Skip to content

Commit fd7d2c8

Browse files
xN4P4LMxN4P4LM
authored
Merge pull request #311 from github/xn4p4lm-rsync-patch
Adding check to add trusted sender if supported
2 parents bf2a569 + 30e7db5 commit fd7d2c8

File tree

5 files changed

+174
-7
lines changed

5 files changed

+174
-7
lines changed

‎bin/ghe-host-check

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -153,8 +153,8 @@ if [[ "$CALLING_SCRIPT" == "ghe-backup" ]]; then
153153
. "$(dirname "${BASH_SOURCE[0]}")/../share/github-backup-utils/requirements.txt"
154154

155155
#source disk size file
156-
# shellcheck source=share/github-backup-utils/ghe-rsync-size.sh
157-
. "$(dirname "${BASH_SOURCE[0]}")/../share/github-backup-utils/ghe-rsync-size.sh"
156+
# shellcheck source=share/github-backup-utils/ghe-rsync-size
157+
. "$(dirname "${BASH_SOURCE[0]}")/../share/github-backup-utils/ghe-rsync-size"
158158

159159
#Display dir requirements for repositories and mysql
160160
echo "Checking host for sufficient space for a backup..." 1>&2

‎share/github-backup-utils/ghe-rsync

Lines changed: 27 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -11,6 +11,7 @@ set -o pipefail
1111
# shellcheck source=share/github-backup-utils/ghe-backup-config
1212
. "$( dirname "${BASH_SOURCE[0]}" )/ghe-backup-config"
1313

14+
# Don't use the feature checker for expected parameters as it can cause issues with server paths
1415
# Check for --ignore-missing-args parameter support and remove if unavailable.
1516
if rsync -h | grep '\-\-ignore-missing-args' >/dev/null 2>&1; then
1617
parameters=("$@")
@@ -20,14 +21,35 @@ else
2021
done
2122
fi
2223

23-
ignoreout='^(file has vanished: |rsync warning: some files vanished before they could be transferred)'
24-
rsync_version_check=$(rsync --version | egrep "version 3.[0-9]*.[0-9]*")
25-
if [ ! -z "$rsync_version_check" ]; then
24+
# This prepends `--trust-sender` to the parameters if supported by the current version of rsync
25+
# to mitigate the degradation of performance due to the resolution of CVE-2022-29154
26+
# shellcheck source=share/github-backup-utils/ghe-rsync-feature-checker
27+
# shellcheck disable=SC2046
28+
if [ "$($( dirname "${BASH_SOURCE[0]}" )/ghe-rsync-feature-checker --trust-sender)" == "true" ]; then
29+
parameters=("--trust-sender" "${parameters[@]}")
30+
fi
31+
32+
# This loads the $GHE_EXTRA_RSYNC_OPTS from the config file if available then adds them
33+
# to the parameters and skip adding if already present in the parameters
34+
# shellcheck source=share/github-backup-utils/ghe-rsync-feature-checker
35+
# shellcheck disable=SC2046
36+
if [ -n "$GHE_EXTRA_RSYNC_OPTS" ]; then
37+
for extra_opt in $GHE_EXTRA_RSYNC_OPTS; do
38+
if [ "$($( dirname "${BASH_SOURCE[0]}" )/ghe-rsync-feature-checker "$extra_opt")" == "true" ]; then
39+
parameters+=("$extra_opt")
40+
fi
41+
done
42+
fi
43+
44+
45+
ignore_out='^(file has vanished: |rsync warning: some files vanished before they could be transferred)'
46+
rsync_version_check=$(rsync --version | grep -E "version 3.[0-9]*.[0-9]*")
47+
if [ -n "$rsync_version_check" ]; then
2648
# rsync >= 3.x sends errors to stderr. so, we need to redirect to stdout before the pipe
27-
rsync "${parameters[@]}" $GHE_EXTRA_RSYNC_OPTS 2>&1 | (egrep -v "$ignoreout" || true)
49+
rsync "${parameters[@]}" 2>&1 | (grep -E -v "$ignore_out" || true)
2850
else
2951
# rsync <3.x sends errors to stdout.
30-
rsync "${parameters[@]}" $GHE_EXTRA_RSYNC_OPTS | (egrep -v "$ignoreout" || true)
52+
rsync "${parameters[@]}" | (grep -E -v "$ignore_out" || true)
3153
fi
3254
res=$?
3355

‎share/github-backup-utils/ghe-rsync-feature-checker

Lines changed: 17 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,17 @@
1+
#!/usr/bin/env bash
2+
#/ Usage: ghe-rsync-feature-checker <rsync-command>
3+
#/ returns true if the passed rsync command is supported by the current version of rsync
4+
#/ returns false if the passed rsync command is not supported by the current version of rsync
5+
#/
6+
7+
set -o pipefail
8+
9+
# set the variable from the first argument and remove any leading dashes
10+
rsync_command=$(echo "$1" | sed -E 's/^-+//')
11+
12+
# check if the passed rsync command is supported by the current version of rsync
13+
if rsync -h | grep -E "\B-+($rsync_command)\b" >/dev/null 2>&1; then
14+
echo "true"
15+
else
16+
echo "false"
17+
fi

‎share/github-backup-utils/ghe-rsync-size.sh renamed to ‎share/github-backup-utils/ghe-rsync-size

File renamed without changes.

