push: Do not blindly overwrite peer

If an application uses PushConnection directly on the native Git wire
protocols JGit should send along the application's expected oldId, not
the advertised value.  This allows the remote peer to compare-and-swap
since it was not tested inside JGit.

Discovered when I tried to use a PushConnection (bypassing the
standard PushProcess) and the client blindly overwrote the remote
reference, even though my app had supplied the wrong ObjectId for
the expectedOldObjectId. This was not expected and cost me over an
hour of debugging, plus "corruption" in the remote repository.

By passing along the exact expectedOldObjectId from the app the
remote side can do the check that the application skipped, and
avoid data loss.

Change-Id: Id3920837e6c47100376225bb4dd61fa3e88c64db

org.eclipse.jgit.test/tst/org/eclipse/jgit/transport/PushConnectionTest.java

@@ -0,0 +1,143 @@
+/*
+ * Copyright (C) 2015, Google Inc.
+ * and other copyright owners as documented in the project's IP log.
+ *
+ * This program and the accompanying materials are made available
+ * under the terms of the Eclipse Distribution License v1.0 which
+ * accompanies this distribution, is reproduced below, and is
+ * available at http://www.eclipse.org/org/documents/edl-v10.php
+ *
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or
+ * without modification, are permitted provided that the following
+ * conditions are met:
+ *
+ * - Redistributions of source code must retain the above copyright
+ *   notice, this list of conditions and the following disclaimer.
+ *
+ * - Redistributions in binary form must reproduce the above
+ *   copyright notice, this list of conditions and the following
+ *   disclaimer in the documentation and/or other materials provided
+ *   with the distribution.
+ *
+ * - Neither the name of the Eclipse Foundation, Inc. nor the
+ *   names of its contributors may be used to endorse or promote
+ *   products derived from this software without specific prior
+ *   written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND
+ * CONTRIBUTORS "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES,
+ * INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
+ * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+ * ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
+ * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER
+ * CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
+ * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF
+ * ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+package org.eclipse.jgit.transport;
+
+import static org.eclipse.jgit.transport.RemoteRefUpdate.Status.REJECTED_OTHER_REASON;
+import static org.junit.Assert.assertEquals;
+
+import java.io.IOException;
+import java.util.HashMap;
+import java.util.Map;
+
+import org.eclipse.jgit.internal.storage.dfs.DfsRepositoryDescription;
+import org.eclipse.jgit.internal.storage.dfs.InMemoryRepository;
+import org.eclipse.jgit.lib.Constants;
+import org.eclipse.jgit.lib.NullProgressMonitor;
+import org.eclipse.jgit.lib.ObjectId;
+import org.eclipse.jgit.lib.ObjectInserter;
+import org.eclipse.jgit.lib.RefUpdate;
+import org.eclipse.jgit.lib.Repository;
+import org.eclipse.jgit.transport.resolver.ReceivePackFactory;
+import org.eclipse.jgit.transport.resolver.ServiceNotAuthorizedException;
+import org.eclipse.jgit.transport.resolver.ServiceNotEnabledException;
+import org.junit.After;
+import org.junit.Before;
+import org.junit.Test;
+
+public class PushConnectionTest {
+	private URIish uri;
+	private TestProtocol<Object> testProtocol;
+	private Object ctx = new Object();
+	private InMemoryRepository server;
+	private InMemoryRepository client;
+	private ObjectId obj1;
+	private ObjectId obj2;
+	private ObjectId obj3;
+	private String refName = "refs/tags/blob";
+
+	@Before
+	public void setUp() throws Exception {
+		server = newRepo("server");
+		client = newRepo("client");
+		testProtocol = new TestProtocol<>(
+				null,
+				new ReceivePackFactory<Object>() {
+					@Override
+					public ReceivePack create(Object req, Repository db)
+							throws ServiceNotEnabledException,
+							ServiceNotAuthorizedException {
+						return new ReceivePack(db);
+					}
+				});
+		uri = testProtocol.register(ctx, server);
+
+		try (ObjectInserter ins = server.newObjectInserter()) {
+			obj1 = ins.insert(Constants.OBJ_BLOB, Constants.encode("test"));
+			obj3 = ins.insert(Constants.OBJ_BLOB, Constants.encode("not"));
+			ins.flush();
+
+			RefUpdate u = server.updateRef(refName);
+			u.setNewObjectId(obj1);
+			assertEquals(RefUpdate.Result.NEW, u.update());
+		}
+
+		try (ObjectInserter ins = client.newObjectInserter()) {
+			obj2 = ins.insert(Constants.OBJ_BLOB, Constants.encode("file"));
+			ins.flush();
+		}
+	}
+
+	@After
+	public void tearDown() {
+		Transport.unregister(testProtocol);
+	}
+
+	private static InMemoryRepository newRepo(String name) {
+		return new InMemoryRepository(new DfsRepositoryDescription(name));
+	}
+
+	@Test
+	public void testWrongOldIdDoesNotReplace() throws IOException {
+		RemoteRefUpdate rru = new RemoteRefUpdate(null, null, obj2, refName,
+				false, null, obj3);
+
+		Map<String, RemoteRefUpdate> updates = new HashMap<>();
+		updates.put(rru.getRemoteName(), rru);
+
+		Transport tn = testProtocol.open(uri, client, "server");
+		try {
+			PushConnection connection = tn.openPush();
+			try {
+				connection.push(NullProgressMonitor.INSTANCE, updates);
+			} finally {
+				connection.close();
+			}
+		} finally {
+			tn.close();
+		}
+
+		assertEquals(REJECTED_OTHER_REASON, rru.getStatus());
+		assertEquals("invalid old id sent", rru.getMessage());
+	}
+}

org.eclipse.jgit/src/org/eclipse/jgit/transport/BasePackPushConnection.java

@@ -237,9 +237,11 @@ public abstract class BasePackPushConnection extends BasePackConnection implemen
 			}
 
 			final StringBuilder sb = new StringBuilder();
-			final Ref advertisedRef = getRef(rru.getRemoteName());
+			ObjectId oldId = rru.getExpectedOldObjectId();
-			final ObjectId oldId = (advertisedRef == null ? ObjectId.zeroId()
+			if (oldId == null) {
-					: advertisedRef.getObjectId());
+				Ref adv = getRef(rru.getRemoteName());
+				oldId = adv != null ? adv.getObjectId() : ObjectId.zeroId();
+			}
 			sb.append(oldId.name());
 			sb.append(' ');
 			sb.append(rru.getNewObjectId().name());

org.eclipse.jgit/src/org/eclipse/jgit/transport/PushProcess.java

@@ -212,6 +212,9 @@ class PushProcess {
 				}
 				continue;
 			}
+			if (!rru.isExpectingOldObjectId()) {
+				rru.setExpectedOldObjectId(advertisedOld);
+			}
 
 			// create ref (hasn't existed on remote side) and delete ref
 			// are always fast-forward commands, feasible at this level

org.eclipse.jgit/src/org/eclipse/jgit/transport/RemoteRefUpdate.java

@@ -125,7 +125,7 @@ public class RemoteRefUpdate {
 		OK;
 	}
 
-	private final ObjectId expectedOldObjectId;
+	private ObjectId expectedOldObjectId;
 
 	private final ObjectId newObjectId;
 
@@ -440,6 +440,10 @@ public class RemoteRefUpdate {
 		return message;
 	}
 
+	void setExpectedOldObjectId(ObjectId id) {
+		expectedOldObjectId = id;
+	}
+
 	void setStatus(final Status status) {
 		this.status = status;
 	}