[PATCH 0/7] Restrict the usage of config_from_gitmodules()

[PATCH 0/7] Restrict the usage of config_from_gitmodules()

[Antonio Ospite]

Hi,

when I tried to reuse and extend 'config_from_gitmodules' in
https://public-inbox.org/git/20180514105823.8378-2-ao2@ao2.it/ it was
pointed out to me that special care is needed to make sure that this
function does not get abused to bring in arbitrary configuration stored
in the .gitmodules file, as the latter is meant only for submodule
specific configuration.

So I thought that the function could be made private to better
communicate that.

This is what this series is about.

Patch 1 moves 'config_from_gitmodules' to submodule-config.c

Patches 2 and 3 add helpers to handle special cases and avoid calling
'config_from_gitmodules' directly, which might set a bad example for
future code.

Patch 4 makes the symbol private to discourage its use in code not
related to submodules.

Patches 5 and 6 enable reusing 'config_from_gitmodules' when it's safe
to do so.

Patches 7 is just a cleanup and I am not even sure it is worth it, so we
might as well just drop it.

The series can be seen as a continuation of the changes from
https://public-inbox.org/git/20170802194923.88239-1-bmwill@google.com/

Even though the helper functions may be less elegant than what was done
back then, they should better protect from misuse of
config_from_gitmodules.

A further change could be to print warning messages when the backward
compatibility helpers find configuration in .gitmodules that should not
belong there, but I'll leave that to someone else.

Thanks,
   Antonio

P.S. I added Jeff King to CC as he has done some work related to
.gitmodules recently, and I removed the vcsh poeple on this one.

Antonio Ospite (7):
  config: move config_from_gitmodules to submodule-config.c
  submodule-config: add helper function to get 'fetch' config from
    .gitmodules
  submodule-config: add helper to get 'update-clone' config from
    .gitmodules
  submodule-config: make 'config_from_gitmodules' private
  submodule-config: pass repository as argument to
    config_from_gitmodules
  submodule-config: reuse config_from_gitmodules in repo_read_gitmodules
  submodule-config: cleanup backward compatibility helpers

 builtin/fetch.c             | 15 +--------
 builtin/submodule--helper.c |  8 ++---
 config.c                    | 17 ----------
 config.h                    | 10 ------
 submodule-config.c          | 66 ++++++++++++++++++++++++++++++-------
 submodule-config.h          | 12 +++++++
 6 files changed, 71 insertions(+), 57 deletions(-)

-- 
Antonio Ospite
https://ao2.it
https://twitter.com/ao2it

A: Because it messes up the order in which people normally read text.
   See http://en.wikipedia.org/wiki/Posting_style
Q: Why is top-posting such a bad thing?

[PATCH 1/7] config: move config_from_gitmodules to submodule-config.c

[Antonio Ospite]

The .gitmodules file is not meant as a place to store arbitrary
configuration to distribute with the repository.

Move config_from_gitmodules() out of config.c and into
submodule-config.c to make it even clearer that it is not a mechanism to
retrieve arbitrary configuration from the .gitmodules file.

Signed-off-by: Antonio Ospite <ao2@ao2.it>
---
 config.c           | 17 -----------------
 config.h           | 10 ----------
 submodule-config.c | 17 +++++++++++++++++
 submodule-config.h | 11 +++++++++++
 4 files changed, 28 insertions(+), 27 deletions(-)

diff --git a/config.c b/config.c
index fbbf0f8e9..2e4dbfa19 100644
--- a/config.c
+++ b/config.c
@@ -2172,23 +2172,6 @@ int git_config_get_pathname(const char *key, const char **dest)
 	return repo_config_get_pathname(the_repository, key, dest);
 }
 
-/*
- * Note: This function exists solely to maintain backward compatibility with
- * 'fetch' and 'update_clone' storing configuration in '.gitmodules' and should
- * NOT be used anywhere else.
- *
- * Runs the provided config function on the '.gitmodules' file found in the
- * working directory.
- */
-void config_from_gitmodules(config_fn_t fn, void *data)
-{
-	if (the_repository->worktree) {
-		char *file = repo_worktree_path(the_repository, GITMODULES_FILE);
-		git_config_from_file(fn, file, data);
-		free(file);
-	}
-}
-
 int git_config_get_expiry(const char *key, const char **output)
 {
 	int ret = git_config_get_string_const(key, output);
diff --git a/config.h b/config.h
index cdac2fc73..3faf4fba9 100644
--- a/config.h
+++ b/config.h
@@ -215,16 +215,6 @@ extern int repo_config_get_maybe_bool(struct repository *repo,
 extern int repo_config_get_pathname(struct repository *repo,
 				    const char *key, const char **dest);
 
