Bug 571798 - Cannot use relative path with ../ in http.cookieFile config
Summary: Cannot use relative path with ../ in http.cookieFile config
Status: NEW
Alias: None
Product: JGit
Classification: Technology
Component: JGit (show other bugs)
Version: unspecified   Edit
Hardware: Other Linux
: P3 normal (vote)
Target Milestone: ---   Edit
Assignee: Project Inbox CLA
QA Contact:
URL:
Whiteboard:
Keywords:
Depends on:
Blocks:
 
Reported: 2021-03-08 17:54 EST by Lindsey Meyer CLA
Modified: 2021-03-12 18:24 EST (History)
1 user (show)

See Also:


Attachments

Note You need to log in before you can comment on or make changes to this bug.
Description Lindsey Meyer CLA 2021-03-08 17:54:06 EST
I am using the http.cookieFile config setting adding to HttpTransport in 5.4.0
https://projects.eclipse.org/projects/technology.jgit/reviews/5.4.0-release-review

But I am unable to use a relative path to the cookie file. This works with normal git, and the relative path should be based on the directory the git config file is location. But when using jgit, the authentication fails.

For example, if I have this setting in the my git config:

[http]
    cookieFile = ../../my_cookie_file

I found that jgit hits this warning:
https://github.com/eclipse/jgit/blob/master/org.eclipse.jgit/src/org/eclipse/jgit/internal/transport/http/NetscapeCookieFile.java#L273

And prints the absolute path it is using as 
<HOME>/../../my_cookie_file (with the literal ../ in the path)

It looks like that is because the toFile() method here doesn't account for relative paths with ../:
https://github.com/eclipse/jgit/blob/master/org.eclipse.jgit/src/org/eclipse/jgit/internal/transport/ssh/OpenSshConfigFile.java#L391-L399

You can see that it removes ~/ from the start of the path, but if the file still isn't an absolute path, it simple appends it to the home path.

It's likely that other config settings have this same issue when trying to use relative paths with ../, but I did not test them.
Comment 1 Thomas Wolf CLA 2021-03-09 02:57:28 EST
It's highly unlikely that a private method in OpenSshConfigFile has anything to do with NetscapeCookieFile.

What does C git do?
Comment 2 Lindsey Meyer CLA 2021-03-10 13:54:40 EST
Ah apologies, I didn't look closely enough at that method.

Normal git works as you would expect when using a relative path for the cookieFile, it finds the file and authenticates correctly in my testing.

For jgit, as far as I can tell, when it gets the file path here:
https://github.com/eclipse/jgit/blob/88e924e86beaa7e4911f4496e847a10833ac1c15/org.eclipse.jgit/src/org/eclipse/jgit/internal/transport/http/NetscapeCookieFile.java#L264

It returns a path like <HOME>/../../my_cookie_file, which of course isn't a valid location, and so it can't find the file. It seems like there is something wrong with the `toFile` method call because it isn't handling the relative path correctly.
Comment 3 Lindsey Meyer CLA 2021-03-10 13:58:06 EST
Ah also, normal git interprets the relative path based on where the config file is located, as far as I can tell. So it seems like to get this working in jgit, we would need to pass through the location of the config file when determining the cookie file path.
Comment 4 Thomas Wolf CLA 2021-03-11 04:51:00 EST
(In reply to Lindsey Meyer from comment #3)
> Ah also, normal git interprets the relative path based on where the config
> file is located, as far as I can tell.

Are you sure? I don't see any code in C git that would do that for http.cookieFile. Looks to me that C git just passes on a relative path as is to libcurl, so it's most likely resolved against whatever the current directory is.

So it might work in the root of the working tree, but not one or more directories down.

What we certainly should do (but don't yet) is ~ replacement such that ~/somepath/cookiefile gets resolved to <homedir>/somepath/cookiefile.
Comment 5 Lindsey Meyer CLA 2021-03-11 16:16:12 EST
Ah interesting, my config file when I was testing was indeed in the root of the repo dir, so that may indeed be why that was working.

I suppose ideally jgit could copy that behavior, so at least it works in this case. But it's potentially true that the c git behavior is not well defined
Comment 6 Eclipse Genie CLA 2021-03-12 06:03:11 EST
New Gerrit change created: https://git.eclipse.org/r/c/jgit/jgit/+/177649