Disable owner validation for Cargo-as-a-binary

diff --git a/src/bin/cargo/main.rs b/src/bin/cargo/main.rs
index a29b77b3cdfc37caa08df0619a652375a190e06a..1619b487b2ff8c4f09b66171806e53a1d6ed19fe 100644 (file)
--- a/src/bin/cargo/main.rs
+++ b/src/bin/cargo/main.rs
@@ -255,4 +255,27 @@ fn init_git_transports(config: &Config) {
     unsafe {
         git2_curl::register(handle);
     }
+
+    // Disabling the owner validation in git can, in theory, lead to code execution
+    // vulnerabilities. However, libgit2 does not launch executables, which is the foundation of
+    // the original security issue. Meanwhile, issues with refusing to load git repos in
+    // `CARGO_HOME` for example will likely be very frustrating for users. So, we disable the
+    // validation.
+    //
+    // For further discussion of Cargo's current interactions with git, see
+    //
+    //   https://github.com/rust-lang/rfcs/pull/3279
+    //
+    // and in particular the subsection on "Git support".
+    //
+    // Note that we only disable this when Cargo is run as a binary. If Cargo is used as a library,
+    // this code won't be invoked. Instead, developers will need to explicitly disable the
+    // validation in their code. This is inconvenient, but won't accidentally open consuming
+    // applications up to security issues if they use git2 to open repositories elsewhere in their
+    // code.
+    unsafe {
+        if git2::opts::set_verify_owner_validation(false).is_err() {
+            return;
+        }
+    }
 }