-/*
- * Note: This function exists solely to maintain backward compatibility with
- * 'fetch' and 'update_clone' storing configuration in '.gitmodules' and should
- * NOT be used anywhere else.
- *
- * Runs the provided config function on the '.gitmodules' file found in the
- * working directory.
- */
-extern void config_from_gitmodules(config_fn_t fn, void *data);
-
 extern int git_config_get_value(const char *key, const char **value);
 extern const struct string_list *git_config_get_value_multi(const char *key);
 extern void git_config_clear(void);
diff --git a/submodule-config.c b/submodule-config.c
index 388ef1f89..b431555db 100644
--- a/submodule-config.c
+++ b/submodule-config.c
@@ -671,3 +671,20 @@ void submodule_free(struct repository *r)
 	if (r->submodule_cache)
 		submodule_cache_clear(r->submodule_cache);
 }
+
+/*
+ * Note: This function exists solely to maintain backward compatibility with
+ * 'fetch' and 'update_clone' storing configuration in '.gitmodules' and should
+ * NOT be used anywhere else.
+ *
+ * Runs the provided config function on the '.gitmodules' file found in the
+ * working directory.
+ */
+void config_from_gitmodules(config_fn_t fn, void *data)
+{
+	if (the_repository->worktree) {
+		char *file = repo_worktree_path(the_repository, GITMODULES_FILE);
+		git_config_from_file(fn, file, data);
+		free(file);
+	}
+}
diff --git a/submodule-config.h b/submodule-config.h
index ca1f94e2d..5148801f4 100644
--- a/submodule-config.h
+++ b/submodule-config.h
@@ -2,6 +2,7 @@
 #define SUBMODULE_CONFIG_CACHE_H
 
 #include "cache.h"
+#include "config.h"
 #include "hashmap.h"
 #include "submodule.h"
 #include "strbuf.h"
@@ -55,4 +56,14 @@ void submodule_free(struct repository *r);
  */
 int check_submodule_name(const char *name);
 
+/*
+ * Note: This function exists solely to maintain backward compatibility with
+ * 'fetch' and 'update_clone' storing configuration in '.gitmodules' and should
+ * NOT be used anywhere else.
+ *
+ * Runs the provided config function on the '.gitmodules' file found in the
+ * working directory.
+ */
+extern void config_from_gitmodules(config_fn_t fn, void *data);
+
 #endif /* SUBMODULE_CONFIG_H */
-- 
2.18.0

[PATCH 2/7] submodule-config: add helper function to get 'fetch' config from .gitmodules

[Antonio Ospite]

Add a helper function to make it clearer that retrieving 'fetch'
configuration from the .gitmodules file is a special case supported
solely for backward compatibility purposes.

This change removes one direct use of 'config_from_gitmodules' in code
not strictly related to submodules, in the effort to communicate better
that .gitmodules is not to be used as a mechanism to store arbitrary
configuration in the repository that any command can retrieve.

Signed-off-by: Antonio Ospite <ao2@ao2.it>
---
 builtin/fetch.c    | 15 +--------------
 submodule-config.c | 28 ++++++++++++++++++++++++++++
 submodule-config.h |  2 ++
 3 files changed, 31 insertions(+), 14 deletions(-)

diff --git a/builtin/fetch.c b/builtin/fetch.c
index ea5b9669a..92a5d235d 100644
--- a/builtin/fetch.c
+++ b/builtin/fetch.c
@@ -93,19 +93,6 @@ static int git_fetch_config(const char *k, const char *v, void *cb)
 	return git_default_config(k, v, cb);
 }
 
-static int gitmodules_fetch_config(const char *var, const char *value, void *cb)
-{
-	if (!strcmp(var, "submodule.fetchjobs")) {
-		max_children = parse_submodule_fetchjobs(var, value);
-		return 0;
-	} else if (!strcmp(var, "fetch.recursesubmodules")) {
-		recurse_submodules = parse_fetch_recurse_submodules_arg(var, value);
-		return 0;
-	}
-
-	return 0;
-}
-
 static int parse_refmap_arg(const struct option *opt, const char *arg, int unset)
 {
 	/*
@@ -1433,7 +1420,7 @@ int cmd_fetch(int argc, const char **argv, const char *prefix)
 	for (i = 1; i < argc; i++)
 		strbuf_addf(&default_rla, " %s", argv[i]);
 
