bug in Git.pm handling unsafe repos

[Hank Leininger <hlein@korelogic.com>]

[-- Attachment #1: Type: text/plain, Size: 3186 bytes --]

Git.pm dies with a syntax error rather than a meaningful message when
told to open a repo that the new logic deems unsafe.

What did you do before the bug happened? (Steps to reproduce your issue)

Create a bare repo as a different user, without registering it as "safe".
Then attempt to open that repo using the perl Git.pm module:

  patsy@foo ~/tmp/test-repo-bare.git $ id
  uid=986(patsy) gid=986(patsy) groups=986(patsy)
  patsy@foo ~/tmp/test-repo-bare.git $ ls -la
  total 36
  drwxrwxr-x  6 hlein hlein 4096 Oct 11 17:02 .
  drwxrwx--- 12 patsy hlein 4096 Oct 11 17:04 ..
  -rw-rw-r--  1 hlein hlein   23 Oct 11 17:02 HEAD
  -rw-rw-r--  1 hlein hlein   66 Oct 11 17:02 config
  -rw-rw-r--  1 hlein hlein   73 Oct 11 17:02 description
  drwxrwxr-x  2 hlein hlein 4096 Oct 11 17:02 hooks
  drwxrwxr-x  2 hlein hlein 4096 Oct 11 17:02 info
  drwxrwxr-x  4 hlein hlein 4096 Oct 11 17:02 objects
  drwxrwxr-x  4 hlein hlein 4096 Oct 11 17:02 refs

  patsy@foo ~/tmp/test-repo-bare.git $ perl -MGit -e 'my $repo = Git->repository'
  Can't use string ("/home/patsy/tmp/test-repo-bare.g"...) as a HASH ref while "strict refs" in use at /usr/lib64/perl5/vendor_perl/5.36/Error.pm line 234.

What did you expect to happen? (Expected behavior)

A meaningful error because the repo is not safe to open, similar to what
'git status' produces:

  patsy@foo ~/tmp/test-repo-bare.git $ git status
  fatal: detected dubious ownership in repository at '/home/patsy/tmp/test-repo-bare.git'
  ...

What happened instead? (Actual behavior)

  Can't use string ("/home/patsy/tmp/test-repo-bare.g"...) as a HASH ref while "strict refs" in use at /usr/lib64/perl5/vendor_perl/5.36/Error.pm line 234. 

What's different between what you expected and what actually happened?

Perl syntax error when trying to generate the meaningful error.

Anything else you want to add:

Opening a "safe" repo (owned by the user, or marked safe in gitconfig)
of course does not error, which is as expected.

It seems that this call at Git.pm line 181:

  try {   
    $dir = $search->command_oneline(['rev-parse', '--git-dir'],
                                    STDERR => 0);
  } catch Git::Error::Command with {
    $dir = undef;
  };

...discards errors so that it just moves on to the next test, but in
this case what it discards would be new and interesting:

  [pid  1448] write(2, "fatal: detected dubious ownershi"..., 212) = 212

...which is the first chance to catch the problem. It doesn't die right
away; I suspect this just sends the logic down a previously untested path.

Please review the rest of the bug report below.
You can delete any lines you don't wish to share.


[System Info]
git version:
git version 2.38.0
cpu: x86_64
no commit associated with this build
sizeof-long: 8
sizeof-size_t: 8
shell-path: /bin/sh
uname: Linux 5.10.mumble
compiler info: gnuc: 11.3
libc info: glibc: 2.35
$SHELL (typically, interactive shell): /bin/bash


[Enabled Hooks]
not run from a git repository - no hooks to show

Thanks,

-- 

Hank Leininger <hlein@korelogic.com>
9606 3BF9 B593 4CBC E31A  A384 6200 F6E3 781E 3DD7

[-- Attachment #2: Digital signature --]
[-- Type: application/pgp-signature, Size: 833 bytes --]