Hold a scanned defbranch to a ref name

The index stats the default branch below the repository to date it,
and a scanned repository sets its own defbranch, which was not held to
what a ref may hold, so one spelled as a path reached a file outside.

2 files changed, 14 insertions, 1 deletion

diff --git a/source/ui-repolist.c b/source/ui-repolist.cindex 24d5479..58e31ed 100644--- a/source/ui-repolist.c+++ b/source/ui-repolist.c@@ -56,8 +56,10 @@ static const char *tip_branch(const struct cgit_repo *repo, struct strbuf *head) 	struct strbuf path = STRBUF_INIT; 	const char *branch = repo->defbranch; +	// A scanned repository sets its own defbranch, which is stat'ed below+	// the repository, so it is held to what a ref name may hold. 	if (branch)-		return branch;+		return check_refname_format(branch, REFNAME_ALLOW_ONELEVEL) ? "master" : branch;  	strbuf_addf(&path, "%s/HEAD", repo->path); 	if (strbuf_read_file(head, path.buf, 0) > 0) {
diff --git a/source/ui-repolist.c b/source/ui-repolist.c
index 24d5479..58e31ed 100644
--- a/source/ui-repolist.c
+++ b/source/ui-repolist.c
@@ -56,8 +56,10 @@ static const char *tip_branch(const struct cgit_repo *repo, struct strbuf *head)
 	struct strbuf path = STRBUF_INIT;
 	const char *branch = repo->defbranch;
 
+	// A scanned repository sets its own defbranch, which is stat'ed below
+	// the repository, so it is held to what a ref name may hold.
 	if (branch)
-		return branch;
+		return check_refname_format(branch, REFNAME_ALLOW_ONELEVEL) ? "master" : branch;
 
 	strbuf_addf(&path, "%s/HEAD", repo->path);
 	if (strbuf_read_file(head, path.buf, 0) > 0) {
diff --git a/tests/t0303-robustness.sh b/tests/t0303-robustness.shindex b53a38d..07f7c09 100755--- a/tests/t0303-robustness.sh+++ b/tests/t0303-robustness.sh@@ -855,4 +855,15 @@ test_expect_success 'a notes ref that names no tree is passed over' ' 	grep "^Status: 404" tmp ' +# A scanned repository names its own default branch, which the index stats+# below the repository to date it, so the name is held to what a ref may be.+test_expect_success 'a scanned defbranch cannot name a path outside the repository' '+	mkdir -p secret &&+	touch -t 200001010000 secret/file &&+	echo "defbranch=../../../../secret/file" >scan/b.git/cgitrc &&+	CGIT_CONFIG="$PWD/gitcfgrc" QUERY_STRING="url=" cgit >tmp &&+	grep ">b.git</a>" tmp &&+	! grep "data-ut=.946" tmp+'+ test_done
diff --git a/tests/t0303-robustness.sh b/tests/t0303-robustness.sh
index b53a38d..07f7c09 100755
--- a/tests/t0303-robustness.sh
+++ b/tests/t0303-robustness.sh
@@ -855,4 +855,15 @@ test_expect_success 'a notes ref that names no tree is passed over' '
 	grep "^Status: 404" tmp
 '
 
+# A scanned repository names its own default branch, which the index stats
+# below the repository to date it, so the name is held to what a ref may be.
+test_expect_success 'a scanned defbranch cannot name a path outside the repository' '
+	mkdir -p secret &&
+	touch -t 200001010000 secret/file &&
+	echo "defbranch=../../../../secret/file" >scan/b.git/cgitrc &&
+	CGIT_CONFIG="$PWD/gitcfgrc" QUERY_STRING="url=" cgit >tmp &&
+	grep ">b.git</a>" tmp &&
+	! grep "data-ut=.946" tmp
+'
+
 test_done