-	config_from_gitmodules(gitmodules_fetch_config, NULL);
+	fetch_config_from_gitmodules(&max_children, &recurse_submodules);
 	git_config(git_fetch_config, NULL);
 
 	argc = parse_options(argc, argv, prefix,
diff --git a/submodule-config.c b/submodule-config.c
index b431555db..ef292eb7c 100644
--- a/submodule-config.c
+++ b/submodule-config.c
@@ -688,3 +688,31 @@ void config_from_gitmodules(config_fn_t fn, void *data)
 		free(file);
 	}
 }
+
+struct fetch_config {
+	int *max_children;
+	int *recurse_submodules;
+};
+
+static int gitmodules_fetch_config(const char *var, const char *value, void *cb)
+{
+	struct fetch_config *config = cb;
+	if (!strcmp(var, "submodule.fetchjobs")) {
+		*(config->max_children) = parse_submodule_fetchjobs(var, value);
+		return 0;
+	} else if (!strcmp(var, "fetch.recursesubmodules")) {
+		*(config ->recurse_submodules) = parse_fetch_recurse_submodules_arg(var, value);
+		return 0;
+	}
+
+	return 0;
+}
+
+void fetch_config_from_gitmodules(int *max_children, int *recurse_submodules)
+{
+	struct fetch_config config = {
+		.max_children = max_children,
+		.recurse_submodules = recurse_submodules
+	};
+	config_from_gitmodules(gitmodules_fetch_config, &config);
+}
diff --git a/submodule-config.h b/submodule-config.h
index 5148801f4..cff297a75 100644
--- a/submodule-config.h
+++ b/submodule-config.h
@@ -66,4 +66,6 @@ int check_submodule_name(const char *name);
  */
 extern void config_from_gitmodules(config_fn_t fn, void *data);
 
+extern void fetch_config_from_gitmodules(int *max_children, int *recurse_submodules);
+
 #endif /* SUBMODULE_CONFIG_H */
-- 
2.18.0

Re: [PATCH 2/7] submodule-config: add helper function to get 'fetch' config from .gitmodules

[Brandon Williams]

On 06/22, Antonio Ospite wrote:
> diff --git a/submodule-config.c b/submodule-config.c
> index b431555db..ef292eb7c 100644
> --- a/submodule-config.c
> +++ b/submodule-config.c
> @@ -688,3 +688,31 @@ void config_from_gitmodules(config_fn_t fn, void *data)
>  		free(file);
>  	}
>  }
> +
> +struct fetch_config {
> +	int *max_children;
> +	int *recurse_submodules;
> +};
> +
> +static int gitmodules_fetch_config(const char *var, const char *value, void *cb)
> +{
> +	struct fetch_config *config = cb;
> +	if (!strcmp(var, "submodule.fetchjobs")) {
> +		*(config->max_children) = parse_submodule_fetchjobs(var, value);
> +		return 0;
> +	} else if (!strcmp(var, "fetch.recursesubmodules")) {
> +		*(config ->recurse_submodules) = parse_fetch_recurse_submodules_arg(var, value);

There shouldn't be a space before "->" in this line.

-- 
Brandon Williams

[PATCH 3/7] submodule-config: add helper to get 'update-clone' config from .gitmodules

[Antonio Ospite]

Add a helper function to make it clearer that retrieving 'update-clone'
configuration from the .gitmodules file is a special case supported
solely for backward compatibility purposes.

This change removes one direct use of 'config_from_gitmodules' for
options not strictly related to submodules: "submodule.fetchobjs" does
not describe a property of a submodule, but a behavior of other commands
when dealing with submodules, so it does not really belong to the
.gitmodules file.

This is in the effort to communicate better that .gitmodules is not to
be used as a mechanism to store arbitrary configuration in the
repository that any command can retrieve.

Signed-off-by: Antonio Ospite <ao2@ao2.it>
---
 builtin/submodule--helper.c |  8 ++++----
 submodule-config.c          | 14 ++++++++++++++
 submodule-config.h          |  1 +
 3 files changed, 19 insertions(+), 4 deletions(-)

diff --git a/builtin/submodule--helper.c b/builtin/submodule--helper.c
index bd250ca21..d450b81da 100644
--- a/builtin/submodule--helper.c
+++ b/builtin/submodule--helper.c
@@ -1562,8 +1562,8 @@ static int update_clone_task_finished(int result,
 	return 0;
 }
 
-static int gitmodules_update_clone_config(const char *var, const char *value,
-					  void *cb)
+static int git_update_clone_config(const char *var, const char *value,
+				   void *cb)
 {
 	int *max_jobs = cb;
 	if (!strcmp(var, "submodule.fetchjobs"))
@@ -1613,8 +1613,8 @@ static int update_clone(int argc, const char **argv, const char *prefix)
 	};
 	suc.prefix = prefix;
 
