[PATCH 01/15] remote: validate --force-with-lease <refname> argument

[Jon Simons <jon@jonsimons.org>]

Use check_refname_format() to validate the <refname> component of
'git push --force-with-lease=<refname>[:<expect>]'.

apply_push_cas() will silently ignore a lease entry that does not match
any remote ref.  And today "./refs/heads/main" will happen to be matched
with "refs/heads/main" due to refname_match() usage of mkpath(), whose
cleanup_path() strips leading "./".

An upcoming commit removes mkpath() from refname_match(), after which
there is no unintentional match in this situation, so that the lease
is ignored instead of applied.  Reject an invalid refname now to make
this situation fail fast both before and after that change.

Signed-off-by: Jon Simons <jon@jonsimons.org>
---
 remote.c            | 2 ++
 t/t5533-push-cas.sh | 9 +++++++++
 2 files changed, 11 insertions(+)

diff --git a/remote.c b/remote.c
index 71170f36a9..114d4d983c 100644
--- a/remote.c
+++ b/remote.c
@@ -2740,6 +2740,8 @@ static int parse_push_cas_option(struct push_cas_option *cas, const char *arg, i
 	/* "--<option>=refname" or "--<option>=refname:value" */
 	colon = strchrnul(arg, ':');
 	entry = add_cas_entry(cas, arg, colon - arg);
+	if (check_refname_format(entry->refname, REFNAME_ALLOW_ONELEVEL))
+		return error(_("'%s' is not a valid refname"), entry->refname);
 	if (!*colon)
 		entry->use_tracking = 1;
 	else if (!colon[1])
diff --git a/t/t5533-push-cas.sh b/t/t5533-push-cas.sh
index e6e1360a42..f6eafee7ad 100755
--- a/t/t5533-push-cas.sh
+++ b/t/t5533-push-cas.sh
@@ -63,6 +63,15 @@ test_expect_success setup '
 	test_commit C
 '
 
+test_expect_success 'push --force-with-lease rejects invalid refname' '
+	setup_srcdst_basic &&
+	(
+		cd dst &&
+		test_must_fail git push --force-with-lease=./refs/heads/main origin main 2>err &&
+		test_grep "is not a valid refname" err
+	)
+'
+
 test_expect_success 'push to update (protected)' '
 	setup_srcdst_basic &&
 	(
-- 
2.55.0