Add version check for versions vulnerable to CVE-2024-32002

Cargo.toml

@@ -1,6 +1,6 @@
 [package]
 name = "magoo"
-version = "0.2.0"
+version = "0.2.1"
 edition = "2021"
 description = "A wrapper for git submodule that simplifies the workflows"
 repository = "https://github.com/Pistonite/magoo"
@@ -20,6 +20,7 @@ exclude = [
 clap = { version = "4.5.4", features = ["derive"], optional = true }
 fs4 = "0.8.2"
 pathdiff = "0.2.1"
+semver = "1.0.23"
 termcolor = "1.4.1"
 thiserror = "1.0.59"
 which = "6.0.1"

README.md

@@ -42,14 +42,17 @@ See https://docs.rs/magoo for more info.
 ## Use ![magoo](https://raw.githubusercontent.com/Pistonite/magoo/main/magoo.webp)
 
 ![magoo](https://raw.githubusercontent.com/Pistonite/magoo/main/magoo.webp) runs `git` commands using sub-processes, so you must have `git` installed on the system.
-To check the version info, run
+By default, ![magoo](https://raw.githubusercontent.com/Pistonite/magoo/main/magoo.webp) checks if the `git` version is supported.
+To print what version is supported manually, run:
 ```
 magoo status --git
 ```
 
-Unsupported versions might work as well, ![magoo](https://raw.githubusercontent.com/Pistonite/magoo/main/magoo.webp) just doesn't know.
-
-**git <=2.42.0 doesn't work due to a bug in set-branch and set-url commands**
+Unsupported versions might work as well, you can let ![magoo](https://raw.githubusercontent.com/Pistonite/magoo/main/magoo.webp) know with the `--allow-unsupported` flag (note
+it needs to be before the subcommand)
+```
+magoo --allow-unsupported status
+```
 
 
 ### Add a submodule

README.txtpp.md

@@ -64,16 +64,21 @@ TXTPP#include magoo.txt
 TXTPP#tag MAGOO
 TXTPP#include magoo.txt
 MAGOO runs `git` commands using sub-processes, so you must have `git` installed on the system.
-To check the version info, run
+TXTPP#tag MAGOO
+TXTPP#include magoo.txt
+By default, MAGOO checks if the `git` version is supported.
+To print what version is supported manually, run:
 ```
 magoo status --git
 ```
 
 TXTPP#tag MAGOO
 TXTPP#include magoo.txt
-Unsupported versions might work as well, MAGOO just doesn't know.
-
-**git <=2.42.0 doesn't work due to a bug in set-branch and set-url commands**
+Unsupported versions might work as well, you can let MAGOO know with the `--allow-unsupported` flag (note
+it needs to be before the subcommand)
+```
+magoo --allow-unsupported status
+```
 
 
 ### Add a submodule

src/git.rs

@@ -9,12 +9,10 @@ use std::time::Duration;
 
 use fs4::FileExt;
 
-use crate::print::{self, println_info, println_verbose, println_warn};
-
-/// The semver notation of the officially supported git versions
-///
-/// The version is not checked at run time, since unsupported versions might work fine.
-pub const SUPPORTED_GIT_VERSIONS: &str = ">=2.43.0";
+use crate::print::{
+    self, println_error, println_hint, println_info, println_verbose, println_warn,
+};
+use crate::version;
 
 /// Context for running git commands
 pub struct GitContext {
@@ -57,14 +55,31 @@ impl GitContext {
         Guard::new(lock_path)
     }
 
-    /// Print the supported git version info and current git version into
-    pub fn print_version_info(&self) -> Result<(), GitError> {
-        println_info!(
-            "The officially supported git versions are: {}",
-            super::SUPPORTED_GIT_VERSIONS
-        );
-        println_info!("Your `git --version` is:");
-        self.run_git_command(&["--version"], true)?;
+    /// Check if the version is supported. If print is true, it will print the info when the
+    /// version is supported. Otherwise only print if it's not supported
+    pub fn check_version(&self, print: bool) -> Result<(), GitError> {
+        let out = self.run_git_command(&["--version"], false)?.join("");
+        let version = version::parse_git_version(&out).ok_or_else(|| {
+            GitError::UnsupportedVersion("nnable to parse git version".to_string())
+        })?;
+        if !version::is_supported(&version) {
+            println_error!("Magoo does not support your git version!");
+            println_error!("Your version is: {}", version);
+            println_hint!(
+                "Supported versions are: {}",
+                version::get_supported_versions()
+            );
+            println_hint!("Please upgrade your git to a supported version or use `magoo --allow-unsupported COMMAND`");
+            return Err(GitError::UnsupportedVersion(version.to_string()));
+        }
+        if print {
+            println_info!("Magoo supports your git version.");
+            println_info!("Your version is: {}", version);
+            println_info!(
+                "Supported versions are: {}",
+                version::get_supported_versions()
+            );
+        }
         Ok(())
     }
 
@@ -599,6 +614,9 @@ pub enum GitError {
 
     #[error("fix the issues above and try again.")]
     NeedFix(bool /* should show fatal */),
+
+    #[error("unsupported git version: {0}")]
+    UnsupportedVersion(String),
 }
 
 /// Helper trait to canonicalize a path and return a [`GitError`] if failed