-	config_from_gitmodules(gitmodules_update_clone_config, &max_jobs);
-	git_config(gitmodules_update_clone_config, &max_jobs);
+	update_clone_config_from_gitmodules(&max_jobs);
+	git_config(git_update_clone_config, &max_jobs);
 
 	argc = parse_options(argc, argv, prefix, module_update_clone_options,
 			     git_submodule_helper_usage, 0);
diff --git a/submodule-config.c b/submodule-config.c
index ef292eb7c..46fb454ae 100644
--- a/submodule-config.c
+++ b/submodule-config.c
@@ -716,3 +716,17 @@ void fetch_config_from_gitmodules(int *max_children, int *recurse_submodules)
 	};
 	config_from_gitmodules(gitmodules_fetch_config, &config);
 }
+
+static int gitmodules_update_clone_config(const char *var, const char *value,
+					  void *cb)
+{
+	int *max_jobs = cb;
+	if (!strcmp(var, "submodule.fetchjobs"))
+		*max_jobs = parse_submodule_fetchjobs(var, value);
+	return 0;
+}
+
+void update_clone_config_from_gitmodules(int *max_jobs)
+{
+	config_from_gitmodules(gitmodules_update_clone_config, &max_jobs);
+}
diff --git a/submodule-config.h b/submodule-config.h
index cff297a75..b6f19d0d4 100644
--- a/submodule-config.h
+++ b/submodule-config.h
@@ -67,5 +67,6 @@ int check_submodule_name(const char *name);
 extern void config_from_gitmodules(config_fn_t fn, void *data);
 
 extern void fetch_config_from_gitmodules(int *max_children, int *recurse_submodules);
+extern void update_clone_config_from_gitmodules(int *max_jobs);
 
 #endif /* SUBMODULE_CONFIG_H */
-- 
2.18.0

Re: [PATCH 3/7] submodule-config: add helper to get 'update-clone' config from .gitmodules

[Brandon Williams]

On 06/22, Antonio Ospite wrote:
> Add a helper function to make it clearer that retrieving 'update-clone'
> configuration from the .gitmodules file is a special case supported
> solely for backward compatibility purposes.
> 
> This change removes one direct use of 'config_from_gitmodules' for
> options not strictly related to submodules: "submodule.fetchobjs" does

s/fetchobjs/fetchjobs


-- 
Brandon Williams

[PATCH 4/7] submodule-config: make 'config_from_gitmodules' private

[Antonio Ospite]

Now that 'config_from_gitmodules' is not used in the open, it can be
marked as private.

Hopefully this will prevent its usage for retrieving arbitrary
configuration form the '.gitmodules' file.

Signed-off-by: Antonio Ospite <ao2@ao2.it>
---
 submodule-config.c |  8 ++++----
 submodule-config.h | 12 +++++-------
 2 files changed, 9 insertions(+), 11 deletions(-)

diff --git a/submodule-config.c b/submodule-config.c
index 46fb454ae..6a9f4b6d1 100644
--- a/submodule-config.c
+++ b/submodule-config.c
@@ -673,14 +673,14 @@ void submodule_free(struct repository *r)
 }
 
 /*
- * Note: This function exists solely to maintain backward compatibility with
- * 'fetch' and 'update_clone' storing configuration in '.gitmodules' and should
- * NOT be used anywhere else.
+ * Note: This function is private for a reason, the '.gitmodules' file should
+ * not be used as as a mechanism to retrieve arbitrary configuration stored in
+ * the repository.
  *
  * Runs the provided config function on the '.gitmodules' file found in the
  * working directory.
  */
-void config_from_gitmodules(config_fn_t fn, void *data)
+static void config_from_gitmodules(config_fn_t fn, void *data)
 {
 	if (the_repository->worktree) {
 		char *file = repo_worktree_path(the_repository, GITMODULES_FILE);
diff --git a/submodule-config.h b/submodule-config.h
index b6f19d0d4..dc7278eea 100644
--- a/submodule-config.h
+++ b/submodule-config.h
@@ -57,15 +57,13 @@ void submodule_free(struct repository *r);
 int check_submodule_name(const char *name);
 
 /*
- * Note: This function exists solely to maintain backward compatibility with
- * 'fetch' and 'update_clone' storing configuration in '.gitmodules' and should
- * NOT be used anywhere else.
+ * Note: these helper functions exist solely to maintain backward
+ * compatibility with 'fetch' and 'update_clone' storing configuration in
+ * '.gitmodules'.
  *
- * Runs the provided config function on the '.gitmodules' file found in the
- * working directory.
+ * New helpers to retrieve arbitrary configuration from the '.gitmodules' file
+ * should NOT be added.
  */
-extern void config_from_gitmodules(config_fn_t fn, void *data);
-
 extern void fetch_config_from_gitmodules(int *max_children, int *recurse_submodules);
 extern void update_clone_config_from_gitmodules(int *max_jobs);
 
-- 
2.18.0

[PATCH 5/7] submodule-config: pass repository as argument to config_from_gitmodules

[Antonio Ospite]

Generlize config_from_gitmodules to accept a repository as an argument.

This is in preparation to reuse the function in repo_read_gitmodules in
order to have a single point where the '.gitmodules' file is accessed.

