diff options
| author | Bryce Kwon <bryce@brycekwon.com> | |
|---|---|---|
| committer | Bryce Kwon <bryce@brycekwon.com> | |
| commit | ||
| parent | ||
| tree | ||
| download | ||
Reject option-like revisions in the log walk
The log page passed the `id` query parameter to git's revision parser
without resolving it and ahead of the end-of-options marker. A value
like `id=--output=/path` was then parsed as an option, so an
unauthenticated request could create or truncate any file the server
user could write. No valid ref or object name begins with a dash.
Diffstat (limited to '')
0 files changed, 0 insertions, 0 deletions