summaryrefslogtreecommitdiff
path: root/ui-clone.c
diff options
context:
space:
mode:
authorKatolaZ <katolaz@freaknet.org>2018-08-06 12:16:09 +0100
committerKatolaZ <katolaz@freaknet.org>2018-08-06 12:16:09 +0100
commitfcc9b201ea499a424b3bda8c504c7beb7e0ec0bd (patch)
treeec799ab66ed4119b68268192ea8fbe62a96b51aa /ui-clone.c
parent5897d950ec1fa084091b06b11a7dca96dc3253a4 (diff)
parent824138e59194acaf5efe53690d4ef6eaf38e1549 (diff)
Merge remote-tracking branch 'upstream/master' into upstreamupstream
Diffstat (limited to 'ui-clone.c')
-rw-r--r--ui-clone.c23
1 files changed, 19 insertions, 4 deletions
diff --git a/ui-clone.c b/ui-clone.c
index 2c1ac3d..6ba8f36 100644
--- a/ui-clone.c
+++ b/ui-clone.c
@@ -92,17 +92,32 @@ void cgit_clone_info(void)
void cgit_clone_objects(void)
{
- if (!ctx.qry.path) {
- cgit_print_error_page(400, "Bad request", "Bad request");
- return;
- }
+ char *p;
+
+ if (!ctx.qry.path)
+ goto err;
if (!strcmp(ctx.qry.path, "info/packs")) {
print_pack_info();
return;
}
+ /* Avoid directory traversal by forbidding "..", but also work around
+ * other funny business by just specifying a fairly strict format. For
+ * example, now we don't have to stress out about the Cygwin port.
+ */
+ for (p = ctx.qry.path; *p; ++p) {
+ if (*p == '.' && *(p + 1) == '.')
+ goto err;
+ if (!isalnum(*p) && *p != '/' && *p != '.' && *p != '-')
+ goto err;
+ }
+
send_file(git_path("objects/%s", ctx.qry.path));
+ return;
+
+err:
+ cgit_print_error_page(400, "Bad request", "Bad request");
}
void cgit_clone_head(void)