Signed-off-by: Antonio Ospite <ao2@ao2.it>
---
 submodule-config.c | 10 +++++-----
 1 file changed, 5 insertions(+), 5 deletions(-)

diff --git a/submodule-config.c b/submodule-config.c
index 6a9f4b6d1..e50c944eb 100644
--- a/submodule-config.c
+++ b/submodule-config.c
@@ -680,10 +680,10 @@ void submodule_free(struct repository *r)
  * Runs the provided config function on the '.gitmodules' file found in the
  * working directory.
  */
-static void config_from_gitmodules(config_fn_t fn, void *data)
+static void config_from_gitmodules(config_fn_t fn, struct repository *repo, void *data)
 {
-	if (the_repository->worktree) {
-		char *file = repo_worktree_path(the_repository, GITMODULES_FILE);
+	if (repo->worktree) {
+		char *file = repo_worktree_path(repo, GITMODULES_FILE);
 		git_config_from_file(fn, file, data);
 		free(file);
 	}
@@ -714,7 +714,7 @@ void fetch_config_from_gitmodules(int *max_children, int *recurse_submodules)
 		.max_children = max_children,
 		.recurse_submodules = recurse_submodules
 	};
-	config_from_gitmodules(gitmodules_fetch_config, &config);
+	config_from_gitmodules(gitmodules_fetch_config, the_repository, &config);
 }
 
 static int gitmodules_update_clone_config(const char *var, const char *value,
@@ -728,5 +728,5 @@ static int gitmodules_update_clone_config(const char *var, const char *value,
 
 void update_clone_config_from_gitmodules(int *max_jobs)
 {
-	config_from_gitmodules(gitmodules_update_clone_config, &max_jobs);
+	config_from_gitmodules(gitmodules_update_clone_config, the_repository, &max_jobs);
 }
-- 
2.18.0

[PATCH 6/7] submodule-config: reuse config_from_gitmodules in repo_read_gitmodules

[Antonio Ospite]

Reuse config_from_gitmodules in repo_read_gitmodules to remove some
duplication and also have a single point where the .gitmodules file is
read.

The change does not introduce any new behavior, the same gitmodules_cb
config callback is still used which only deals with configuration
specific to submodules.

The config_from_gitmodules function is moved up in the file —unchanged—
before its users to avoid a forward declaration.

Signed-off-by: Antonio Ospite <ao2@ao2.it>
---
 submodule-config.c | 50 +++++++++++++++++++---------------------------
 1 file changed, 21 insertions(+), 29 deletions(-)

diff --git a/submodule-config.c b/submodule-config.c
index e50c944eb..ce204fb53 100644
--- a/submodule-config.c
+++ b/submodule-config.c
@@ -591,6 +591,23 @@ static void submodule_cache_check_init(struct repository *repo)
 	submodule_cache_init(repo->submodule_cache);
 }
 
+/*
+ * Note: This function is private for a reason, the '.gitmodules' file should
+ * not be used as as a mechanism to retrieve arbitrary configuration stored in
+ * the repository.
+ *
+ * Runs the provided config function on the '.gitmodules' file found in the
+ * working directory.
+ */
+static void config_from_gitmodules(config_fn_t fn, struct repository *repo, void *data)
+{
+	if (repo->worktree) {
+		char *file = repo_worktree_path(repo, GITMODULES_FILE);
+		git_config_from_file(fn, file, data);
+		free(file);
+	}
+}
+
 static int gitmodules_cb(const char *var, const char *value, void *data)
 {
 	struct repository *repo = data;
@@ -608,19 +625,11 @@ void repo_read_gitmodules(struct repository *repo)
 {
 	submodule_cache_check_init(repo);
 
-	if (repo->worktree) {
-		char *gitmodules;
-
-		if (repo_read_index(repo) < 0)
-			return;
-
-		gitmodules = repo_worktree_path(repo, GITMODULES_FILE);
-
-		if (!is_gitmodules_unmerged(repo->index))
-			git_config_from_file(gitmodules_cb, gitmodules, repo);
+	if (repo_read_index(repo) < 0)
+		return;
 
-		free(gitmodules);
-	}
+	if (!is_gitmodules_unmerged(repo->index))
+		config_from_gitmodules(gitmodules_cb, repo, repo);
 
 	repo->submodule_cache->gitmodules_read = 1;
 }
@@ -672,23 +681,6 @@ void submodule_free(struct repository *r)
 		submodule_cache_clear(r->submodule_cache);
 }
 
-/*
- * Note: This function is private for a reason, the '.gitmodules' file should
- * not be used as as a mechanism to retrieve arbitrary configuration stored in
- * the repository.
- *
- * Runs the provided config function on the '.gitmodules' file found in the
- * working directory.
- */
-static void config_from_gitmodules(config_fn_t fn, struct repository *repo, void *data)
-{
-	if (repo->worktree) {
-		char *file = repo_worktree_path(repo, GITMODULES_FILE);
-		git_config_from_file(fn, file, data);
-		free(file);
-	}
-}
-
 struct fetch_config {
 	int *max_children;
 	int *recurse_submodules;
-- 
2.18.0

Re: [PATCH 6/7] submodule-config: reuse config_from_gitmodules in repo_read_gitmodules

