From 37ad59f3ec8f7f0764c089aac82663cf383c96de Mon Sep 17 00:00:00 2001 From: Arlo Siemsen Date: Mon, 25 May 2026 09:49:43 +0200 Subject: [PATCH] CVE-2026-5222: avoid stripping .git suffix when for non git registries MIME-Version: 1.0 Content-Type: text/plain; charset=utf8 Content-Transfer-Encoding: 8bit FG: backported from 1.96.0 Signed-off-by: Fabian Grünbichler Gbp-Pq: Topic cargo Gbp-Pq: Name CVE-2026-5222-avoid-stripping-.git-suffix-when-for-non-gi.patch --- .../cargo/src/cargo/sources/git/source.rs | 7 +++ .../cargo/src/cargo/util/canonical_url.rs | 44 ++++++++++--------- 2 files changed, 31 insertions(+), 20 deletions(-) diff --git a/src/tools/cargo/src/cargo/sources/git/source.rs b/src/tools/cargo/src/cargo/sources/git/source.rs index 1c1dc4cd72..c1299b961f 100644 --- a/src/tools/cargo/src/cargo/sources/git/source.rs +++ b/src/tools/cargo/src/cargo/sources/git/source.rs @@ -450,6 +450,13 @@ mod test { assert_eq!(ident1, ident2); } + #[test] + fn test_canonicalize_idents_does_not_strip_dot_git_for_sparse() { + let ident1 = ident(&src("sparse+https://crates.io/fake-registry")); + let ident2 = ident(&src("sparse+https://crates.io/fake-registry.git")); + assert_ne!(ident1, ident2); + } + fn src(s: &str) -> SourceId { SourceId::for_git(&s.into_url().unwrap(), GitReference::DefaultBranch).unwrap() } diff --git a/src/tools/cargo/src/cargo/util/canonical_url.rs b/src/tools/cargo/src/cargo/util/canonical_url.rs index 7516e03569..2716d2d4f5 100644 --- a/src/tools/cargo/src/cargo/util/canonical_url.rs +++ b/src/tools/cargo/src/cargo/util/canonical_url.rs @@ -33,27 +33,31 @@ impl CanonicalUrl { url.path_segments_mut().unwrap().pop_if_empty(); } - // For GitHub URLs specifically, just lower-case everything. GitHub - // treats both the same, but they hash differently, and we're gonna be - // hashing them. This wants a more general solution, and also we're - // almost certainly not using the same case conversion rules that GitHub - // does. (See issue #84) - if url.host_str() == Some("github.com") { - url = format!("https{}", &url[url::Position::AfterScheme..]) - .parse() - .unwrap(); - let path = url.path().to_lowercase(); - url.set_path(&path); - } + // Perform further canonicalization specific to git registries, which + // do not contain a `+` specifier. + if !url.scheme().contains('+') { + // For GitHub URLs specifically, just lower-case everything. GitHub + // treats both the same, but they hash differently, and we're gonna be + // hashing them. This wants a more general solution, and also we're + // almost certainly not using the same case conversion rules that GitHub + // does. (See issue #84) + if url.host_str() == Some("github.com") { + url = format!("https{}", &url[url::Position::AfterScheme..]) + .parse() + .unwrap(); + let path = url.path().to_lowercase(); + url.set_path(&path); + } - // Repos can generally be accessed with or without `.git` extension. - let needs_chopping = url.path().ends_with(".git"); - if needs_chopping { - let last = { - let last = url.path_segments().unwrap().next_back().unwrap(); - last[..last.len() - 4].to_owned() - }; - url.path_segments_mut().unwrap().pop().push(&last); + // Repos can generally be accessed with or without `.git` extension. + let needs_chopping = url.path().ends_with(".git"); + if needs_chopping { + let last = { + let last = url.path_segments().unwrap().next_back().unwrap(); + last[..last.len() - 4].to_owned() + }; + url.path_segments_mut().unwrap().pop().push(&last); + } } Ok(CanonicalUrl(url)) -- 2.30.2