/caarlos0) in go-git/go-git#453
-   plumbing: protocol/pakp: Actions should have type Action by [@&#8203;abhinav](https://github.com/abhinav) in go-git/go-git#420
-   plumbing: protocol/pakp: allow unsupported `multi_ack` capability by [@&#8203;pjbgf](https://github.com/pjbgf) in go-git/go-git#613
-   plumbing: transport/ssh, auto-populate HostKeyAlgorithms. Fixes [#&#8203;411](go-git/go-git#411) by [@&#8203;evanelias](https://github.com/evanelias) in go-git/go-git#548
-   pumbling: format/packfile, resolve external reference delta by [@&#8203;ga-paul-t](https://github.com/ga-paul-t) in go-git/go-git#392
-   plumbing: format/packfile, prevent large objects from being read into memory completely by [@&#8203;zeripath](https://github.com/zeripath) in go-git/go-git#330
-   plumbing: format/index, support v3 index by [@&#8203;john-cai](https://github.com/john-cai) in go-git/go-git#407
-   plumbing: format/gitignore, Read .git/info/exclude file too. by [@&#8203;enisdenjo](https://github.com/enisdenjo) in go-git/go-git#402
-   plumbing: format/gitattributes, Avoid index out of range  by [@&#8203;To1ne](https://github.com/To1ne) in go-git/go-git#598
-   plumbing: format/config, Branch name with hash can be cloned. Fixes [#&#8203;309](go-git/go-git#309) by [@&#8203;dowy](https://github.com/dowy) in go-git/go-git#354
-   go.mod: update github.com/xanzy/ssh-agent to v0.3.1 by [@&#8203;tklauser](https://github.com/tklauser) in go-git/go-git#403
-   go.mod: update dependencies to remove supply chain CVEs by [@&#8203;pjbgf](https://github.com/pjbgf) in go-git/go-git#620
-   examples: added "tag find if head is tagged" by [@&#8203;snebel29](https://github.com/snebel29) in go-git/go-git#374
-   examples: remote fix typo by [@&#8203;nep-0](https://github.com/nep-0) in go-git/go-git#408

**Full Changelog**: go-git/go-git@v5.4.2...v5.5.0

</details>

---

### Configuration

📅 **Schedule**: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined).

🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied.

♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 **Ignore**: Close this PR and you won't be reminded about this update again.

---

 - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box

---

This PR has been generated by [Renovate Bot](https://github.com/renovatebot/renovate).
<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiIzNi43OS4xIiwidXBkYXRlZEluVmVyIjoiMzYuNzkuMSIsInRhcmdldEJyYW5jaCI6Im1haW4ifQ==-->

Reviewed-on: https://gitea.com/gitea/tea/pulls/578
Co-authored-by: Renovate Bot <renovate-bot@gitea.com>
Co-committed-by: Renovate Bot <renovate-bot@gitea.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

None yet

2 participants