Diff options
| author | Bryce Kwon <bryce@brycekwon.com> | |
|---|---|---|
| committer | Bryce Kwon <bryce@brycekwon.com> | |
| commit | ||
| parent | ||
| tree | ||
| download | ||
Hold a scanned defbranch to a ref name
The index stats the default branch below the repository to date it,
and a scanned repository sets its own defbranch, which was not held to
what a ref may hold, so one spelled as a path reached a file outside.
| -rw-r--r-- | source/ui-repolist.c | 4 | |
| -rwxr-xr-x | tests/t0303-robustness.sh | 11 |
2 files changed, 14 insertions, 1 deletion
diff --git a/source/ui-repolist.c b/source/ui-repolist.c index 24d5479..58e31ed 100644 --- a/source/ui-repolist.c +++ b/source/ui-repolist.c @@ -56,8 +56,10 @@ static const char *tip_branch(const struct cgit_repo *repo, struct strbuf *head) struct strbuf path = STRBUF_INIT; const char *branch = repo->defbranch; + // A scanned repository sets its own defbranch, which is stat'ed below + // the repository, so it is held to what a ref name may hold. if (branch) - return branch; + return check_refname_format(branch, REFNAME_ALLOW_ONELEVEL) ? "master" : branch; strbuf_addf(&path, "%s/HEAD", repo->path); if (strbuf_read_file(head, path.buf, 0) > 0) { diff --git a/tests/t0303-robustness.sh b/tests/t0303-robustness.sh index 9969687..45c17f5 100755 --- a/tests/t0303-robustness.sh +++ b/tests/t0303-robustness.sh @@ -855,4 +855,15 @@ test_expect_success 'a notes ref that names no tree is passed over' ' grep "^Status: 404" tmp ' +# A scanned repository names its own default branch, which the index stats +# below the repository to date it, so the name is held to what a ref may be. +test_expect_success 'a scanned defbranch cannot name a path outside the repository' ' + mkdir -p secret && + touch -t 200001010000 secret/file && + echo "defbranch=../../../../secret/file" >scan/b.git/cgitrc && + CGIT_CONFIG="$PWD/gitcfgrc" QUERY_STRING="url=" cgit >tmp && + grep ">b.git</a>" tmp && + ! grep "data-ut=.946" tmp +' + test_done |