[Brandon Williams]

On 06/22, Antonio Ospite wrote:
> Reuse config_from_gitmodules in repo_read_gitmodules to remove some
> duplication and also have a single point where the .gitmodules file is
> read.
> 
> The change does not introduce any new behavior, the same gitmodules_cb
> config callback is still used which only deals with configuration
> specific to submodules.
> 
> The config_from_gitmodules function is moved up in the file —unchanged—
> before its users to avoid a forward declaration.
> 
> Signed-off-by: Antonio Ospite <ao2@ao2.it>
> ---
>  submodule-config.c | 50 +++++++++++++++++++---------------------------
>  1 file changed, 21 insertions(+), 29 deletions(-)
> 
> diff --git a/submodule-config.c b/submodule-config.c
> index e50c944eb..ce204fb53 100644
> --- a/submodule-config.c
> +++ b/submodule-config.c
> @@ -591,6 +591,23 @@ static void submodule_cache_check_init(struct repository *repo)
>  	submodule_cache_init(repo->submodule_cache);
>  }
>  
> +/*
> + * Note: This function is private for a reason, the '.gitmodules' file should
> + * not be used as as a mechanism to retrieve arbitrary configuration stored in
> + * the repository.
> + *
> + * Runs the provided config function on the '.gitmodules' file found in the
> + * working directory.
> + */
> +static void config_from_gitmodules(config_fn_t fn, struct repository *repo, void *data)
> +{
> +	if (repo->worktree) {
> +		char *file = repo_worktree_path(repo, GITMODULES_FILE);
> +		git_config_from_file(fn, file, data);
> +		free(file);
> +	}
> +}
> +
>  static int gitmodules_cb(const char *var, const char *value, void *data)
>  {
>  	struct repository *repo = data;
> @@ -608,19 +625,11 @@ void repo_read_gitmodules(struct repository *repo)
>  {
>  	submodule_cache_check_init(repo);
>  
> -	if (repo->worktree) {
> -		char *gitmodules;
> -
> -		if (repo_read_index(repo) < 0)
> -			return;
> -
> -		gitmodules = repo_worktree_path(repo, GITMODULES_FILE);
> -
> -		if (!is_gitmodules_unmerged(repo->index))
> -			git_config_from_file(gitmodules_cb, gitmodules, repo);
> +	if (repo_read_index(repo) < 0)
> +		return;
>  
> -		free(gitmodules);
> -	}
> +	if (!is_gitmodules_unmerged(repo->index))
> +		config_from_gitmodules(gitmodules_cb, repo, repo);

So the check for the repo's worktree has been pushed into
config_from_gitmodules().  This looks like the right thing to do in
order to get to a world where you'd rather read the gitmodules file from
the index instead of the worktree.

>  
>  	repo->submodule_cache->gitmodules_read = 1;
>  }
> @@ -672,23 +681,6 @@ void submodule_free(struct repository *r)
>  		submodule_cache_clear(r->submodule_cache);
>  }
>  
> -/*
> - * Note: This function is private for a reason, the '.gitmodules' file should
> - * not be used as as a mechanism to retrieve arbitrary configuration stored in
> - * the repository.
> - *
> - * Runs the provided config function on the '.gitmodules' file found in the
> - * working directory.
> - */
> -static void config_from_gitmodules(config_fn_t fn, struct repository *repo, void *data)
> -{
> -	if (repo->worktree) {
> -		char *file = repo_worktree_path(repo, GITMODULES_FILE);
> -		git_config_from_file(fn, file, data);
> -		free(file);
> -	}
> -}
> -
>  struct fetch_config {
>  	int *max_children;
>  	int *recurse_submodules;
> -- 
> 2.18.0
> 

-- 
Brandon Williams

[PATCH 7/7] submodule-config: cleanup backward compatibility helpers

[Antonio Ospite]

Use one callback per configuration setting to handle the generic options
which have to be supported for backward compatibility.

This removes some duplication and some support code at the cost of
parsing the .gitmodules file twice when calling the fetch command.

Signed-off-by: Antonio Ospite <ao2@ao2.it>
---
 submodule-config.c | 39 +++++++++++++++------------------------
 1 file changed, 15 insertions(+), 24 deletions(-)

diff --git a/submodule-config.c b/submodule-config.c
index ce204fb53..0a5274891 100644
--- a/submodule-config.c
+++ b/submodule-config.c
@@ -681,36 +681,20 @@ void submodule_free(struct repository *r)
 		submodule_cache_clear(r->submodule_cache);
 }
 
