Diff options
| author | Bryce Kwon <bryce@brycekwon.com> | |
|---|---|---|
| committer | Bryce Kwon <bryce@brycekwon.com> | |
| commit | ||
| parent | ||
| tree | ||
| download | ||
Refuse pathspec magic through one helper
| -rw-r--r-- | source/ui-atom.c | 7 | |
| -rw-r--r-- | source/ui-log.c | 6 | |
| -rw-r--r-- | source/ui-patch.c | 6 | |
| -rw-r--r-- | source/ui-shared.c | 8 | |
| -rw-r--r-- | source/ui-shared.h | 7 | |
| -rw-r--r-- | source/ui-stats.c | 6 |
6 files changed, 19 insertions, 21 deletions
diff --git a/source/ui-atom.c b/source/ui-atom.c index c9194f6..b9762b1 100644 --- a/source/ui-atom.c +++ b/source/ui-atom.c @@ -160,13 +160,8 @@ void cgit_print_atom(char *tip, const char *path, int max_count) int argc = 2; bool need_updated = true; - // A leading colon makes git read the path as a pathspec with magic, - // which can end the request inside git, so the feed refuses it as the - // log does. - if (path && path[0] == ':') { - cgit_print_error_page(400, "Bad Request", "Invalid path"); + if (cgit_refuse_pathspec_magic(path)) return; - } if (ctx.qry.show_all) argv[1] = "--all"; diff --git a/source/ui-log.c b/source/ui-log.c index 4bb4b06..128c01f 100644 --- a/source/ui-log.c +++ b/source/ui-log.c @@ -479,12 +479,8 @@ void cgit_print_log(const char *tip, int ofs, int cnt, const char *grep, const c } strvec_push(&rev_argv, tip); - // A leading colon makes git read the path as a pathspec with magic, - // which can end the request inside git. - if (path && path[0] == ':') { - cgit_print_error_page(400, "Bad Request", "Invalid path"); + if (cgit_refuse_pathspec_magic(path)) goto out; - } if (grep && pattern && *pattern) { if (!strcmp(grep, "grep") || !strcmp(grep, "author") || !strcmp(grep, "committer")) { diff --git a/source/ui-patch.c b/source/ui-patch.c index d4a8c5a..0d29e38 100644 --- a/source/ui-patch.c +++ b/source/ui-patch.c @@ -28,12 +28,8 @@ void cgit_print_patch(const char *new_rev, const char *old_rev, const char *pref if (!new_rev) new_rev = ctx.qry.head; - // A leading colon makes git read the path as a pathspec with magic, - // which can end the request inside git after the headers are out. - if (prefix && prefix[0] == ':') { - cgit_print_error_page(400, "Bad Request", "Invalid path"); + if (cgit_refuse_pathspec_magic(prefix)) return; - } commit = cgit_get_commit(new_rev, &new_oid); if (!commit || cgit_get_old_oid(old_rev, commit, &old_oid)) diff --git a/source/ui-shared.c b/source/ui-shared.c index cef57eb..fc4e559 100644 --- a/source/ui-shared.c +++ b/source/ui-shared.c @@ -1534,6 +1534,14 @@ int cgit_prepare_walk(struct rev_info *rev) return -1; } +int cgit_refuse_pathspec_magic(const char *path) +{ + if (!path || path[0] != ':') + return 0; + cgit_print_error_page(400, "Bad Request", "Invalid path"); + return -1; +} + static void add_clone_urls(void (*fn)(const char *), char *urls, char *suffix) { struct strbuf **url_list = strbuf_split_str(urls, ' ', 0); diff --git a/source/ui-shared.h b/source/ui-shared.h index fa8d8dd..87f9c60 100644 --- a/source/ui-shared.h +++ b/source/ui-shared.h @@ -142,6 +142,13 @@ extern int cgit_get_old_oid(const char *old_rev, const struct commit *commit, st */ extern int cgit_prepare_walk(struct rev_info *rev); +/* + * Refuse a path with a leading colon, printing the 400 page. git reads such a + * path as a pathspec with magic, which can end the request inside git. + * Returns non-zero when the path was refused. + */ +extern int cgit_refuse_pathspec_magic(const char *path); + extern void cgit_print_filemode(unsigned short mode); extern void cgit_print_snapshot_links(const struct cgit_repo *repo, const char *ref, const char *separator); diff --git a/source/ui-stats.c b/source/ui-stats.c index 83a4ee9..a0ad442 100644 --- a/source/ui-stats.c +++ b/source/ui-stats.c @@ -409,12 +409,8 @@ void cgit_show_stats(void) cgit_print_error_page(400, "Bad Request", "Statistics type disabled: %s", period->name); return; } - // A leading colon makes git read the path as a pathspec with magic, - // which can end the request inside git. - if (ctx.qry.path && ctx.qry.path[0] == ':') { - cgit_print_error_page(400, "Bad Request", "Invalid path"); + if (cgit_refuse_pathspec_magic(ctx.qry.path)) return; - } if (collect_stats(period, &authors)) return; QSORT(authors.items, authors.nr, cmp_total_commits); |