‎test/test-ghe-rsync-feature-checker.sh

Lines changed: 128 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,128 @@
1+
#!/usr/bin/env bash
2+
# ghe-rsync-feature-checker command tests
3+
4+
TESTS_DIR="$PWD/$(dirname "$0")"
5+
# Bring in testlib.
6+
# shellcheck source=test/testlib.sh
7+
. "$TESTS_DIR/testlib.sh"
8+
9+
## testing for known supported command help with and without leading dashes
10+
11+
begin_test "Testing ghe-rsync-feature-checker for known supported command --help"
12+
(
13+
set -e
14+
15+
# Test ghe-rsync-feature-checker command
16+
ghe-rsync-feature-checker --help | grep -q "true"
17+
)
18+
end_test
19+
20+
begin_test "Testing ghe-rsync-feature-checker with known supported command help"
21+
(
22+
set -e
23+
24+
# Test ghe-rsync-feature-checker command
25+
ghe-rsync-feature-checker help | grep -q "true"
26+
)
27+
end_test
28+
29+
## testing with known unsupported command not-an-actual-feature with and without leading dashes
30+
31+
begin_test "Testing ghe-rsync-feature-checker with known unsupported command --not-an-actual-feature"
32+
(
33+
set -e
34+
35+
# Test ghe-rsync-feature-checker command
36+
ghe-rsync-feature-checker --not-an-actual-feature | grep -q "false"
37+
38+
)
39+
end_test
40+
41+
begin_test "Testing ghe-rsync-feature-checker with known unsupported command not-an-actual-feature"
42+
(
43+
set -e
44+
45+
# Test ghe-rsync-feature-checker command
46+
ghe-rsync-feature-checker not-an-actual-feature | grep -q "false"
47+
)
48+
end_test
49+
50+
## testing with known supported command partial with and without leading dashes
51+
52+
begin_test "Testing ghe-rsync-feature-checker with known supported command --partial"
53+
(
54+
set -e
55+
56+
# Test ghe-rsync-feature-checker command
57+
ghe-rsync-feature-checker --partial | grep -q "true"
58+
)
59+
end_test
60+
61+
begin_test "Testing ghe-rsync-feature-checker with known supported command partial"
62+
(
63+
set -e
64+
65+
# Test ghe-rsync-feature-checker command
66+
ghe-rsync-feature-checker partial | grep -q "true"
67+
)
68+
end_test
69+
70+
## testing with known supported command -v with and without leading dashes
71+
72+
begin_test "Testing ghe-rsync-feature-checker with known supported command -v"
73+
(
74+
set -e
75+
76+
# Test ghe-rsync-feature-checker command
77+
ghe-rsync-feature-checker -v | grep -q "true"
78+
)
79+
end_test
80+
81+
begin_test "Testing ghe-rsync-feature-checker with known supported command v"
82+
(
83+
set -e
84+
85+
# Test ghe-rsync-feature-checker command
86+
ghe-rsync-feature-checker v | grep -q "true"
87+
)
88+
end_test
89+
90+
## testing with known supported command --verbose with and without leading dashes
91+
92+
begin_test "Testing ghe-rsync-feature-checker with known supported command --verbose"
93+
(
94+
set -e
95+
96+
# Test ghe-rsync-feature-checker command
97+
ghe-rsync-feature-checker --verbose | grep -q "true"
98+
)
99+
end_test
100+
101+
begin_test "Testing ghe-rsync-feature-checker with known supported command verbose"
102+
(
103+
set -e
104+
105+
# Test ghe-rsync-feature-checker command
106+
ghe-rsync-feature-checker verbose | grep -q "true"
107+
)
108+
end_test
109+
110+
## testing with known supported command ignore-missing-args with and without leading dashes
111+
112+
begin_test "Testing ghe-rsync-feature-checker with known supported command --ignore-missing-args"
113+
(
114+
set -e
115+
116+
# Test ghe-rsync-feature-checker command
117+
ghe-rsync-feature-checker "--ignore-missing-args" | grep -q "true"
118+
)
119+
end_test
120+
121+
begin_test "Testing ghe-rsync-feature-checker with known supported command ignore-missing-args"
122+
(
123+
set -e
124+
125+
# Test ghe-rsync-feature-checker command
126+
ghe-rsync-feature-checker "ignore-missing-args" | grep -q "true"
127+
)
128+
end_test

0 commit comments

Comments
 (0)