-struct fetch_config {
-	int *max_children;
-	int *recurse_submodules;
-};
-
-static int gitmodules_fetch_config(const char *var, const char *value, void *cb)
+static int gitmodules_recurse_submodules_config(const char *var,
+						const char *value, void *cb)
 {
-	struct fetch_config *config = cb;
-	if (!strcmp(var, "submodule.fetchjobs")) {
-		*(config->max_children) = parse_submodule_fetchjobs(var, value);
-		return 0;
-	} else if (!strcmp(var, "fetch.recursesubmodules")) {
-		*(config ->recurse_submodules) = parse_fetch_recurse_submodules_arg(var, value);
+	int *recurse_submodules = cb;
+	if (!strcmp(var, "fetch.recursesubmodules")) {
+		*recurse_submodules = parse_fetch_recurse_submodules_arg(var, value);
 		return 0;
 	}
 
 	return 0;
 }
 
-void fetch_config_from_gitmodules(int *max_children, int *recurse_submodules)
-{
-	struct fetch_config config = {
-		.max_children = max_children,
-		.recurse_submodules = recurse_submodules
-	};
-	config_from_gitmodules(gitmodules_fetch_config, the_repository, &config);
-}
-
-static int gitmodules_update_clone_config(const char *var, const char *value,
-					  void *cb)
+static int gitmodules_fetchobjs_config(const char *var, const char *value,
+				       void *cb)
 {
 	int *max_jobs = cb;
 	if (!strcmp(var, "submodule.fetchjobs"))
@@ -718,7 +702,14 @@ static int gitmodules_update_clone_config(const char *var, const char *value,
 	return 0;
 }
 
+
+void fetch_config_from_gitmodules(int *max_children, int *recurse_submodules)
+{
+	config_from_gitmodules(gitmodules_fetchobjs_config, the_repository, &max_children);
+	config_from_gitmodules(gitmodules_recurse_submodules_config, the_repository, &recurse_submodules);
+}
+
 void update_clone_config_from_gitmodules(int *max_jobs)
 {
-	config_from_gitmodules(gitmodules_update_clone_config, the_repository, &max_jobs);
+	config_from_gitmodules(gitmodules_fetchobjs_config, the_repository, &max_jobs);
 }
-- 
2.18.0

Re: [PATCH 7/7] submodule-config: cleanup backward compatibility helpers

[Brandon Williams]

On 06/22, Antonio Ospite wrote:
> Use one callback per configuration setting to handle the generic options
> which have to be supported for backward compatibility.
> 
> This removes some duplication and some support code at the cost of
> parsing the .gitmodules file twice when calling the fetch command.
> 
> Signed-off-by: Antonio Ospite <ao2@ao2.it>

I'm not sure how I feel about this patch, I'm leaning towards not
needing it but I like the idea of eliminating the duplicate code.  One
way you could get rid of having to read the .gitmodules file twice would
be something like the following but I don't really think its needed:


diff --git a/submodule-config.c b/submodule-config.c
index ce204fb53..7cc1864b5 100644
--- a/submodule-config.c
+++ b/submodule-config.c
@@ -681,19 +681,24 @@ void submodule_free(struct repository *r)
 		submodule_cache_clear(r->submodule_cache);
 }
 
-struct fetch_config {
-	int *max_children;
+struct fetch_clone_config {
+	int *fetchjobs;
 	int *recurse_submodules;
 };
 
-static int gitmodules_fetch_config(const char *var, const char *value, void *cb)
+static int gitmodules_fetch_clone_config(const char *var, const char *value,
+					 void *cb)
 {
-	struct fetch_config *config = cb;
+	struct fetch_clone_config *config = cb;
 	if (!strcmp(var, "submodule.fetchjobs")) {
-		*(config->max_children) = parse_submodule_fetchjobs(var, value);
+		if (config->fetchjobs)
+			*(config->fetchjobs) =
+				parse_submodule_fetchjobs(var, value);
 		return 0;
 	} else if (!strcmp(var, "fetch.recursesubmodules")) {
-		*(config ->recurse_submodules) = parse_fetch_recurse_submodules_arg(var, value);
+		if (config->recurse_submodules)
+			*(config->recurse_submodules) =
+				parse_fetch_recurse_submodules_arg(var, value);
 		return 0;
 	}
 
@@ -702,23 +707,20 @@ static int gitmodules_fetch_config(const char *var, const char *value, void *cb)
 
 void fetch_config_from_gitmodules(int *max_children, int *recurse_submodules)
 {
-	struct fetch_config config = {
-		.max_children = max_children,
-		.recurse_submodules = recurse_submodules
+	struct fetch_clone_config config = {
+		.fetchjobs = max_children,
+		.recurse_submodules = recurse_submodules,
 	};
-	config_from_gitmodules(gitmodules_fetch_config, the_repository, &config);
-}
-
-static int gitmodules_update_clone_config(const char *var, const char *value,
-					  void *cb)
-{
-	int *max_jobs = cb;
-	if (!strcmp(var, "submodule.fetchjobs"))
-		*max_jobs = parse_submodule_fetchjobs(var, value);
-	return 0;
+	config_from_gitmodules(gitmodules_fetch_clone_config, the_repository,
+			       &config);
 }
 
 void update_clone_config_from_gitmodules(int *max_jobs)
 {
-	config_from_gitmodules(gitmodules_update_clone_config, the_repository, &max_jobs);
+	struct fetch_clone_config config = {
+		.fetchjobs = max_jobs,
+		.recurse_submodules = NULL,
+	};
+	config_from_gitmodules(gitmodules_fetch_clone_config, the_repository,
+			       &config);
 }

