Diff options
| author | Bryce Kwon <bryce@brycekwon.com> | |
|---|---|---|
| committer | Bryce Kwon <bryce@brycekwon.com> | |
| commit | ||
| parent | ||
| tree | ||
| download | ||
Refuse pathspec magic on the stats page
Diffstat (limited to 'source')
| -rw-r--r-- | source/ui-stats.c | 6 |
1 file changed, 6 insertions, 0 deletions
diff --git a/source/ui-stats.c b/source/ui-stats.c index 6cb2653..555b795 100644 --- a/source/ui-stats.c +++ b/source/ui-stats.c @@ -452,6 +452,12 @@ void cgit_show_stats(void) cgit_print_error_page(400, "Bad Request", "Statistics type disabled: %s", period->name); return; } + // A leading colon makes git read the path as a pathspec with magic, + // which can end the request inside git. + if (ctx.qry.path && ctx.qry.path[0] == ':') { + cgit_print_error_page(400, "Bad Request", "Invalid path"); + return; + } if (collect_stats(period, &authors)) return; cgit_qsort(authors.items, authors.nr, sizeof(struct string_list_item), cmp_total_commits); |