-- 
Brandon Williams

Re: [PATCH 0/7] Restrict the usage of config_from_gitmodules()

[Brandon Williams]

On 06/22, Antonio Ospite wrote:
> Hi,
> 
> when I tried to reuse and extend 'config_from_gitmodules' in
> https://public-inbox.org/git/20180514105823.8378-2-ao2@ao2.it/ it was
> pointed out to me that special care is needed to make sure that this
> function does not get abused to bring in arbitrary configuration stored
> in the .gitmodules file, as the latter is meant only for submodule
> specific configuration.
> 
> So I thought that the function could be made private to better
> communicate that.
> 
> This is what this series is about.
> 
> Patch 1 moves 'config_from_gitmodules' to submodule-config.c
> 
> Patches 2 and 3 add helpers to handle special cases and avoid calling
> 'config_from_gitmodules' directly, which might set a bad example for
> future code.
> 
> Patch 4 makes the symbol private to discourage its use in code not
> related to submodules.
> 
> Patches 5 and 6 enable reusing 'config_from_gitmodules' when it's safe
> to do so.
> 
> Patches 7 is just a cleanup and I am not even sure it is worth it, so we
> might as well just drop it.
> 
> The series can be seen as a continuation of the changes from
> https://public-inbox.org/git/20170802194923.88239-1-bmwill@google.com/
> 
> Even though the helper functions may be less elegant than what was done
> back then, they should better protect from misuse of
> config_from_gitmodules.
> 
> A further change could be to print warning messages when the backward
> compatibility helpers find configuration in .gitmodules that should not
> belong there, but I'll leave that to someone else.
> 
> Thanks,
>    Antonio
> 
> P.S. I added Jeff King to CC as he has done some work related to
> .gitmodules recently, and I removed the vcsh poeple on this one.
> 

Thanks for working on this.  I think its a good approach and the end
result makes it much harder for arbitrary config to sneak back in to the
.gitmodules file.  And after this series it looks like you should be in
a good place to read the .gitmodules file from other places (not just in
the worktree).

As you've mentioned here I also agree we could do without the last patch
but I'll leave that up to you.  Other than a couple typos I found I
think this series looks good!  Thanks again for revisiting this.

-- 
Brandon Williams

Re: [PATCH 0/7] Restrict the usage of config_from_gitmodules()

[Antonio Ospite]

On Fri, 22 Jun 2018 10:13:10 -0700
Brandon Williams <bmwill@google.com> wrote:

[...] 
> Thanks for working on this.  I think its a good approach and the end
> result makes it much harder for arbitrary config to sneak back in to the
> .gitmodules file.  And after this series it looks like you should be in
> a good place to read the .gitmodules file from other places (not just in
> the worktree).
>

:)

> As you've mentioned here I also agree we could do without the last patch
> but I'll leave that up to you.  Other than a couple typos I found I
> think this series looks good!  Thanks again for revisiting this.
>

Thanks for the review.

I understand your compromise solution for patch 7, but I'd say let's
keep it simple and just drop patch 7 for now.

I am going to wait a couple of days and then send a v2.

Ciao,
   Antonio

-- 
Antonio Ospite
https://ao2.it
https://twitter.com/ao2it

A: Because it messes up the order in which people normally read text.
   See http://en.wikipedia.org/wiki/Posting_style
Q: Why is top-posting such a bad thing?

Re: [PATCH 0/7] Restrict the usage of config_from_gitmodules()

[Brandon Williams]

On 06/22, Antonio Ospite wrote:
> On Fri, 22 Jun 2018 10:13:10 -0700
> Brandon Williams <bmwill@google.com> wrote:
> 
> [...] 
> > Thanks for working on this.  I think its a good approach and the end
> > result makes it much harder for arbitrary config to sneak back in to the
> > .gitmodules file.  And after this series it looks like you should be in
> > a good place to read the .gitmodules file from other places (not just in
> > the worktree).
> >
> 
> :)
> 
> > As you've mentioned here I also agree we could do without the last patch
> > but I'll leave that up to you.  Other than a couple typos I found I
> > think this series looks good!  Thanks again for revisiting this.
> >
> 
> Thanks for the review.
> 
> I understand your compromise solution for patch 7, but I'd say let's
> keep it simple and just drop patch 7 for now.

Yeah that's probably the best approach for the time being.

> 
> I am going to wait a couple of days and then send a v2.

Perfect, thanks again!

-- 
Brandon Williams